Merge remote-tracking branch 'origin/main' into feature/resolver

# Conflicts:
#	internal/resolver/errors.go
#	internal/resolver/resolver.go
#	internal/resolver/resolver_test.go

.golangci.yml

@@ -1,9 +1,5 @@
 version: "2"
 
-# Config schema uses the golangci-lint v2 layout (settings live under
-# linters.settings, not top-level linters-settings) so that the
-# thresholds below are actually applied by golangci-lint >= v2.
-
 run:
   timeout: 5m
   modules-download-mode: readonly
@@ -18,17 +14,19 @@ linters:
     - wsl              # Deprecated, replaced by wsl_v5
     - wrapcheck        # Too verbose for internal packages
     - varnamelen       # Short names like db, id are idiomatic Go
-  settings:
+
-    lll:
+linters-settings:
-      line-length: 88
+  lll:
-    funlen:
+    line-length: 88
-      lines: 80
+  funlen:
-      statements: 50
+    lines: 80
-    cyclop:
+    statements: 50
-      max-complexity: 15
+  cyclop:
-    dupl:
+    max-complexity: 15
-      threshold: 100
+  dupl:
+    threshold: 100
 
 issues:
+  exclude-use-default: false
   max-issues-per-linter: 0
   max-same-issues: 0

Dockerfile

@@ -4,8 +4,8 @@ FROM golang@sha256:f6751d823c26342f9506c03797d2527668d095b0a15f1862cddb4d927a7a4
 
 RUN apk add --no-cache git make gcc musl-dev binutils-gold
 
-# golangci-lint v2.12.2, 2026-08-07
+# golangci-lint v2.10.1
-RUN go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@c0d3ddc9cf3faa61a4e378e879ece580256d76e5
+RUN go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@5d1e709b7be35cb2025444e19de266b056b7b7ee
 # goimports v0.42.0
 RUN go install golang.org/x/tools/cmd/goimports@009367f5c17a8d4c45a961a3a509277190a9a6f0
 

README.md

@@ -17,26 +17,6 @@ without requiring an external database.
 
 ---
 
-## No DNS mocking. Ever.
-
-**DNS is never mocked in this project — not in tests, not anywhere else.**
-No mock resolvers, no fake DNS servers, no stubbed lookups.
-
-dnswatcher's entire purpose is correct behavior against the real DNS.
-Tests exercise real iterative resolution against live nameservers by
-design; a test suite that passes against a mock proves nothing about the
-one thing this program exists to do.
-
-When live tests are flaky, that is a robustness problem, and it gets
-fixed with robustness: retries with backoff, querying multiple
-independent nameservers, longer timeouts — or explicit opt-in gating
-decided by the project owner. Never with mocks.
-
-Contributions that introduce mocked, faked, or stubbed DNS will be
-rejected.
-
----
-
 ## Features
 
 ### DNS Domain Monitoring (Apex Domains)
@@ -218,8 +198,7 @@ internal/
 - **Structured logging**: All logs use `log/slog` with JSON output in
   production (TTY detection for development).
 - **Graceful shutdown**: All background goroutines respect context
-  cancellation and the fx lifecycle. In-flight notification deliveries
+  cancellation and the fx lifecycle.
-  are drained on shutdown, bounded by the shutdown timeout.
 
 ---
 
@@ -453,14 +432,8 @@ docker run -d \
      from a previous cycle.
 4. **On change detection**: Send notifications to all configured
    endpoints, update in-memory state, persist to disk.
-5. **Shutdown**: Persist final state to disk, wait for in-flight
+5. **Shutdown**: Persist final state to disk, complete in-flight
-   notification deliveries to complete, stop gracefully. The wait is
+   notifications, stop gracefully.
-   bounded by the fx shutdown timeout (15s by default): deliveries still
-   retrying against an unreachable endpoint when that expires are
-   abandoned, and the number abandoned is logged at warn level rather
-   than dropped silently. Notifications generated after shutdown has
-   begun are refused and logged, so a late burst cannot extend the
-   shutdown.
 
 ---
 

TODO.md

@@ -25,23 +25,6 @@ confirm make check still passes.
 
 # Completed Steps
 
-- 2026-08-09: in-flight notification deliveries are now drained at
-  shutdown (#106): `notify.New` registers an fx `OnStop` hook that waits
-  on a `sync.WaitGroup` of tracked delivery goroutines, bounded by the
-  `OnStop` context; on expiry the outstanding count is logged at warn
-  level and parked retry backoffs are released instead of being dropped
-  silently, and deliveries submitted after the drain begins are refused
-  so shutdown cannot be extended indefinitely; an `OnStop` context that
-  is already expired on entry with nothing outstanding drains quietly
-  rather than warning about deliveries that were never abandoned
-- 2026-08-07: golangci-lint bumped to v2.12.2 (commit-pinned installs
-  in `Dockerfile` and `script/bootstrap`); `.golangci.yml` set to the
-  org-standard v2-schema config used across the org's repos
-  (owner-authorized; same file is being landed as canonical via prompts
-  PR #24), with settings under `linters.settings` so the
-  lll/funlen/cyclop/dupl thresholds apply; fixed the resulting
-  `goconst`, `dupl`, and `lll` findings; the informational `gomodguard`
-  deprecation warning under this config is accepted
 - 2026-07-07 Adopted scripts-to-rule-them-all: `script/` entrypoints,
   Makefile shims, README Entrypoints section
 - 2026-02-20: iterative DNS resolver implemented; tests made hermetic

internal/config/classify_test.go

@@ -17,33 +17,13 @@ func TestClassifyDNSName(t *testing.T) {
 	}{
 		{name: "apex domain simple", input: "example.com", want: config.DNSNameTypeDomain},
 		{name: "hostname simple", input: "www.example.com", want: config.DNSNameTypeHostname},
-		{
+		{name: "apex domain multi-part TLD", input: "example.co.uk", want: config.DNSNameTypeDomain},
-			name:  "apex domain multi-part TLD",
+		{name: "hostname multi-part TLD", input: "api.example.co.uk", want: config.DNSNameTypeHostname},
-			input: "example.co.uk",
-			want:  config.DNSNameTypeDomain,
-		},
-		{
-			name:  "hostname multi-part TLD",
-			input: "api.example.co.uk",
-			want:  config.DNSNameTypeHostname,
-		},
 		{name: "public suffix itself", input: "co.uk", wantErr: true},
 		{name: "empty string", input: "", wantErr: true},
-		{
+		{name: "deeply nested hostname", input: "a.b.c.example.com", want: config.DNSNameTypeHostname},
-			name:  "deeply nested hostname",
+		{name: "trailing dot stripped", input: "example.com.", want: config.DNSNameTypeDomain},
-			input: "a.b.c.example.com",
+		{name: "uppercase normalized", input: "WWW.Example.COM", want: config.DNSNameTypeHostname},
-			want:  config.DNSNameTypeHostname,
-		},
-		{
-			name:  "trailing dot stripped",
-			input: "example.com.",
-			want:  config.DNSNameTypeDomain,
-		},
-		{
-			name:  "uppercase normalized",
-			input: "WWW.Example.COM",
-			want:  config.DNSNameTypeHostname,
-		},
 	}
 
 	for _, tt := range tests {

internal/notify/delivery_test.go

@@ -25,20 +25,6 @@ const (
 	colorDefault = "#6c757d"
 )
 
-// Priority strings used across multiple tests.
-const (
-	prioError   = "error"
-	prioWarning = "warning"
-	prioSuccess = "success"
-	prioInfo    = "info"
-	prioUnknown = "unknown"
-	prioDefault = "default"
-	prioUrgent  = "urgent"
-)
-
-// testHost is the hostname used in request construction tests.
-const testHost = "example.com"
-
 // errSimulated is a static error for transport failures.
 var errSimulated = errors.New("simulated transport failure")
 
@@ -115,13 +101,13 @@ func TestNtfyPriority(t *testing.T) {
 		input string
 		want  string
 	}{
-		{prioError, prioUrgent},
+		{"error", "urgent"},
-		{prioWarning, "high"},
+		{"warning", "high"},
-		{prioSuccess, prioDefault},
+		{"success", "default"},
-		{prioInfo, "low"},
+		{"info", "low"},
-		{"", prioDefault},
+		{"", "default"},
-		{prioUnknown, prioDefault},
+		{"unknown", "default"},
-		{"critical", prioDefault},
+		{"critical", "default"},
 	}
 
 	for _, tc := range cases {
@@ -148,12 +134,12 @@ func TestSlackColor(t *testing.T) {
 		input string
 		want  string
 	}{
-		{prioError, colorError},
+		{"error", colorError},
-		{prioWarning, colorWarning},
+		{"warning", colorWarning},
-		{prioSuccess, colorSuccess},
+		{"success", colorSuccess},
-		{prioInfo, colorInfo},
+		{"info", colorInfo},
 		{"", colorDefault},
-		{prioUnknown, colorDefault},
+		{"unknown", colorDefault},
 		{"critical", colorDefault},
 	}
 
@@ -179,7 +165,7 @@ func TestNewRequest(t *testing.T) {
 
 	target := &url.URL{
 		Scheme: "https",
-		Host:   testHost,
+		Host:   "example.com",
 		Path:   "/webhook",
 	}
 	body := bytes.NewBufferString("hello")
@@ -201,9 +187,9 @@ func TestNewRequest(t *testing.T) {
 		)
 	}
 
-	if req.Host != testHost {
+	if req.Host != "example.com" {
 		t.Errorf(
-			"Host = %q, want %q", req.Host, testHost,
+			"Host = %q, want %q", req.Host, "example.com",
 		)
 	}
 
@@ -231,7 +217,7 @@ func TestNewRequestPreservesContext(t *testing.T) {
 		ctxKey("k"),
 		"v",
 	)
-	target := &url.URL{Scheme: "https", Host: testHost}
+	target := &url.URL{Scheme: "https", Host: "example.com"}
 
 	req := notify.NewRequestForTest(
 		ctx, http.MethodGet, target, http.NoBody,
@@ -303,10 +289,10 @@ func TestSendNtfyHeaders(t *testing.T) {
 		)
 	}
 
-	if captured.priority != prioUrgent {
+	if captured.priority != "urgent" {
 		t.Errorf(
 			"Priority header = %q, want %q",
-			captured.priority, prioUrgent,
+			captured.priority, "urgent",
 		)
 	}
 
@@ -325,10 +311,10 @@ func TestSendNtfyAllPriorities(t *testing.T) {
 		input string
 		want  string
 	}{
-		{prioError, prioUrgent},
+		{"error", "urgent"},
-		{prioWarning, "high"},
+		{"warning", "high"},
-		{prioSuccess, prioDefault},
+		{"success", "default"},
-		{prioInfo, "low"},
+		{"info", "low"},
 	}
 
 	for _, tc := range priorities {
@@ -370,69 +356,56 @@ func TestSendNtfyAllPriorities(t *testing.T) {
 	}
 }
 
-// assertSendStatusError verifies that send returns an error
+func TestSendNtfyClientError(t *testing.T) {
-// wrapping wantErr when the server responds with status.
+	t.Parallel()
-func assertSendStatusError(
-	t *testing.T,
-	status int,
-	wantErr error,
-	send func(*notify.Service, *url.URL) error,
-) {
-	t.Helper()
 
 	srv := httptest.NewServer(
 		http.HandlerFunc(
 			func(w http.ResponseWriter, _ *http.Request) {
-				w.WriteHeader(status)
+				w.WriteHeader(http.StatusForbidden)
 			}),
 	)
 	defer srv.Close()
 
 	svc := notify.NewTestService(srv.Client().Transport)
-	target, _ := url.Parse(srv.URL)
+	topicURL, _ := url.Parse(srv.URL)
 
-	err := send(svc, target)
+	err := svc.SendNtfy(
+		context.Background(), topicURL, "t", "m", "info",
+	)
 	if err == nil {
-		t.Fatalf("expected error for %d response", status)
+		t.Fatal("expected error for 403 response")
 	}
 
-	if !errors.Is(err, wantErr) {
+	if !errors.Is(err, notify.ErrNtfyFailed) {
-		t.Errorf("error = %v, want %v", err, wantErr)
+		t.Errorf("error = %v, want ErrNtfyFailed", err)
 	}
 }
 
-func sendNtfyInfo(
-	svc *notify.Service, target *url.URL,
-) error {
-	return svc.SendNtfy(
-		context.Background(), target, "t", "m", prioInfo,
-	)
-}
-
-func sendSlackInfo(
-	svc *notify.Service, target *url.URL,
-) error {
-	return svc.SendSlack(
-		context.Background(), target, "t", "m", prioInfo,
-	)
-}
-
-func TestSendNtfyClientError(t *testing.T) {
-	t.Parallel()
-
-	assertSendStatusError(
-		t, http.StatusForbidden,
-		notify.ErrNtfyFailed, sendNtfyInfo,
-	)
-}
-
 func TestSendNtfyServerError(t *testing.T) {
 	t.Parallel()
 
-	assertSendStatusError(
+	srv := httptest.NewServer(
-		t, http.StatusInternalServerError,
+		http.HandlerFunc(
-		notify.ErrNtfyFailed, sendNtfyInfo,
+			func(w http.ResponseWriter, _ *http.Request) {
+				w.WriteHeader(http.StatusInternalServerError)
+			}),
 	)
+	defer srv.Close()
+
+	svc := notify.NewTestService(srv.Client().Transport)
+	topicURL, _ := url.Parse(srv.URL)
+
+	err := svc.SendNtfy(
+		context.Background(), topicURL, "t", "m", "info",
+	)
+	if err == nil {
+		t.Fatal("expected error for 500 response")
+	}
+
+	if !errors.Is(err, notify.ErrNtfyFailed) {
+		t.Errorf("error = %v, want ErrNtfyFailed", err)
+	}
 }
 
 func TestSendNtfySuccess(t *testing.T) {
@@ -577,11 +550,11 @@ func TestSendSlackAllColors(t *testing.T) {
 		priority string
 		want     string
 	}{
-		{prioError, colorError},
+		{"error", colorError},
-		{prioWarning, colorWarning},
+		{"warning", colorWarning},
-		{prioSuccess, colorSuccess},
+		{"success", colorSuccess},
-		{prioInfo, colorInfo},
+		{"info", colorInfo},
-		{prioUnknown, colorDefault},
+		{"unknown", colorDefault},
 	}
 
 	for _, tc := range colors {
@@ -633,19 +606,53 @@ func TestSendSlackAllColors(t *testing.T) {
 func TestSendSlackClientError(t *testing.T) {
 	t.Parallel()
 
-	assertSendStatusError(
+	srv := httptest.NewServer(
-		t, http.StatusBadRequest,
+		http.HandlerFunc(
-		notify.ErrSlackFailed, sendSlackInfo,
+			func(w http.ResponseWriter, _ *http.Request) {
+				w.WriteHeader(http.StatusBadRequest)
+			}),
 	)
+	defer srv.Close()
+
+	svc := notify.NewTestService(srv.Client().Transport)
+	webhookURL, _ := url.Parse(srv.URL)
+
+	err := svc.SendSlack(
+		context.Background(), webhookURL, "t", "m", "info",
+	)
+	if err == nil {
+		t.Fatal("expected error for 400 response")
+	}
+
+	if !errors.Is(err, notify.ErrSlackFailed) {
+		t.Errorf("error = %v, want ErrSlackFailed", err)
+	}
 }
 
 func TestSendSlackServerError(t *testing.T) {
 	t.Parallel()
 
-	assertSendStatusError(
+	srv := httptest.NewServer(
-		t, http.StatusBadGateway,
+		http.HandlerFunc(
-		notify.ErrSlackFailed, sendSlackInfo,
+			func(w http.ResponseWriter, _ *http.Request) {
+				w.WriteHeader(http.StatusBadGateway)
+			}),
 	)
+	defer srv.Close()
+
+	svc := notify.NewTestService(srv.Client().Transport)
+	webhookURL, _ := url.Parse(srv.URL)
+
+	err := svc.SendSlack(
+		context.Background(), webhookURL, "t", "m", "error",
+	)
+	if err == nil {
+		t.Fatal("expected error for 502 response")
+	}
+
+	if !errors.Is(err, notify.ErrSlackFailed) {
+		t.Errorf("error = %v, want ErrSlackFailed", err)
+	}
 }
 
 func TestSendSlackNetworkError(t *testing.T) {
@@ -970,62 +977,74 @@ func TestSendNotificationMattermostOnly(t *testing.T) {
 	}
 }
 
-// assertSendNotificationTolerates verifies SendNotification
+func TestSendNotificationNtfyError(t *testing.T) {
-// neither panics nor blocks when the endpoint configured by
+	t.Parallel()
-// setURL responds with status.
-func assertSendNotificationTolerates(
-	t *testing.T,
-	status int,
-	priority string,
-	setURL func(*notify.Service, *url.URL),
-) {
-	t.Helper()
 
 	srv := httptest.NewServer(
 		http.HandlerFunc(
 			func(w http.ResponseWriter, _ *http.Request) {
-				w.WriteHeader(status)
+				w.WriteHeader(http.StatusInternalServerError)
 			}),
 	)
 	defer srv.Close()
 
-	target, _ := url.Parse(srv.URL)
+	ntfyURL, _ := url.Parse(srv.URL)
 
 	svc := notify.NewTestService(http.DefaultTransport)
-	setURL(svc, target)
+	svc.SetNtfyURL(ntfyURL)
 
+	// Should not panic or block.
 	svc.SendNotification(
-		context.Background(), "t", "m", priority,
+		context.Background(), "t", "m", "error",
 	)
 
 	time.Sleep(100 * time.Millisecond)
 }
 
-func TestSendNotificationNtfyError(t *testing.T) {
-	t.Parallel()
-
-	assertSendNotificationTolerates(
-		t, http.StatusInternalServerError, prioError,
-		(*notify.Service).SetNtfyURL,
-	)
-}
-
 func TestSendNotificationSlackError(t *testing.T) {
 	t.Parallel()
 
-	assertSendNotificationTolerates(
+	srv := httptest.NewServer(
-		t, http.StatusForbidden, prioError,
+		http.HandlerFunc(
-		(*notify.Service).SetSlackWebhookURL,
+			func(w http.ResponseWriter, _ *http.Request) {
+				w.WriteHeader(http.StatusForbidden)
+			}),
 	)
+	defer srv.Close()
+
+	slackURL, _ := url.Parse(srv.URL)
+
+	svc := notify.NewTestService(http.DefaultTransport)
+	svc.SetSlackWebhookURL(slackURL)
+
+	svc.SendNotification(
+		context.Background(), "t", "m", "error",
+	)
+
+	time.Sleep(100 * time.Millisecond)
 }
 
 func TestSendNotificationMattermostError(t *testing.T) {
 	t.Parallel()
 
-	assertSendNotificationTolerates(
+	srv := httptest.NewServer(
-		t, http.StatusBadGateway, prioWarning,
+		http.HandlerFunc(
-		(*notify.Service).SetMattermostWebhookURL,
+			func(w http.ResponseWriter, _ *http.Request) {
+				w.WriteHeader(http.StatusBadGateway)
+			}),
 	)
+	defer srv.Close()
+
+	mmURL, _ := url.Parse(srv.URL)
+
+	svc := notify.NewTestService(http.DefaultTransport)
+	svc.SetMattermostWebhookURL(mmURL)
+
+	svc.SendNotification(
+		context.Background(), "t", "m", "warning",
+	)
+
+	time.Sleep(100 * time.Millisecond)
 }
 
 // ── SlackPayload JSON marshaling ──────────────────────────

internal/notify/export_test.go

@@ -32,27 +32,11 @@ func NewRequestForTest(
 // NewTestService creates a Service suitable for unit testing.
 // It discards log output and uses the given transport.
 func NewTestService(transport http.RoundTripper) *Service {
-	return newService(slog.New(slog.DiscardHandler), transport)
+	return &Service{
-}
+		log:       slog.New(slog.DiscardHandler),
-
+		transport: transport,
-// NewTestServiceWithLogger creates a Service that writes to the
+		history:   NewAlertHistory(),
-// given handler, so tests can assert on emitted log records.
+	}
-func NewTestServiceWithLogger(
-	transport http.RoundTripper,
-	handler slog.Handler,
-) *Service {
-	return newService(slog.New(handler), transport)
-}
-
-// Drain exports drain for testing.
-func (svc *Service) Drain(ctx context.Context) {
-	svc.drain(ctx)
-}
-
-// OutstandingDeliveries reports how many delivery goroutines
-// are currently tracked as in flight.
-func (svc *Service) OutstandingDeliveries() int64 {
-	return svc.outstanding.Load()
 }
 
 // SetNtfyURL sets the ntfy URL on a Service for testing.

internal/notify/history_test.go

@@ -29,14 +29,14 @@ func TestAlertHistoryAddAndRecent(t *testing.T) {
 		Timestamp: now.Add(-2 * time.Minute),
 		Title:     "first",
 		Message:   "msg1",
-		Priority:  prioInfo,
+		Priority:  "info",
 	})
 
 	h.Add(notify.AlertEntry{
 		Timestamp: now.Add(-1 * time.Minute),
 		Title:     "second",
 		Message:   "msg2",
-		Priority:  prioWarning,
+		Priority:  "warning",
 	})
 
 	entries := h.Recent()

internal/notify/notify.go

@@ -12,8 +12,6 @@ import (
 	"log/slog"
 	"net/http"
 	"net/url"
-	"sync"
-	"sync/atomic"
 	"time"
 
 	"go.uber.org/fx"
@@ -117,41 +115,19 @@ type Service struct {
 	history              *AlertHistory
 	retryConfig          RetryConfig
 	sleepFn              func(time.Duration) <-chan time.Time
-
-	// Shutdown draining state.  drainMu guards draining and
-	// serialises it against the counter increment in
-	// startDelivery; inFlight tracks the delivery goroutines
-	// themselves and outstanding mirrors its count so a timed
-	// out drain can report how many were abandoned.
-	drainMu     sync.Mutex
-	draining    bool
-	inFlight    sync.WaitGroup
-	outstanding atomic.Int64
-	abandon     chan struct{}
-	abandonOnce sync.Once
-}
-
-// newService builds a Service with the fields every Service
-// needs regardless of how it was constructed.
-func newService(
-	log *slog.Logger,
-	transport http.RoundTripper,
-) *Service {
-	return &Service{
-		log:       log,
-		transport: transport,
-		history:   NewAlertHistory(),
-		abandon:   make(chan struct{}),
-	}
 }
 
 // New creates a new notify Service.
 func New(
-	lifecycle fx.Lifecycle,
+	_ fx.Lifecycle,
 	params Params,
 ) (*Service, error) {
-	svc := newService(params.Logger.Get(), http.DefaultTransport)
+	svc := &Service{
-	svc.config = params.Config
+		log:       params.Logger.Get(),
+		transport: http.DefaultTransport,
+		config:    params.Config,
+		history:   NewAlertHistory(),
+	}
 
 	if params.Config.NtfyTopic != "" {
 		u, err := ValidateWebhookURL(
@@ -192,14 +168,6 @@ func New(
 		svc.mattermostWebhookURL = u
 	}
 
-	lifecycle.Append(fx.Hook{
-		OnStop: func(ctx context.Context) error {
-			svc.drain(ctx)
-
-			return nil
-		},
-	})
-
 	return svc, nil
 }
 
@@ -226,32 +194,6 @@ func (svc *Service) SendNotification(
 	svc.dispatchMattermost(ctx, title, message, priority)
 }
 
-// dispatch delivers a notification to one endpoint on a
-// tracked background goroutine.
-//
-// The delivery context is detached from ctx with
-// context.WithoutCancel so that a cancelled caller does not
-// kill a delivery already under way; the shutdown drain, not
-// the caller, decides how long deliveries may keep running.
-func (svc *Service) dispatch(
-	ctx context.Context,
-	endpoint string,
-	send func(context.Context) error,
-) {
-	notifyCtx := context.WithoutCancel(ctx)
-
-	svc.startDelivery(endpoint, func() {
-		err := svc.deliverWithRetry(notifyCtx, endpoint, send)
-		if err != nil {
-			svc.log.Error(
-				"failed to send notification after retries",
-				"endpoint", endpoint,
-				"error", err,
-			)
-		}
-	})
-}
-
 func (svc *Service) dispatchNtfy(
 	ctx context.Context,
 	title, message, priority string,
@@ -260,11 +202,26 @@ func (svc *Service) dispatchNtfy(
 		return
 	}
 
-	svc.dispatch(ctx, "ntfy", func(c context.Context) error {
+	go func() {
-		return svc.sendNtfy(
+		notifyCtx := context.WithoutCancel(ctx)
-			c, svc.ntfyURL, title, message, priority,
+
+		err := svc.deliverWithRetry(
+			notifyCtx, "ntfy",
+			func(c context.Context) error {
+				return svc.sendNtfy(
+					c, svc.ntfyURL,
+					title, message, priority,
+				)
+			},
 		)
-	})
+		if err != nil {
+			svc.log.Error(
+				"failed to send ntfy notification "+
+					"after retries",
+				"error", err,
+			)
+		}
+	}()
 }
 
 func (svc *Service) dispatchSlack(
@@ -275,11 +232,26 @@ func (svc *Service) dispatchSlack(
 		return
 	}
 
-	svc.dispatch(ctx, "slack", func(c context.Context) error {
+	go func() {
-		return svc.sendSlack(
+		notifyCtx := context.WithoutCancel(ctx)
-			c, svc.slackWebhookURL, title, message, priority,
+
+		err := svc.deliverWithRetry(
+			notifyCtx, "slack",
+			func(c context.Context) error {
+				return svc.sendSlack(
+					c, svc.slackWebhookURL,
+					title, message, priority,
+				)
+			},
 		)
-	})
+		if err != nil {
+			svc.log.Error(
+				"failed to send slack notification "+
+					"after retries",
+				"error", err,
+			)
+		}
+	}()
 }
 
 func (svc *Service) dispatchMattermost(
@@ -290,15 +262,26 @@ func (svc *Service) dispatchMattermost(
 		return
 	}
 
-	svc.dispatch(
+	go func() {
-		ctx, "mattermost",
+		notifyCtx := context.WithoutCancel(ctx)
-		func(c context.Context) error {
+
-			return svc.sendSlack(
+		err := svc.deliverWithRetry(
-				c, svc.mattermostWebhookURL,
+			notifyCtx, "mattermost",
-				title, message, priority,
+			func(c context.Context) error {
+				return svc.sendSlack(
+					c, svc.mattermostWebhookURL,
+					title, message, priority,
+				)
+			},
+		)
+		if err != nil {
+			svc.log.Error(
+				"failed to send mattermost notification "+
+					"after retries",
+				"error", err,
 			)
-		},
+		}
-	)
+	}()
 }
 
 func (svc *Service) sendNtfy(

internal/notify/retry.go

@@ -2,7 +2,6 @@ package notify
 
 import (
 	"context"
-	"fmt"
 	"math"
 	"math/rand/v2"
 	"time"
@@ -70,7 +69,7 @@ func (rc RetryConfig) backoff(attempt int) time.Duration {
 	lo := raw * (1 - jitterFraction)
 	hi := raw * (1 + jitterFraction)
 
-	jittered := lo + rand.Float64()*(hi-lo) //nolint:gosec // jitter needs no crypto/rand
+	jittered := lo + rand.Float64()*(hi-lo) //nolint:gosec // jitter does not need crypto/rand
 
 	return time.Duration(jittered)
 }
@@ -122,14 +121,6 @@ func (svc *Service) deliverWithRetry(
 		select {
 		case <-ctx.Done():
 			return ctx.Err()
-		case <-svc.abandon:
-			// Shutdown drained past its deadline; stop
-			// sleeping rather than outlive the process.
-			// A nil channel (Service built without a
-			// constructor) simply never fires.
-			return fmt.Errorf(
-				"%w: %s", ErrDeliveryAbandoned, endpoint,
-			)
 		case <-svc.sleepFunc(delay):
 		}
 	}

internal/notify/shutdown.go

@@ -1,119 +0,0 @@
-package notify
-
-import (
-	"context"
-	"errors"
-)
-
-// ErrDeliveryAbandoned is returned by a retry loop that was
-// cut short because shutdown drained past its deadline.
-var ErrDeliveryAbandoned = errors.New(
-	"notification delivery abandoned at shutdown",
-)
-
-// startDelivery runs fn on its own goroutine while tracking it,
-// so that drain can wait for it during shutdown.
-//
-// The WaitGroup counter is incremented here, on the caller's
-// goroutine, before the worker exists: incrementing it inside
-// the worker would race with drain's Wait and could let
-// shutdown sail past a delivery that had not started yet.
-//
-// Once draining has begun the delivery is refused outright
-// rather than queued, so a steady stream of newly submitted
-// notifications cannot keep extending the drain.
-func (svc *Service) startDelivery(endpoint string, fn func()) {
-	svc.drainMu.Lock()
-
-	if svc.draining {
-		svc.drainMu.Unlock()
-
-		svc.log.Warn(
-			"notification not dispatched: shutdown in progress",
-			"endpoint", endpoint,
-		)
-
-		return
-	}
-
-	svc.outstanding.Add(1)
-
-	// WaitGroup.Go increments the counter synchronously, here,
-	// and only then starts the goroutine.
-	svc.inFlight.Go(func() {
-		// Runs before the WaitGroup counter is decremented, so
-		// a drain that times out reports an accurate count.
-		defer svc.outstanding.Add(-1)
-
-		fn()
-	})
-
-	svc.drainMu.Unlock()
-}
-
-// drain waits for in-flight notification deliveries to finish.
-//
-// It first stops accepting new deliveries, then waits until
-// either every outstanding delivery has completed or ctx
-// expires — whichever comes first.  ctx is the context fx
-// passes to the OnStop hook, so a permanently dead webhook
-// cannot hang shutdown indefinitely.
-//
-// When the deadline arrives with deliveries still outstanding,
-// the count is logged at warn level and the abandon channel is
-// closed, which releases any retry loop sleeping in backoff.
-// Deliveries already inside an HTTP round trip are bounded by
-// the existing httpClientTimeout instead.
-//
-// A ctx that is already expired on entry is not by itself cause
-// for alarm: if nothing is outstanding there is nothing to
-// abandon, and the drain says so at debug level rather than
-// warning about deliveries that do not exist.
-func (svc *Service) drain(ctx context.Context) {
-	svc.drainMu.Lock()
-	svc.draining = true
-	svc.drainMu.Unlock()
-
-	done := make(chan struct{})
-
-	go func() {
-		svc.inFlight.Wait()
-		close(done)
-	}()
-
-	select {
-	case <-done:
-		svc.log.Debug(
-			"all in-flight notifications completed",
-		)
-	case <-ctx.Done():
-		// outstanding is decremented before the WaitGroup
-		// counter, and startDelivery can no longer add to it
-		// now that draining is set, so a zero here means every
-		// delivery really did finish.  ctx expiring in that
-		// state (an OnStop context that was already cancelled
-		// on entry is the usual way) abandons nothing, so it
-		// must not close abandon or warn about it.
-		abandoned := svc.outstanding.Load()
-		if abandoned == 0 {
-			svc.log.Debug(
-				"all in-flight notifications completed",
-			)
-
-			return
-		}
-
-		svc.abandonOnce.Do(func() {
-			if svc.abandon != nil {
-				close(svc.abandon)
-			}
-		})
-
-		svc.log.Warn(
-			"shutdown deadline reached with notifications "+
-				"still in flight; abandoning them",
-			"abandoned", abandoned,
-			"error", ctx.Err(),
-		)
-	}
-}

internal/notify/shutdown_test.go

@@ -1,531 +0,0 @@
-package notify_test
-
-import (
-	"bytes"
-	"context"
-	"log/slog"
-	"net/http"
-	"net/http/httptest"
-	"net/url"
-	"strings"
-	"sync"
-	"sync/atomic"
-	"testing"
-	"time"
-
-	"go.uber.org/fx"
-
-	"sneak.berlin/go/dnswatcher/internal/config"
-	"sneak.berlin/go/dnswatcher/internal/globals"
-	"sneak.berlin/go/dnswatcher/internal/logger"
-	"sneak.berlin/go/dnswatcher/internal/notify"
-)
-
-// Timings used by the drain tests.  They stay in the same
-// 10-100ms band as the retry tests so the suite never waits on
-// a real backoff delay.
-const (
-	// inFlightHold is how long a delivery is kept mid-request
-	// before the handler is released.
-	inFlightHold = 30 * time.Millisecond
-
-	// drainDeadline bounds a drain that is expected to time
-	// out.
-	drainDeadline = 50 * time.Millisecond
-
-	// drainSlack is the upper bound on how long a bounded
-	// drain may take; generous enough for a loaded CI box,
-	// still far below the 20s test ceiling.
-	drainSlack = 2 * time.Second
-
-	// settleDelay is how long to wait before asserting that
-	// something did *not* happen.
-	settleDelay = 50 * time.Millisecond
-
-	// idleDrainBound is the upper bound on a drain that has
-	// nothing in flight.  It is deliberately far above the cost
-	// of the goroutine hop through inFlight.Wait() — which
-	// reached 57ms on a loaded box under -race with the package's
-	// parallel tests — and far below drainSlack, the deadline
-	// such a drain is given.  A drain that blocked until its
-	// deadline instead of returning on the WaitGroup therefore
-	// still fails this bound, but scheduling delay alone cannot.
-	idleDrainBound = 500 * time.Millisecond
-)
-
-// syncBuffer is an io.Writer safe for concurrent use, so log
-// output written from delivery goroutines can be inspected.
-type syncBuffer struct {
-	mu  sync.Mutex
-	buf bytes.Buffer
-}
-
-func (sb *syncBuffer) Write(p []byte) (int, error) {
-	sb.mu.Lock()
-	defer sb.mu.Unlock()
-
-	return sb.buf.Write(p) //nolint:wrapcheck // test helper
-}
-
-func (sb *syncBuffer) String() string {
-	sb.mu.Lock()
-	defer sb.mu.Unlock()
-
-	return sb.buf.String()
-}
-
-// newLoggingService returns a Service writing JSON logs into
-// the returned buffer.
-func newLoggingService(
-	transport http.RoundTripper,
-) (*notify.Service, *syncBuffer) {
-	logs := &syncBuffer{}
-	handler := slog.NewJSONHandler(logs, nil)
-
-	return notify.NewTestServiceWithLogger(transport, handler),
-		logs
-}
-
-// blockingNtfyServer returns a server whose handler signals on
-// entered, waits for release, and then responds 200.
-func blockingNtfyServer(
-	entered chan<- struct{},
-	release <-chan struct{},
-	served *atomic.Bool,
-) *httptest.Server {
-	var once sync.Once
-
-	return httptest.NewServer(
-		http.HandlerFunc(
-			func(w http.ResponseWriter, _ *http.Request) {
-				once.Do(func() { close(entered) })
-				<-release
-
-				served.Store(true)
-
-				w.WriteHeader(http.StatusOK)
-			}),
-	)
-}
-
-// TestDrainWaitsForInFlightDelivery verifies that a delivery
-// already under way when shutdown starts is allowed to finish.
-func TestDrainWaitsForInFlightDelivery(t *testing.T) {
-	t.Parallel()
-
-	var served atomic.Bool
-
-	entered := make(chan struct{})
-	release := make(chan struct{})
-
-	srv := blockingNtfyServer(entered, release, &served)
-	defer srv.Close()
-
-	topicURL, _ := url.Parse(srv.URL)
-
-	svc := notify.NewTestService(http.DefaultTransport)
-	svc.SetNtfyURL(topicURL)
-
-	svc.SendNotification(
-		context.Background(), "t", "m", prioInfo,
-	)
-
-	// Make sure the delivery really is mid-request before the
-	// drain begins.
-	select {
-	case <-entered:
-	case <-time.After(drainSlack):
-		t.Fatal("delivery never reached the endpoint")
-	}
-
-	// As in TestDrainBoundedByContextDeadline: start is captured
-	// before the clock it is compared against, here the timer
-	// holding the delivery open, so elapsed covers the whole hold
-	// and the lower bound cannot come out short from scheduling
-	// delay alone.
-	start := time.Now()
-
-	timer := time.AfterFunc(inFlightHold, func() {
-		close(release)
-	})
-	defer timer.Stop()
-
-	ctx, cancel := context.WithTimeout(
-		context.Background(), drainSlack,
-	)
-	defer cancel()
-
-	svc.Drain(ctx)
-
-	elapsed := time.Since(start)
-
-	if !served.Load() {
-		t.Error(
-			"drain returned before the in-flight delivery " +
-				"completed",
-		)
-	}
-
-	if elapsed < inFlightHold {
-		t.Errorf(
-			"drain took %v, want at least %v",
-			elapsed, inFlightHold,
-		)
-	}
-
-	if got := svc.OutstandingDeliveries(); got != 0 {
-		t.Errorf("outstanding deliveries = %d, want 0", got)
-	}
-}
-
-// neverFires returns a channel that never delivers, standing in
-// for a long backoff sleep without actually sleeping.
-func neverFires(_ time.Duration) <-chan time.Time {
-	return make(chan time.Time)
-}
-
-// TestDrainBoundedByContextDeadline verifies that a delivery
-// stuck retrying against a dead endpoint does not hold shutdown
-// past the OnStop context deadline, and that the abandoned
-// deliveries are logged at warn level rather than dropped
-// silently.
-func TestDrainBoundedByContextDeadline(t *testing.T) {
-	t.Parallel()
-
-	var requests atomic.Int64
-
-	srv := httptest.NewServer(
-		http.HandlerFunc(
-			func(w http.ResponseWriter, _ *http.Request) {
-				requests.Add(1)
-
-				w.WriteHeader(http.StatusInternalServerError)
-			}),
-	)
-	defer srv.Close()
-
-	topicURL, _ := url.Parse(srv.URL)
-
-	svc, logs := newLoggingService(http.DefaultTransport)
-	svc.SetNtfyURL(topicURL)
-	// Never let the backoff sleep complete: the delivery is
-	// parked in its retry wait until shutdown releases it.
-	svc.SetSleepFunc(neverFires)
-	svc.SetRetryConfig(notify.RetryConfig{
-		MaxRetries: 5,
-		BaseDelay:  time.Hour,
-		MaxDelay:   time.Hour,
-	})
-
-	svc.SendNotification(
-		context.Background(), "t", "m", prioError,
-	)
-
-	waitForCondition(t, func() bool {
-		return requests.Load() >= 1 &&
-			svc.OutstandingDeliveries() == 1
-	})
-
-	// start must be captured *before* the deadline clock starts,
-	// so that the measured interval is a superset of the deadline
-	// interval.  Capturing it after context.WithTimeout would
-	// make elapsed structurally smaller than drainDeadline and
-	// the lower bound below unfalsifiable-by-luck: it would fail
-	// whenever the two statements were separated by any
-	// scheduling delay, and pass otherwise, regardless of what
-	// the drain did.
-	start := time.Now()
-
-	ctx, cancel := context.WithTimeout(
-		context.Background(), drainDeadline,
-	)
-	defer cancel()
-
-	// The upper bound is enforced by a watchdog rather than by
-	// measuring after the fact: a drain that is not bounded at
-	// all never returns here (the delivery is parked in a backoff
-	// that never fires), so an unbounded drain must fail this
-	// test promptly instead of hanging the package until the test
-	// binary's 30s timeout.
-	returned := make(chan struct{})
-
-	go func() {
-		defer close(returned)
-
-		svc.Drain(ctx)
-	}()
-
-	select {
-	case <-returned:
-	case <-time.After(drainSlack):
-		t.Fatalf(
-			"drain did not return within %v; its %v deadline "+
-				"did not bound it",
-			drainSlack, drainDeadline,
-		)
-	}
-
-	// The lower bound is the real assertion: the drain must have
-	// waited for its whole deadline rather than giving up on the
-	// outstanding delivery early.  With start captured above, an
-	// early return is the only thing that can make it fail.
-	if elapsed := time.Since(start); elapsed < drainDeadline {
-		t.Errorf(
-			"drain returned after %v, before its %v deadline",
-			elapsed, drainDeadline,
-		)
-	}
-
-	assertAbandonLogged(t, logs.String())
-
-	// The abandoned delivery must stop retrying rather than
-	// outlive the drain.
-	waitForCondition(t, func() bool {
-		return svc.OutstandingDeliveries() == 0
-	})
-}
-
-// assertAbandonLogged checks that the drain logged the
-// abandoned deliveries at warn level with a count.
-func assertAbandonLogged(t *testing.T, output string) {
-	t.Helper()
-
-	if !strings.Contains(output, `"level":"WARN"`) {
-		t.Errorf(
-			"abandoned deliveries not logged at warn level; "+
-				"log output: %s",
-			output,
-		)
-	}
-
-	if !strings.Contains(output, `"abandoned":1`) {
-		t.Errorf(
-			"abandoned delivery count not logged; "+
-				"log output: %s",
-			output,
-		)
-	}
-}
-
-// TestDrainRefusesNewDeliveries verifies that notifications
-// submitted after the drain has begun are refused and logged,
-// so a stream of new work cannot extend shutdown indefinitely.
-func TestDrainRefusesNewDeliveries(t *testing.T) {
-	t.Parallel()
-
-	var requests atomic.Int64
-
-	srv := httptest.NewServer(
-		http.HandlerFunc(
-			func(w http.ResponseWriter, _ *http.Request) {
-				requests.Add(1)
-
-				w.WriteHeader(http.StatusOK)
-			}),
-	)
-	defer srv.Close()
-
-	target, _ := url.Parse(srv.URL)
-
-	svc, logs := newLoggingService(http.DefaultTransport)
-	svc.SetNtfyURL(target)
-	svc.SetSlackWebhookURL(target)
-	svc.SetMattermostWebhookURL(target)
-
-	ctx, cancel := context.WithTimeout(
-		context.Background(), drainSlack,
-	)
-	defer cancel()
-
-	// Nothing is in flight, so this returns immediately and
-	// leaves the service refusing further deliveries.
-	svc.Drain(ctx)
-
-	for range 3 {
-		svc.SendNotification(
-			context.Background(), "t", "m", prioInfo,
-		)
-	}
-
-	time.Sleep(settleDelay)
-
-	if got := requests.Load(); got != 0 {
-		t.Errorf(
-			"%d requests reached the endpoint after drain, "+
-				"want 0",
-			got,
-		)
-	}
-
-	if got := svc.OutstandingDeliveries(); got != 0 {
-		t.Errorf("outstanding deliveries = %d, want 0", got)
-	}
-
-	output := logs.String()
-	if !strings.Contains(output, "shutdown in progress") {
-		t.Errorf(
-			"refused deliveries not logged; log output: %s",
-			output,
-		)
-	}
-}
-
-// recordingLifecycle is a minimal fx.Lifecycle that records the
-// hooks appended to it, so the wiring done by notify.New can be
-// inspected without standing up a whole fx application.
-type recordingLifecycle struct {
-	hooks []fx.Hook
-}
-
-func (l *recordingLifecycle) Append(hook fx.Hook) {
-	l.hooks = append(l.hooks, hook)
-}
-
-// newNotifyService builds a Service through the real
-// constructor, wired to the given lifecycle.
-func newNotifyService(
-	t *testing.T,
-	lifecycle fx.Lifecycle,
-	ntfyTopic string,
-) *notify.Service {
-	t.Helper()
-
-	g, err := globals.New(nil)
-	if err != nil {
-		t.Fatalf("globals.New: %v", err)
-	}
-
-	log, err := logger.New(nil, logger.Params{Globals: g})
-	if err != nil {
-		t.Fatalf("logger.New: %v", err)
-	}
-
-	svc, err := notify.New(lifecycle, notify.Params{
-		Logger: log,
-		Config: &config.Config{NtfyTopic: ntfyTopic},
-	})
-	if err != nil {
-		t.Fatalf("notify.New: %v", err)
-	}
-
-	return svc
-}
-
-// TestNewRegistersDrainingStopHook verifies that notify.New
-// wires an OnStop hook into the fx lifecycle and that the hook
-// waits for in-flight deliveries.
-func TestNewRegistersDrainingStopHook(t *testing.T) {
-	t.Parallel()
-
-	var served atomic.Bool
-
-	entered := make(chan struct{})
-	release := make(chan struct{})
-
-	srv := blockingNtfyServer(entered, release, &served)
-	defer srv.Close()
-
-	lifecycle := &recordingLifecycle{}
-	svc := newNotifyService(t, lifecycle, srv.URL)
-
-	if len(lifecycle.hooks) != 1 {
-		t.Fatalf(
-			"appended %d lifecycle hooks, want 1",
-			len(lifecycle.hooks),
-		)
-	}
-
-	stop := lifecycle.hooks[0].OnStop
-	if stop == nil {
-		t.Fatal("lifecycle hook has no OnStop function")
-	}
-
-	svc.SendNotification(
-		context.Background(), "t", "m", prioInfo,
-	)
-
-	select {
-	case <-entered:
-	case <-time.After(drainSlack):
-		t.Fatal("delivery never reached the endpoint")
-	}
-
-	timer := time.AfterFunc(inFlightHold, func() {
-		close(release)
-	})
-	defer timer.Stop()
-
-	ctx, cancel := context.WithTimeout(
-		context.Background(), drainSlack,
-	)
-	defer cancel()
-
-	err := stop(ctx)
-	if err != nil {
-		t.Fatalf("OnStop returned error: %v", err)
-	}
-
-	if !served.Load() {
-		t.Error(
-			"OnStop returned before the in-flight delivery " +
-				"completed",
-		)
-	}
-}
-
-// TestDrainWithoutDeliveriesReturnsImmediately verifies the
-// common case: nothing in flight, shutdown is not delayed.
-func TestDrainWithoutDeliveriesReturnsImmediately(t *testing.T) {
-	t.Parallel()
-
-	svc := notify.NewTestService(http.DefaultTransport)
-
-	// Captured before the deadline clock, as elsewhere in this
-	// file; for an upper bound that is the conservative
-	// direction, since the measured interval can then only be
-	// longer than the drain itself.
-	start := time.Now()
-
-	ctx, cancel := context.WithTimeout(
-		context.Background(), drainSlack,
-	)
-	defer cancel()
-
-	svc.Drain(ctx)
-
-	if elapsed := time.Since(start); elapsed > idleDrainBound {
-		t.Errorf(
-			"drain of an idle service took %v, want well "+
-				"under its %v deadline",
-			elapsed, drainSlack,
-		)
-	}
-}
-
-// TestDrainWithCancelledContextDoesNotWarn verifies that an
-// OnStop context that is already dead on entry does not produce
-// an "abandoning them" warning when there was nothing in flight
-// to abandon.  The expired context wins the select immediately,
-// so only the outstanding count can tell the difference between
-// a genuine timeout and a shutdown that had simply already run
-// out of time with no work left.
-func TestDrainWithCancelledContextDoesNotWarn(t *testing.T) {
-	t.Parallel()
-
-	svc, logs := newLoggingService(http.DefaultTransport)
-
-	ctx, cancel := context.WithCancel(context.Background())
-	cancel()
-
-	svc.Drain(ctx)
-
-	if output := logs.String(); strings.Contains(
-		output, `"level":"WARN"`,
-	) {
-		t.Errorf(
-			"drain with nothing in flight warned about "+
-				"abandoned deliveries; log output: %s",
-			output,
-		)
-	}
-}

internal/resolver/resolver_test.go

@@ -1,3 +1,10 @@
+// Package resolver_test verifies the iterative resolver against
+// live DNS. Per TESTING.md, all resolver tests use real queries
+// against real nameservers — no mocking of the DNS client layer.
+// Tests target long-lived public infrastructure (root servers,
+// gTLD servers, IANA, Google, Cloudflare, GitHub) to minimize
+// fixture churn, plus dedicated fixture records in the
+// sneak.cloud zone.
 package resolver_test
 
 import (
@@ -10,13 +17,36 @@ import (
 	"testing"
 	"time"
 
-	"github.com/miekg/dns"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
 	"sneak.berlin/go/dnswatcher/internal/resolver"
 )
 
+// ----------------------------------------------------------------
+// Test fixtures
+// ----------------------------------------------------------------
+
+// Fixture hostnames in the sneak.cloud zone (hosted on
+// Cloudflare). These records must exist in the sneak.cloud zone:
+//
+//	basic.dns.sneak.cloud         A      192.0.2.1
+//	multi.dns.sneak.cloud         A      192.0.2.1
+//	multi.dns.sneak.cloud         A      192.0.2.2
+//	ipv6.dns.sneak.cloud          AAAA   2001:db8::1
+//	dual.dns.sneak.cloud          A      192.0.2.1
+//	dual.dns.sneak.cloud          AAAA   2001:db8::1
+//	cname-target.dns.sneak.cloud  A      198.51.100.1
+//	cname.dns.sneak.cloud         CNAME  cname-target.dns.sneak.cloud
+const (
+	testDomain        = "sneak.cloud"
+	testHostBasic     = "basic.dns.sneak.cloud"
+	testHostMultiA    = "multi.dns.sneak.cloud"
+	testHostIPv6      = "ipv6.dns.sneak.cloud"
+	testHostDualStack = "dual.dns.sneak.cloud"
+	testHostCNAME     = "cname.dns.sneak.cloud"
+)
+
 // ----------------------------------------------------------------
 // Test helpers
 // ----------------------------------------------------------------
@@ -108,6 +138,35 @@ func TestFindAuthoritativeNameservers_Subdomain(
 	require.NotEmpty(t, nameservers)
 }
 
+func TestFindAuthoritativeNameservers_TLD(t *testing.T) {
+	t.Parallel()
+
+	r := newTestResolver(t)
+	ctx := testContext(t)
+
+	nameservers, err := r.FindAuthoritativeNameservers(
+		ctx, "com",
+	)
+	require.NoError(t, err)
+	require.NotEmpty(t, nameservers,
+		"should find TLD nameservers",
+	)
+
+	hasGTLD := false
+
+	for _, ns := range nameservers {
+		if strings.Contains(ns, "gtld-servers.net") {
+			hasGTLD = true
+
+			break
+		}
+	}
+
+	assert.True(t, hasGTLD,
+		"expected gtld-servers for com, got: %v", nameservers,
+	)
+}
+
 func TestFindAuthoritativeNameservers_ReturnsSorted(
 	t *testing.T,
 ) {
@@ -191,6 +250,68 @@ func TestFindAuthoritativeNameservers_CloudflareDomain(
 	}
 }
 
+func TestFindAuthoritativeNameservers_AllNSRespondAuthoritatively(
+	t *testing.T,
+) {
+	// Every NS returned by FindAuthoritativeNameservers must
+	// actually serve the zone. A lame NS would return REFUSED,
+	// SERVFAIL, or a non-authoritative answer.
+	t.Parallel()
+
+	r := newTestResolver(t)
+	ctx := testContext(t)
+
+	nameservers, err := r.FindAuthoritativeNameservers(
+		ctx, "google.com",
+	)
+	require.NoError(t, err)
+	require.NotEmpty(t, nameservers)
+
+	for _, ns := range nameservers {
+		resp, queryErr := r.QueryNameserver(
+			ctx, ns, "www.google.com",
+		)
+		require.NoError(t, queryErr,
+			"NS %s should be queryable", ns,
+		)
+		assert.Equal(
+			t, resolver.StatusOK, resp.Status,
+			"NS %s should respond authoritatively, "+
+				"status=%s error=%s",
+			ns, resp.Status, resp.Error,
+		)
+
+		hasRecords := len(resp.Records["A"]) > 0 ||
+			len(resp.Records["CNAME"]) > 0
+		assert.True(t, hasRecords,
+			"NS %s should return records for www.google.com",
+			ns,
+		)
+	}
+}
+
+func TestFindAuthoritativeNameservers_IsIterative(
+	t *testing.T,
+) {
+	// Verify that resolution works for well-known domains,
+	// proving we trace from root rather than relying on a
+	// system stub resolver that might not be configured.
+	t.Parallel()
+
+	r := newTestResolver(t)
+	ctx := testContext(t)
+
+	// Resolve a well-known domain to prove root->TLD->domain
+	// tracing works.
+	nameservers, err := r.FindAuthoritativeNameservers(
+		ctx, "example.com",
+	)
+	require.NoError(t, err)
+	require.NotEmpty(t, nameservers)
+
+	t.Logf("example.com NS: %v", nameservers)
+}
+
 // ----------------------------------------------------------------
 // QueryNameserver tests
 // ----------------------------------------------------------------
@@ -218,6 +339,28 @@ func TestQueryNameserver_BasicA(t *testing.T) {
 	)
 }
 
+func TestQueryNameserver_MultipleA(t *testing.T) {
+	t.Parallel()
+
+	r := newTestResolver(t)
+	ctx := testContext(t)
+	ns := findOneNSForDomain(t, r, ctx, testDomain)
+
+	resp, err := r.QueryNameserver(ctx, ns, testHostMultiA)
+	require.NoError(t, err)
+	require.NotNil(t, resp)
+	assert.Equal(t, resolver.StatusOK, resp.Status)
+
+	aRecords := resp.Records["A"]
+	require.Len(
+		t, aRecords, 2,
+		"multi.dns should have exactly 2 A records",
+	)
+
+	sort.Strings(aRecords)
+	assert.Equal(t, []string{"192.0.2.1", "192.0.2.2"}, aRecords)
+}
+
 func TestQueryNameserver_AAAA(t *testing.T) {
 	t.Parallel()
 
@@ -243,6 +386,44 @@ func TestQueryNameserver_AAAA(t *testing.T) {
 	}
 }
 
+func TestQueryNameserver_DualStack(t *testing.T) {
+	t.Parallel()
+
+	r := newTestResolver(t)
+	ctx := testContext(t)
+	ns := findOneNSForDomain(t, r, ctx, testDomain)
+
+	resp, err := r.QueryNameserver(ctx, ns, testHostDualStack)
+	require.NoError(t, err)
+	require.NotNil(t, resp)
+	assert.Equal(t, resolver.StatusOK, resp.Status)
+
+	assert.Contains(t, resp.Records["A"], "192.0.2.1")
+	assert.Contains(t, resp.Records["AAAA"], "2001:db8::1")
+}
+
+func TestQueryNameserver_CNAME(t *testing.T) {
+	t.Parallel()
+
+	r := newTestResolver(t)
+	ctx := testContext(t)
+	ns := findOneNSForDomain(t, r, ctx, testDomain)
+
+	resp, err := r.QueryNameserver(ctx, ns, testHostCNAME)
+	require.NoError(t, err)
+	require.NotNil(t, resp)
+	assert.Equal(t, resolver.StatusOK, resp.Status)
+
+	cnameRecords := resp.Records["CNAME"]
+	require.NotEmpty(
+		t, cnameRecords,
+		"cname.dns should have CNAME records",
+	)
+	assert.Contains(
+		t, cnameRecords, "cname-target.dns.sneak.cloud.",
+	)
+}
+
 func TestQueryNameserver_MX(t *testing.T) {
 	t.Parallel()
 
@@ -390,6 +571,116 @@ func TestQueryNameserver_TrailingDotHandling(t *testing.T) {
 	assert.Equal(t, resp1.Status, resp2.Status)
 }
 
+func TestQueryNameserver_NSRecordsForZoneApex(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	r := newTestResolver(t)
+	ctx := testContext(t)
+	ns := findOneNSForDomain(t, r, ctx, "cloudflare.com")
+
+	// Querying a zone apex should return NS records.
+	resp, err := r.QueryNameserver(
+		ctx, ns, "cloudflare.com",
+	)
+	require.NoError(t, err)
+	require.NotNil(t, resp)
+	assert.Equal(t, resolver.StatusOK, resp.Status)
+
+	nsRecords := resp.Records["NS"]
+	require.NotEmpty(t, nsRecords,
+		"zone apex should have NS records",
+	)
+
+	hasCloudflare := false
+
+	for _, nsRecord := range nsRecords {
+		if strings.Contains(nsRecord, "cloudflare") {
+			hasCloudflare = true
+
+			break
+		}
+	}
+
+	assert.True(t, hasCloudflare,
+		"NS records should include cloudflare, got: %v",
+		nsRecords,
+	)
+}
+
+func TestQueryNameserver_NoNSRecordsForLeafHostname(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	r := newTestResolver(t)
+	ctx := testContext(t)
+	ns := findOneNSForDomain(t, r, ctx, "google.com")
+
+	// A leaf hostname (not a zone cut) has no NS records.
+	resp, err := r.QueryNameserver(
+		ctx, ns, "www.google.com",
+	)
+	require.NoError(t, err)
+	require.NotNil(t, resp)
+
+	assert.Empty(t, resp.Records["NS"],
+		"leaf hostname should not have NS records, got: %v",
+		resp.Records["NS"],
+	)
+}
+
+func TestQueryNameserver_LameNameserver(t *testing.T) {
+	// Querying a nameserver that does not serve a zone should
+	// return a non-ok status, not silently return empty results
+	// with status "ok". a.iana-servers.net serves example.com,
+	// not google.com.
+	t.Parallel()
+
+	r := newTestResolver(t)
+	ctx := testContext(t)
+
+	resp, err := r.QueryNameserver(
+		ctx, "a.iana-servers.net.", "www.google.com",
+	)
+	require.NoError(t, err, "should not return Go-level error")
+	require.NotNil(t, resp)
+
+	assert.NotEqual(
+		t, resolver.StatusOK, resp.Status,
+		"lame NS should not return status ok; got status=%s "+
+			"records=%v",
+		resp.Status, resp.Records,
+	)
+}
+
+// ----------------------------------------------------------------
+// QueryNameserverIP tests
+// ----------------------------------------------------------------
+
+func TestQueryNameserverIP_BasicA(t *testing.T) {
+	t.Parallel()
+
+	r := newTestResolver(t)
+	ctx := testContext(t)
+
+	// a.iana-servers.net (199.43.135.53) is authoritative for
+	// example.com; query it directly by IP.
+	resp, err := r.QueryNameserverIP(
+		ctx, "a.iana-servers.net.", "199.43.135.53",
+		"example.com",
+	)
+	require.NoError(t, err)
+	require.NotNil(t, resp)
+
+	assert.Equal(t, resolver.StatusOK, resp.Status)
+	assert.Equal(t, "a.iana-servers.net.", resp.Nameserver)
+	assert.NotEmpty(t, resp.Records["A"],
+		"example.com should have A records",
+	)
+}
+
 // ----------------------------------------------------------------
 // QueryAllNameservers tests
 // ----------------------------------------------------------------
@@ -432,6 +723,39 @@ func TestQueryAllNameservers_AllReturnOK(t *testing.T) {
 	}
 }
 
+func TestQueryAllNameservers_Consistent(t *testing.T) {
+	t.Parallel()
+
+	r := newTestResolver(t)
+	ctx := testContext(t)
+
+	results, err := r.QueryAllNameservers(ctx, testHostBasic)
+	require.NoError(t, err)
+	require.NotEmpty(t, results)
+
+	// All NSes should return the same A records for a
+	// well-configured hostname.
+	var referenceRecords map[string][]string
+
+	for ns, resp := range results {
+		require.Equal(
+			t, resolver.StatusOK, resp.Status,
+			"NS %s should return OK status", ns,
+		)
+
+		if referenceRecords == nil {
+			referenceRecords = resp.Records
+
+			continue
+		}
+
+		assert.Equal(
+			t, referenceRecords["A"], resp.Records["A"],
+			"NS %s A records should match", ns,
+		)
+	}
+}
+
 func TestQueryAllNameservers_NXDomainFromAllNS(
 	t *testing.T,
 ) {
@@ -526,6 +850,80 @@ func TestResolveIPAddresses_ReturnsIPs(t *testing.T) {
 	}
 }
 
+func TestResolveIPAddresses_BasicA(t *testing.T) {
+	t.Parallel()
+
+	r := newTestResolver(t)
+	ctx := testContext(t)
+
+	ips, err := r.ResolveIPAddresses(ctx, testHostBasic)
+	require.NoError(t, err)
+	require.NotEmpty(t, ips)
+	assert.Contains(t, ips, "192.0.2.1")
+}
+
+func TestResolveIPAddresses_MultipleA(t *testing.T) {
+	t.Parallel()
+
+	r := newTestResolver(t)
+	ctx := testContext(t)
+
+	ips, err := r.ResolveIPAddresses(ctx, testHostMultiA)
+	require.NoError(t, err)
+
+	sort.Strings(ips)
+	assert.Contains(t, ips, "192.0.2.1")
+	assert.Contains(t, ips, "192.0.2.2")
+}
+
+func TestResolveIPAddresses_IPv6Only(t *testing.T) {
+	t.Parallel()
+
+	r := newTestResolver(t)
+	ctx := testContext(t)
+
+	ips, err := r.ResolveIPAddresses(ctx, testHostIPv6)
+	require.NoError(t, err)
+	require.NotEmpty(t, ips)
+	assert.Contains(t, ips, "2001:db8::1")
+
+	// Should not contain any IPv4
+	for _, ip := range ips {
+		parsed := net.ParseIP(ip)
+		require.NotNil(t, parsed, "should be valid IP: %s", ip)
+		assert.Nil(
+			t, parsed.To4(),
+			"ipv6-only host should not return IPv4: %s", ip,
+		)
+	}
+}
+
+func TestResolveIPAddresses_DualStack(t *testing.T) {
+	t.Parallel()
+
+	r := newTestResolver(t)
+	ctx := testContext(t)
+
+	ips, err := r.ResolveIPAddresses(ctx, testHostDualStack)
+	require.NoError(t, err)
+
+	assert.Contains(t, ips, "192.0.2.1")
+	assert.Contains(t, ips, "2001:db8::1")
+}
+
+func TestResolveIPAddresses_FollowsCNAME(t *testing.T) {
+	t.Parallel()
+
+	r := newTestResolver(t)
+	ctx := testContext(t)
+
+	// www.github.com is a long-standing CNAME to github.com;
+	// resolution must follow the chain to A records.
+	ips, err := r.ResolveIPAddresses(ctx, "www.github.com")
+	require.NoError(t, err)
+	require.NotEmpty(t, ips)
+}
+
 func TestResolveIPAddresses_Deduplicated(t *testing.T) {
 	t.Parallel()
 
@@ -623,59 +1021,6 @@ func TestQueryAllNameservers_ContextCanceled(t *testing.T) {
 	assert.Error(t, err)
 }
 
-// ----------------------------------------------------------------
-// Timeout tests
-// ----------------------------------------------------------------
-
-func TestQueryNameserverIP_Timeout(t *testing.T) {
-	t.Parallel()
-
-	log := slog.New(slog.NewTextHandler(
-		os.Stderr,
-		&slog.HandlerOptions{Level: slog.LevelDebug},
-	))
-
-	r := resolver.NewFromLoggerWithClient(
-		log, &timeoutClient{},
-	)
-
-	ctx, cancel := context.WithTimeout(
-		context.Background(), 10*time.Second,
-	)
-	t.Cleanup(cancel)
-
-	// Query any IP — the client always returns a timeout error.
-	resp, err := r.QueryNameserverIP(
-		ctx, "unreachable.test.", "192.0.2.1",
-		"example.com",
-	)
-	require.NoError(t, err)
-
-	assert.Equal(t, resolver.StatusTimeout, resp.Status)
-	assert.NotEmpty(t, resp.Error)
-}
-
-// timeoutClient simulates DNS timeout errors for testing.
-type timeoutClient struct{}
-
-func (c *timeoutClient) ExchangeContext(
-	_ context.Context,
-	_ *dns.Msg,
-	_ string,
-) (*dns.Msg, time.Duration, error) {
-	return nil, 0, &net.OpError{
-		Op:  "read",
-		Net: "udp",
-		Err: &timeoutError{},
-	}
-}
-
-type timeoutError struct{}
-
-func (e *timeoutError) Error() string   { return "i/o timeout" }
-func (e *timeoutError) Timeout() bool   { return true }
-func (e *timeoutError) Temporary() bool { return true }
-
 func TestResolveIPAddresses_ContextCanceled(t *testing.T) {
 	t.Parallel()
 

internal/state/state_test.go

@@ -13,16 +13,6 @@ import (
 
 const testHostname = "www.example.com"
 
-// Shared fixture values used across tests.
-const (
-	testNS1     = "ns1.example.com."
-	testNS2     = "ns2.example.com."
-	testAltNS1  = "ns1.test.com."
-	testIPv4    = "93.184.216.34"
-	testIP      = "1.2.3.4"
-	statusError = "error"
-)
-
 // populateState fills a State with representative test data across all categories.
 func populateState(t *testing.T, s *state.State) {
 	t.Helper()
@@ -30,7 +20,7 @@ func populateState(t *testing.T, s *state.State) {
 	now := time.Now().UTC().Truncate(time.Second)
 
 	s.SetDomainState("example.com", &state.DomainState{
-		Nameservers: []string{testNS1, testNS2},
+		Nameservers: []string{"ns1.example.com.", "ns2.example.com."},
 		LastChecked: now,
 	})
 
@@ -41,17 +31,17 @@ func populateState(t *testing.T, s *state.State) {
 
 	s.SetHostnameState(testHostname, &state.HostnameState{
 		RecordsByNameserver: map[string]*state.NameserverRecordState{
-			testNS1: {
+			"ns1.example.com.": {
 				Records: map[string][]string{
-					"A":    {testIPv4},
+					"A":    {"93.184.216.34"},
 					"AAAA": {"2606:2800:220:1:248:1893:25c8:1946"},
 				},
 				Status:      "ok",
 				LastChecked: now,
 			},
-			testNS2: {
+			"ns2.example.com.": {
 				Records: map[string][]string{
-					"A": {testIPv4},
+					"A": {"93.184.216.34"},
 				},
 				Status:      "ok",
 				LastChecked: now,
@@ -162,13 +152,13 @@ func TestSaveLoadRoundTrip_Hostnames(t *testing.T) {
 func verifyNS1Records(t *testing.T, hn *state.HostnameState) {
 	t.Helper()
 
-	ns1, ok := hn.RecordsByNameserver[testNS1]
+	ns1, ok := hn.RecordsByNameserver["ns1.example.com."]
 	if !ok {
 		t.Fatal("missing nameserver ns1.example.com.")
 	}
 
 	aRecords := ns1.Records["A"]
-	if len(aRecords) != 1 || aRecords[0] != testIPv4 {
+	if len(aRecords) != 1 || aRecords[0] != "93.184.216.34" {
 		t.Errorf("ns1 A records: got %v", aRecords)
 	}
 
@@ -223,8 +213,7 @@ func TestSaveLoadRoundTrip_Ports(t *testing.T) {
 	}
 }
 
-// TestSaveLoadRoundTrip_Certificates verifies certificate data
+// TestSaveLoadRoundTrip_Certificates verifies certificate data survives a save/load cycle.
-// survives a save/load cycle.
 func TestSaveLoadRoundTrip_Certificates(t *testing.T) {
 	t.Parallel()
 
@@ -664,7 +653,7 @@ func TestDomainState_GetSet(t *testing.T) {
 
 	now := time.Now().UTC().Truncate(time.Second)
 	ds := &state.DomainState{
-		Nameservers: []string{testAltNS1},
+		Nameservers: []string{"ns1.test.com."},
 		LastChecked: now,
 	}
 
@@ -675,7 +664,7 @@ func TestDomainState_GetSet(t *testing.T) {
 		t.Fatal("expected true for existing domain")
 	}
 
-	if len(got.Nameservers) != 1 || got.Nameservers[0] != testAltNS1 {
+	if len(got.Nameservers) != 1 || got.Nameservers[0] != "ns1.test.com." {
 		t.Errorf("nameservers: got %v", got.Nameservers)
 	}
 
@@ -685,7 +674,7 @@ func TestDomainState_GetSet(t *testing.T) {
 
 	// Overwrite.
 	ds2 := &state.DomainState{
-		Nameservers: []string{testAltNS1, "ns2.test.com."},
+		Nameservers: []string{"ns1.test.com.", "ns2.test.com."},
 		LastChecked: now.Add(time.Hour),
 	}
 
@@ -715,8 +704,8 @@ func TestHostnameState_GetSet(t *testing.T) {
 	now := time.Now().UTC().Truncate(time.Second)
 	hs := &state.HostnameState{
 		RecordsByNameserver: map[string]*state.NameserverRecordState{
-			testNS1: {
+			"ns1.example.com.": {
-				Records:     map[string][]string{"A": {testIP}},
+				Records:     map[string][]string{"A": {"1.2.3.4"}},
 				Status:      "ok",
 				LastChecked: now,
 			},
@@ -731,7 +720,7 @@ func TestHostnameState_GetSet(t *testing.T) {
 		t.Fatal("expected true for existing hostname")
 	}
 
-	nsState, ok := got.RecordsByNameserver[testNS1]
+	nsState, ok := got.RecordsByNameserver["ns1.example.com."]
 	if !ok {
 		t.Fatal("missing nameserver entry")
 	}
@@ -741,7 +730,7 @@ func TestHostnameState_GetSet(t *testing.T) {
 	}
 
 	aRecords := nsState.Records["A"]
-	if len(aRecords) != 1 || aRecords[0] != testIP {
+	if len(aRecords) != 1 || aRecords[0] != "1.2.3.4" {
 		t.Errorf("A records: got %v", aRecords)
 	}
 }
@@ -880,7 +869,7 @@ func TestCertificateState_ErrorField(t *testing.T) {
 
 	now := time.Now().UTC().Truncate(time.Second)
 	cs := &state.CertificateState{
-		Status:      statusError,
+		Status:      "error",
 		Error:       "connection refused",
 		LastChecked: now,
 	}
@@ -904,8 +893,8 @@ func TestCertificateState_ErrorField(t *testing.T) {
 		t.Fatal("missing certificate after load")
 	}
 
-	if got.Status != statusError {
+	if got.Status != "error" {
-		t.Errorf("status: got %q, want %q", got.Status, statusError)
+		t.Errorf("status: got %q, want %q", got.Status, "error")
 	}
 
 	if got.Error != "connection refused" {
@@ -923,9 +912,9 @@ func TestHostnameState_ErrorField(t *testing.T) {
 	now := time.Now().UTC().Truncate(time.Second)
 	hs := &state.HostnameState{
 		RecordsByNameserver: map[string]*state.NameserverRecordState{
-			testNS1: {
+			"ns1.example.com.": {
 				Records:     nil,
-				Status:      statusError,
+				Status:      "error",
 				Error:       "SERVFAIL",
 				LastChecked: now,
 			},
@@ -952,9 +941,9 @@ func TestHostnameState_ErrorField(t *testing.T) {
 		t.Fatal("missing hostname after load")
 	}
 
-	nsState := got.RecordsByNameserver[testNS1]
+	nsState := got.RecordsByNameserver["ns1.example.com."]
-	if nsState.Status != statusError {
+	if nsState.Status != "error" {
-		t.Errorf("status: got %q, want %q", nsState.Status, statusError)
+		t.Errorf("status: got %q, want %q", nsState.Status, "error")
 	}
 
 	if nsState.Error != "SERVFAIL" {
@@ -1073,8 +1062,7 @@ func TestConcurrentGetSet(t *testing.T) {
 	wg.Wait()
 }
 
-// runConcurrentOps performs a series of get/set/delete
+// runConcurrentOps performs a series of get/set/delete operations for concurrency testing.
-// operations for concurrency testing.
 func runConcurrentOps(s *state.State, key string, now time.Time) {
 	const iterations = 50
 
@@ -1097,7 +1085,7 @@ func runConcurrentOps(s *state.State, key string, now time.Time) {
 		s.SetHostnameState(key+".example.com", &state.HostnameState{
 			RecordsByNameserver: map[string]*state.NameserverRecordState{
 				"ns1.test.": {
-					Records:     map[string][]string{"A": {testIP}},
+					Records:     map[string][]string{"A": {"1.2.3.4"}},
 					Status:      "ok",
 					LastChecked: now,
 				},

internal/watcher/watcher.go

@@ -26,12 +26,6 @@ const tlsPort = 443
 // hoursPerDay converts days to hours for duration calculations.
 const hoursPerDay = 24
 
-// Status values recorded for nameserver and certificate checks.
-const (
-	statusOK    = "ok"
-	statusError = "error"
-)
-
 // Params contains dependencies for Watcher.
 type Params struct {
 	fx.In
@@ -350,7 +344,7 @@ func buildHostnameState(
 	for ns, recs := range records {
 		hs.RecordsByNameserver[ns] = &state.NameserverRecordState{
 			Records:     recs,
-			Status:      statusOK,
+			Status:      "ok",
 			LastChecked: now,
 		}
 	}
@@ -408,7 +402,7 @@ func (w *Watcher) detectNSDisappearances(
 	current map[string]map[string][]string,
 ) {
 	for ns, prevNS := range prev.RecordsByNameserver {
-		if _, ok := current[ns]; ok || prevNS.Status != statusOK {
+		if _, ok := current[ns]; ok || prevNS.Status != "ok" {
 			continue
 		}
 
@@ -427,7 +421,7 @@ func (w *Watcher) detectNSDisappearances(
 
 	for ns := range current {
 		prevNS, ok := prev.RecordsByNameserver[ns]
-		if !ok || prevNS.Status != statusError {
+		if !ok || prevNS.Status != "error" {
 			continue
 		}
 
@@ -711,7 +705,7 @@ func (w *Watcher) handleTLSError(
 	now time.Time,
 	err error,
 ) {
-	if hasPrev && !w.firstRun && prev.Status == statusOK {
+	if hasPrev && !w.firstRun && prev.Status == "ok" {
 		msg := fmt.Sprintf(
 			"Host: %s\nIP: %s\nError: %s",
 			hostname, ip, err,
@@ -727,7 +721,7 @@ func (w *Watcher) handleTLSError(
 
 	w.state.SetCertificateState(
 		certKey, &state.CertificateState{
-			Status:      statusError,
+			Status:      "error",
 			Error:       err.Error(),
 			LastChecked: now,
 		},
@@ -754,7 +748,7 @@ func (w *Watcher) handleTLSSuccess(
 			Issuer:                  cert.Issuer,
 			NotAfter:                cert.NotAfter,
 			SubjectAlternativeNames: cert.SubjectAlternativeNames,
-			Status:                  statusOK,
+			Status:                  "ok",
 			LastChecked:             now,
 		},
 	)
@@ -766,7 +760,7 @@ func (w *Watcher) detectTLSChanges(
 	prev *state.CertificateState,
 	cert *tlscheck.CertificateInfo,
 ) {
-	if prev.Status == statusError {
+	if prev.Status == "error" {
 		msg := fmt.Sprintf(
 			"Host: %s\nIP: %s\nTLS recovered",
 			hostname, ip,

internal/watcher/watcher_test.go

@@ -18,17 +18,6 @@ import (
 // errNotFound is returned when mock data is missing.
 var errNotFound = errors.New("not found")
 
-// Fixture values shared across tests.
-const (
-	testDomain = "example.com"
-	testHost   = "www.example.com"
-	testNS1    = "ns1.example.com."
-	testNS2    = "ns2.example.com."
-	testIPv4   = "93.184.216.34"
-	testIP     = "1.2.3.4"
-	testIssuer = "DigiCert"
-)
-
 // --- Mock implementations ---
 
 type mockResolver struct {
@@ -267,8 +256,8 @@ func TestFirstRunBaseline(t *testing.T) {
 	t.Parallel()
 
 	cfg := defaultTestConfig(t)
-	cfg.Domains = []string{testDomain}
+	cfg.Domains = []string{"example.com"}
-	cfg.Hostnames = []string{testHost}
+	cfg.Hostnames = []string{"www.example.com"}
 
 	w, deps := newTestWatcher(t, cfg)
 	setupBaselineMocks(deps)
@@ -280,37 +269,37 @@ func TestFirstRunBaseline(t *testing.T) {
 }
 
 func setupBaselineMocks(deps *testDeps) {
-	deps.resolver.nsRecords[testDomain] = []string{
+	deps.resolver.nsRecords["example.com"] = []string{
-		testNS1,
+		"ns1.example.com.",
-		testNS2,
+		"ns2.example.com.",
 	}
-	deps.resolver.allRecords[testDomain] = map[string]map[string][]string{
+	deps.resolver.allRecords["example.com"] = map[string]map[string][]string{
-		testNS1: {"A": {testIPv4}},
+		"ns1.example.com.": {"A": {"93.184.216.34"}},
-		testNS2: {"A": {testIPv4}},
+		"ns2.example.com.": {"A": {"93.184.216.34"}},
 	}
-	deps.resolver.allRecords[testHost] = map[string]map[string][]string{
+	deps.resolver.allRecords["www.example.com"] = map[string]map[string][]string{
-		testNS1: {"A": {testIPv4}},
+		"ns1.example.com.": {"A": {"93.184.216.34"}},
-		testNS2: {"A": {testIPv4}},
+		"ns2.example.com.": {"A": {"93.184.216.34"}},
 	}
-	deps.resolver.ipAddresses[testHost] = []string{
+	deps.resolver.ipAddresses["www.example.com"] = []string{
-		testIPv4,
+		"93.184.216.34",
 	}
 	deps.portChecker.results["93.184.216.34:80"] = true
 	deps.portChecker.results["93.184.216.34:443"] = true
 	deps.tlsChecker.certs["93.184.216.34:www.example.com"] = &tlscheck.CertificateInfo{
-		CommonName: testHost,
+		CommonName: "www.example.com",
-		Issuer:     testIssuer,
+		Issuer:     "DigiCert",
 		NotAfter:   time.Now().Add(90 * 24 * time.Hour),
 		SubjectAlternativeNames: []string{
-			testHost,
+			"www.example.com",
 		},
 	}
 	deps.tlsChecker.certs["93.184.216.34:example.com"] = &tlscheck.CertificateInfo{
-		CommonName: testDomain,
+		CommonName: "example.com",
-		Issuer:     testIssuer,
+		Issuer:     "DigiCert",
 		NotAfter:   time.Now().Add(90 * 24 * time.Hour),
 		SubjectAlternativeNames: []string{
-			testDomain,
+			"example.com",
 		},
 	}
 }
@@ -359,24 +348,24 @@ func TestDomainPortAndTLSChecks(t *testing.T) {
 	t.Parallel()
 
 	cfg := defaultTestConfig(t)
-	cfg.Domains = []string{testDomain}
+	cfg.Domains = []string{"example.com"}
 
 	w, deps := newTestWatcher(t, cfg)
 
-	deps.resolver.nsRecords[testDomain] = []string{
+	deps.resolver.nsRecords["example.com"] = []string{
-		testNS1,
+		"ns1.example.com.",
 	}
-	deps.resolver.allRecords[testDomain] = map[string]map[string][]string{
+	deps.resolver.allRecords["example.com"] = map[string]map[string][]string{
-		testNS1: {"A": {testIPv4}},
+		"ns1.example.com.": {"A": {"93.184.216.34"}},
 	}
 	deps.portChecker.results["93.184.216.34:80"] = true
 	deps.portChecker.results["93.184.216.34:443"] = true
 	deps.tlsChecker.certs["93.184.216.34:example.com"] = &tlscheck.CertificateInfo{
-		CommonName: testDomain,
+		CommonName: "example.com",
-		Issuer:     testIssuer,
+		Issuer:     "DigiCert",
 		NotAfter:   time.Now().Add(90 * 24 * time.Hour),
 		SubjectAlternativeNames: []string{
-			testDomain,
+			"example.com",
 		},
 	}
 
@@ -417,17 +406,17 @@ func TestNSChangeDetection(t *testing.T) {
 	t.Parallel()
 
 	cfg := defaultTestConfig(t)
-	cfg.Domains = []string{testDomain}
+	cfg.Domains = []string{"example.com"}
 
 	w, deps := newTestWatcher(t, cfg)
 
-	deps.resolver.nsRecords[testDomain] = []string{
+	deps.resolver.nsRecords["example.com"] = []string{
-		testNS1,
+		"ns1.example.com.",
-		testNS2,
+		"ns2.example.com.",
 	}
-	deps.resolver.allRecords[testDomain] = map[string]map[string][]string{
+	deps.resolver.allRecords["example.com"] = map[string]map[string][]string{
-		testNS1: {"A": {testIP}},
+		"ns1.example.com.": {"A": {"1.2.3.4"}},
-		testNS2: {"A": {testIP}},
+		"ns2.example.com.": {"A": {"1.2.3.4"}},
 	}
 	deps.portChecker.results["1.2.3.4:80"] = false
 	deps.portChecker.results["1.2.3.4:443"] = false
@@ -436,13 +425,13 @@ func TestNSChangeDetection(t *testing.T) {
 	w.RunOnce(ctx)
 
 	deps.resolver.mu.Lock()
-	deps.resolver.nsRecords[testDomain] = []string{
+	deps.resolver.nsRecords["example.com"] = []string{
-		testNS1,
+		"ns1.example.com.",
 		"ns3.example.com.",
 	}
-	deps.resolver.allRecords[testDomain] = map[string]map[string][]string{
+	deps.resolver.allRecords["example.com"] = map[string]map[string][]string{
-		testNS1:            {"A": {testIP}},
+		"ns1.example.com.": {"A": {"1.2.3.4"}},
-		"ns3.example.com.": {"A": {testIP}},
+		"ns3.example.com.": {"A": {"1.2.3.4"}},
 	}
 	deps.resolver.mu.Unlock()
 
@@ -470,15 +459,15 @@ func TestRecordChangeDetection(t *testing.T) {
 	t.Parallel()
 
 	cfg := defaultTestConfig(t)
-	cfg.Hostnames = []string{testHost}
+	cfg.Hostnames = []string{"www.example.com"}
 
 	w, deps := newTestWatcher(t, cfg)
 
-	deps.resolver.allRecords[testHost] = map[string]map[string][]string{
+	deps.resolver.allRecords["www.example.com"] = map[string]map[string][]string{
-		testNS1: {"A": {testIPv4}},
+		"ns1.example.com.": {"A": {"93.184.216.34"}},
 	}
-	deps.resolver.ipAddresses[testHost] = []string{
+	deps.resolver.ipAddresses["www.example.com"] = []string{
-		testIPv4,
+		"93.184.216.34",
 	}
 	deps.portChecker.results["93.184.216.34:80"] = false
 	deps.portChecker.results["93.184.216.34:443"] = false
@@ -487,10 +476,10 @@ func TestRecordChangeDetection(t *testing.T) {
 	w.RunOnce(ctx)
 
 	deps.resolver.mu.Lock()
-	deps.resolver.allRecords[testHost] = map[string]map[string][]string{
+	deps.resolver.allRecords["www.example.com"] = map[string]map[string][]string{
-		testNS1: {"A": {"93.184.216.35"}},
+		"ns1.example.com.": {"A": {"93.184.216.35"}},
 	}
-	deps.resolver.ipAddresses[testHost] = []string{
+	deps.resolver.ipAddresses["www.example.com"] = []string{
 		"93.184.216.35",
 	}
 	deps.resolver.mu.Unlock()
@@ -512,24 +501,24 @@ func TestPortStateChange(t *testing.T) {
 	t.Parallel()
 
 	cfg := defaultTestConfig(t)
-	cfg.Hostnames = []string{testHost}
+	cfg.Hostnames = []string{"www.example.com"}
 
 	w, deps := newTestWatcher(t, cfg)
 
-	deps.resolver.allRecords[testHost] = map[string]map[string][]string{
+	deps.resolver.allRecords["www.example.com"] = map[string]map[string][]string{
-		testNS1: {"A": {testIP}},
+		"ns1.example.com.": {"A": {"1.2.3.4"}},
 	}
-	deps.resolver.ipAddresses[testHost] = []string{
+	deps.resolver.ipAddresses["www.example.com"] = []string{
-		testIP,
+		"1.2.3.4",
 	}
 	deps.portChecker.results["1.2.3.4:80"] = true
 	deps.portChecker.results["1.2.3.4:443"] = true
 	deps.tlsChecker.certs["1.2.3.4:www.example.com"] = &tlscheck.CertificateInfo{
-		CommonName: testHost,
+		CommonName: "www.example.com",
-		Issuer:     testIssuer,
+		Issuer:     "DigiCert",
 		NotAfter:   time.Now().Add(90 * 24 * time.Hour),
 		SubjectAlternativeNames: []string{
-			testHost,
+			"www.example.com",
 		},
 	}
 
@@ -552,24 +541,24 @@ func TestTLSExpiryWarning(t *testing.T) {
 	t.Parallel()
 
 	cfg := defaultTestConfig(t)
-	cfg.Hostnames = []string{testHost}
+	cfg.Hostnames = []string{"www.example.com"}
 
 	w, deps := newTestWatcher(t, cfg)
 
-	deps.resolver.allRecords[testHost] = map[string]map[string][]string{
+	deps.resolver.allRecords["www.example.com"] = map[string]map[string][]string{
-		testNS1: {"A": {testIP}},
+		"ns1.example.com.": {"A": {"1.2.3.4"}},
 	}
-	deps.resolver.ipAddresses[testHost] = []string{
+	deps.resolver.ipAddresses["www.example.com"] = []string{
-		testIP,
+		"1.2.3.4",
 	}
 	deps.portChecker.results["1.2.3.4:80"] = true
 	deps.portChecker.results["1.2.3.4:443"] = true
 	deps.tlsChecker.certs["1.2.3.4:www.example.com"] = &tlscheck.CertificateInfo{
-		CommonName: testHost,
+		CommonName: "www.example.com",
-		Issuer:     testIssuer,
+		Issuer:     "DigiCert",
 		NotAfter:   time.Now().Add(3 * 24 * time.Hour),
 		SubjectAlternativeNames: []string{
-			testHost,
+			"www.example.com",
 		},
 	}
 
@@ -603,25 +592,25 @@ func TestTLSExpiryWarningDedup(t *testing.T) {
 	t.Parallel()
 
 	cfg := defaultTestConfig(t)
-	cfg.Hostnames = []string{testHost}
+	cfg.Hostnames = []string{"www.example.com"}
 	cfg.TLSInterval = 24 * time.Hour
 
 	w, deps := newTestWatcher(t, cfg)
 
-	deps.resolver.allRecords[testHost] = map[string]map[string][]string{
+	deps.resolver.allRecords["www.example.com"] = map[string]map[string][]string{
-		testNS1: {"A": {testIP}},
+		"ns1.example.com.": {"A": {"1.2.3.4"}},
 	}
-	deps.resolver.ipAddresses[testHost] = []string{
+	deps.resolver.ipAddresses["www.example.com"] = []string{
-		testIP,
+		"1.2.3.4",
 	}
 	deps.portChecker.results["1.2.3.4:80"] = true
 	deps.portChecker.results["1.2.3.4:443"] = true
 	deps.tlsChecker.certs["1.2.3.4:www.example.com"] = &tlscheck.CertificateInfo{
-		CommonName: testHost,
+		CommonName: "www.example.com",
-		Issuer:     testIssuer,
+		Issuer:     "DigiCert",
 		NotAfter:   time.Now().Add(3 * 24 * time.Hour),
 		SubjectAlternativeNames: []string{
-			testHost,
+			"www.example.com",
 		},
 	}
 
@@ -658,17 +647,17 @@ func TestGracefulShutdown(t *testing.T) {
 	t.Parallel()
 
 	cfg := defaultTestConfig(t)
-	cfg.Domains = []string{testDomain}
+	cfg.Domains = []string{"example.com"}
 	cfg.DNSInterval = 100 * time.Millisecond
 	cfg.TLSInterval = 100 * time.Millisecond
 
 	w, deps := newTestWatcher(t, cfg)
 
-	deps.resolver.nsRecords[testDomain] = []string{
+	deps.resolver.nsRecords["example.com"] = []string{
-		testNS1,
+		"ns1.example.com.",
 	}
-	deps.resolver.allRecords[testDomain] = map[string]map[string][]string{
+	deps.resolver.allRecords["example.com"] = map[string]map[string][]string{
-		testNS1: {"A": {testIP}},
+		"ns1.example.com.": {"A": {"1.2.3.4"}},
 	}
 	deps.portChecker.results["1.2.3.4:80"] = false
 	deps.portChecker.results["1.2.3.4:443"] = false
@@ -698,13 +687,13 @@ func setupHostnameIP(
 	hostname, ip string,
 ) {
 	deps.resolver.allRecords[hostname] = map[string]map[string][]string{
-		testNS1: {"A": {ip}},
+		"ns1.example.com.": {"A": {ip}},
 	}
 	deps.portChecker.results[ip+":80"] = true
 	deps.portChecker.results[ip+":443"] = true
 	deps.tlsChecker.certs[ip+":"+hostname] = &tlscheck.CertificateInfo{
 		CommonName:              hostname,
-		Issuer:                  testIssuer,
+		Issuer:                  "DigiCert",
 		NotAfter:                time.Now().Add(90 * 24 * time.Hour),
 		SubjectAlternativeNames: []string{hostname},
 	}
@@ -713,7 +702,7 @@ func setupHostnameIP(
 func updateHostnameIP(deps *testDeps, hostname, ip string) {
 	deps.resolver.mu.Lock()
 	deps.resolver.allRecords[hostname] = map[string]map[string][]string{
-		testNS1: {"A": {ip}},
+		"ns1.example.com.": {"A": {ip}},
 	}
 	deps.resolver.mu.Unlock()
 
@@ -725,7 +714,7 @@ func updateHostnameIP(deps *testDeps, hostname, ip string) {
 	deps.tlsChecker.mu.Lock()
 	deps.tlsChecker.certs[ip+":"+hostname] = &tlscheck.CertificateInfo{
 		CommonName:              hostname,
-		Issuer:                  testIssuer,
+		Issuer:                  "DigiCert",
 		NotAfter:                time.Now().Add(90 * 24 * time.Hour),
 		SubjectAlternativeNames: []string{hostname},
 	}
@@ -736,11 +725,11 @@ func TestDNSRunsBeforePortAndTLSChecks(t *testing.T) {
 	t.Parallel()
 
 	cfg := defaultTestConfig(t)
-	cfg.Hostnames = []string{testHost}
+	cfg.Hostnames = []string{"www.example.com"}
 
 	w, deps := newTestWatcher(t, cfg)
 
-	setupHostnameIP(deps, testHost, "10.0.0.1")
+	setupHostnameIP(deps, "www.example.com", "10.0.0.1")
 
 	ctx := t.Context()
 	w.RunOnce(ctx)
@@ -751,7 +740,7 @@ func TestDNSRunsBeforePortAndTLSChecks(t *testing.T) {
 	}
 
 	// DNS changes to a new IP; port and TLS must pick it up.
-	updateHostnameIP(deps, testHost, "10.0.0.2")
+	updateHostnameIP(deps, "www.example.com", "10.0.0.2")
 
 	w.RunOnce(ctx)
 
@@ -771,8 +760,8 @@ func TestSendTestNotification_Enabled(t *testing.T) {
 	t.Parallel()
 
 	cfg := defaultTestConfig(t)
-	cfg.Domains = []string{testDomain}
+	cfg.Domains = []string{"example.com"}
-	cfg.Hostnames = []string{testHost}
+	cfg.Hostnames = []string{"www.example.com"}
 	cfg.SendTestNotification = true
 
 	w, deps := newTestWatcher(t, cfg)
@@ -797,8 +786,8 @@ func TestSendTestNotification_ViaRun(t *testing.T) {
 	t.Parallel()
 
 	cfg := defaultTestConfig(t)
-	cfg.Domains = []string{testDomain}
+	cfg.Domains = []string{"example.com"}
-	cfg.Hostnames = []string{testHost}
+	cfg.Hostnames = []string{"www.example.com"}
 	cfg.SendTestNotification = true
 	cfg.DNSInterval = 24 * time.Hour
 	cfg.TLSInterval = 24 * time.Hour
@@ -844,8 +833,8 @@ func TestSendTestNotification_Disabled(t *testing.T) {
 	t.Parallel()
 
 	cfg := defaultTestConfig(t)
-	cfg.Domains = []string{testDomain}
+	cfg.Domains = []string{"example.com"}
-	cfg.Hostnames = []string{testHost}
+	cfg.Hostnames = []string{"www.example.com"}
 	cfg.SendTestNotification = false
 	cfg.DNSInterval = 24 * time.Hour
 	cfg.TLSInterval = 24 * time.Hour
@@ -882,16 +871,16 @@ func TestNSFailureAndRecovery(t *testing.T) {
 	t.Parallel()
 
 	cfg := defaultTestConfig(t)
-	cfg.Hostnames = []string{testHost}
+	cfg.Hostnames = []string{"www.example.com"}
 
 	w, deps := newTestWatcher(t, cfg)
 
-	deps.resolver.allRecords[testHost] = map[string]map[string][]string{
+	deps.resolver.allRecords["www.example.com"] = map[string]map[string][]string{
-		testNS1: {"A": {testIP}},
+		"ns1.example.com.": {"A": {"1.2.3.4"}},
-		testNS2: {"A": {testIP}},
+		"ns2.example.com.": {"A": {"1.2.3.4"}},
 	}
-	deps.resolver.ipAddresses[testHost] = []string{
+	deps.resolver.ipAddresses["www.example.com"] = []string{
-		testIP,
+		"1.2.3.4",
 	}
 	deps.portChecker.results["1.2.3.4:80"] = false
 	deps.portChecker.results["1.2.3.4:443"] = false
@@ -901,8 +890,8 @@ func TestNSFailureAndRecovery(t *testing.T) {
 	w.RunOnce(ctx)
 
 	deps.resolver.mu.Lock()
-	deps.resolver.allRecords[testHost] = map[string]map[string][]string{
+	deps.resolver.allRecords["www.example.com"] = map[string]map[string][]string{
-		testNS1: {"A": {testIP}},
+		"ns1.example.com.": {"A": {"1.2.3.4"}},
 	}
 	deps.resolver.mu.Unlock()
 

script/bootstrap

@@ -9,9 +9,9 @@ set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
-# Pinned versions, 2026-08-07 (same pins as the Dockerfile)
+# Pinned versions, 2026-07-07 (same pins as the Dockerfile)
-# golangci-lint v2.12.2
+# golangci-lint v2.10.1
-GOLANGCI_LINT_REF="github.com/golangci/golangci-lint/v2/cmd/golangci-lint@c0d3ddc9cf3faa61a4e378e879ece580256d76e5"
+GOLANGCI_LINT_REF="github.com/golangci/golangci-lint/v2/cmd/golangci-lint@5d1e709b7be35cb2025444e19de266b056b7b7ee"
 # goimports v0.42.0
 GOIMPORTS_REF="golang.org/x/tools/cmd/goimports@009367f5c17a8d4c45a961a3a509277190a9a6f0"