Refresh vendored REPO_POLICIES.md

.golangci.yml

@@ -1,9 +1,5 @@
 version: "2"
 
-# Config schema uses the golangci-lint v2 layout (settings live under
-# linters.settings, not top-level linters-settings) so that the
-# thresholds below are actually applied by golangci-lint >= v2.
-
 run:
   timeout: 5m
   modules-download-mode: readonly
@@ -18,7 +14,8 @@ linters:
     - wsl              # Deprecated, replaced by wsl_v5
     - wrapcheck        # Too verbose for internal packages
     - varnamelen       # Short names like db, id are idiomatic Go
-  settings:
+
+linters-settings:
   lll:
     line-length: 88
   funlen:
@@ -30,5 +27,6 @@ linters:
     threshold: 100
 
 issues:
+  exclude-use-default: false
   max-issues-per-linter: 0
   max-same-issues: 0

Dockerfile

@@ -4,8 +4,8 @@ FROM golang@sha256:f6751d823c26342f9506c03797d2527668d095b0a15f1862cddb4d927a7a4
 
 RUN apk add --no-cache git make gcc musl-dev binutils-gold
 
-# golangci-lint v2.12.2, 2026-08-07
-RUN go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@c0d3ddc9cf3faa61a4e378e879ece580256d76e5
+# golangci-lint v2.10.1
+RUN go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@5d1e709b7be35cb2025444e19de266b056b7b7ee
 # goimports v0.42.0
 RUN go install golang.org/x/tools/cmd/goimports@009367f5c17a8d4c45a961a3a509277190a9a6f0
 

README.md

@@ -17,26 +17,6 @@ without requiring an external database.
 
 ---
 
-## No DNS mocking. Ever.
-
-**DNS is never mocked in this project — not in tests, not anywhere else.**
-No mock resolvers, no fake DNS servers, no stubbed lookups.
-
-dnswatcher's entire purpose is correct behavior against the real DNS.
-Tests exercise real iterative resolution against live nameservers by
-design; a test suite that passes against a mock proves nothing about the
-one thing this program exists to do.
-
-When live tests are flaky, that is a robustness problem, and it gets
-fixed with robustness: retries with backoff, querying multiple
-independent nameservers, longer timeouts — or explicit opt-in gating
-decided by the project owner. Never with mocks.
-
-Contributions that introduce mocked, faked, or stubbed DNS will be
-rejected.
-
----
-
 ## Features
 
 ### DNS Domain Monitoring (Apex Domains)

TODO.md

@@ -25,21 +25,6 @@ confirm make check still passes.
 
 # Completed Steps
 
-- 2026-08-09: `script/bootstrap` now installs the pinned `golangci-lint`
-  and `goimports` unconditionally instead of only when the binary is
-  absent from `PATH`, so the commit pins actually take effect on
-  already-provisioned machines; it also warns when `PATH` resolves
-  either tool to a copy outside the directory `go install` writes to.
-  The `missing` presence check is retained for `git`, `make`, and `go`
-  (#117)
-- 2026-08-07: golangci-lint bumped to v2.12.2 (commit-pinned installs
-  in `Dockerfile` and `script/bootstrap`); `.golangci.yml` set to the
-  org-standard v2-schema config used across the org's repos
-  (owner-authorized; same file is being landed as canonical via prompts
-  PR #24), with settings under `linters.settings` so the
-  lll/funlen/cyclop/dupl thresholds apply; fixed the resulting
-  `goconst`, `dupl`, and `lll` findings; the informational `gomodguard`
-  deprecation warning under this config is accepted
 - 2026-07-07 Adopted scripts-to-rule-them-all: `script/` entrypoints,
   Makefile shims, README Entrypoints section
 - 2026-02-20: iterative DNS resolver implemented; tests made hermetic

internal/config/classify_test.go

@@ -17,33 +17,13 @@ func TestClassifyDNSName(t *testing.T) {
 	}{
 		{name: "apex domain simple", input: "example.com", want: config.DNSNameTypeDomain},
 		{name: "hostname simple", input: "www.example.com", want: config.DNSNameTypeHostname},
-		{
-			name:  "apex domain multi-part TLD",
-			input: "example.co.uk",
-			want:  config.DNSNameTypeDomain,
-		},
-		{
-			name:  "hostname multi-part TLD",
-			input: "api.example.co.uk",
-			want:  config.DNSNameTypeHostname,
-		},
+		{name: "apex domain multi-part TLD", input: "example.co.uk", want: config.DNSNameTypeDomain},
+		{name: "hostname multi-part TLD", input: "api.example.co.uk", want: config.DNSNameTypeHostname},
 		{name: "public suffix itself", input: "co.uk", wantErr: true},
 		{name: "empty string", input: "", wantErr: true},
-		{
-			name:  "deeply nested hostname",
-			input: "a.b.c.example.com",
-			want:  config.DNSNameTypeHostname,
-		},
-		{
-			name:  "trailing dot stripped",
-			input: "example.com.",
-			want:  config.DNSNameTypeDomain,
-		},
-		{
-			name:  "uppercase normalized",
-			input: "WWW.Example.COM",
-			want:  config.DNSNameTypeHostname,
-		},
+		{name: "deeply nested hostname", input: "a.b.c.example.com", want: config.DNSNameTypeHostname},
+		{name: "trailing dot stripped", input: "example.com.", want: config.DNSNameTypeDomain},
+		{name: "uppercase normalized", input: "WWW.Example.COM", want: config.DNSNameTypeHostname},
 	}
 
 	for _, tt := range tests {

internal/notify/delivery_test.go

@@ -25,20 +25,6 @@ const (
 	colorDefault = "#6c757d"
 )
 
-// Priority strings used across multiple tests.
-const (
-	prioError   = "error"
-	prioWarning = "warning"
-	prioSuccess = "success"
-	prioInfo    = "info"
-	prioUnknown = "unknown"
-	prioDefault = "default"
-	prioUrgent  = "urgent"
-)
-
-// testHost is the hostname used in request construction tests.
-const testHost = "example.com"
-
 // errSimulated is a static error for transport failures.
 var errSimulated = errors.New("simulated transport failure")
 
@@ -115,13 +101,13 @@ func TestNtfyPriority(t *testing.T) {
 		input string
 		want  string
 	}{
-		{prioError, prioUrgent},
-		{prioWarning, "high"},
-		{prioSuccess, prioDefault},
-		{prioInfo, "low"},
-		{"", prioDefault},
-		{prioUnknown, prioDefault},
-		{"critical", prioDefault},
+		{"error", "urgent"},
+		{"warning", "high"},
+		{"success", "default"},
+		{"info", "low"},
+		{"", "default"},
+		{"unknown", "default"},
+		{"critical", "default"},
 	}
 
 	for _, tc := range cases {
@@ -148,12 +134,12 @@ func TestSlackColor(t *testing.T) {
 		input string
 		want  string
 	}{
-		{prioError, colorError},
-		{prioWarning, colorWarning},
-		{prioSuccess, colorSuccess},
-		{prioInfo, colorInfo},
+		{"error", colorError},
+		{"warning", colorWarning},
+		{"success", colorSuccess},
+		{"info", colorInfo},
 		{"", colorDefault},
-		{prioUnknown, colorDefault},
+		{"unknown", colorDefault},
 		{"critical", colorDefault},
 	}
 
@@ -179,7 +165,7 @@ func TestNewRequest(t *testing.T) {
 
 	target := &url.URL{
 		Scheme: "https",
-		Host:   testHost,
+		Host:   "example.com",
 		Path:   "/webhook",
 	}
 	body := bytes.NewBufferString("hello")
@@ -201,9 +187,9 @@ func TestNewRequest(t *testing.T) {
 		)
 	}
 
-	if req.Host != testHost {
+	if req.Host != "example.com" {
 		t.Errorf(
-			"Host = %q, want %q", req.Host, testHost,
+			"Host = %q, want %q", req.Host, "example.com",
 		)
 	}
 
@@ -231,7 +217,7 @@ func TestNewRequestPreservesContext(t *testing.T) {
 		ctxKey("k"),
 		"v",
 	)
-	target := &url.URL{Scheme: "https", Host: testHost}
+	target := &url.URL{Scheme: "https", Host: "example.com"}
 
 	req := notify.NewRequestForTest(
 		ctx, http.MethodGet, target, http.NoBody,
@@ -303,10 +289,10 @@ func TestSendNtfyHeaders(t *testing.T) {
 		)
 	}
 
-	if captured.priority != prioUrgent {
+	if captured.priority != "urgent" {
 		t.Errorf(
 			"Priority header = %q, want %q",
-			captured.priority, prioUrgent,
+			captured.priority, "urgent",
 		)
 	}
 
@@ -325,10 +311,10 @@ func TestSendNtfyAllPriorities(t *testing.T) {
 		input string
 		want  string
 	}{
-		{prioError, prioUrgent},
-		{prioWarning, "high"},
-		{prioSuccess, prioDefault},
-		{prioInfo, "low"},
+		{"error", "urgent"},
+		{"warning", "high"},
+		{"success", "default"},
+		{"info", "low"},
 	}
 
 	for _, tc := range priorities {
@@ -370,69 +356,56 @@ func TestSendNtfyAllPriorities(t *testing.T) {
 	}
 }
 
-// assertSendStatusError verifies that send returns an error
-// wrapping wantErr when the server responds with status.
-func assertSendStatusError(
-	t *testing.T,
-	status int,
-	wantErr error,
-	send func(*notify.Service, *url.URL) error,
-) {
-	t.Helper()
+func TestSendNtfyClientError(t *testing.T) {
+	t.Parallel()
 
 	srv := httptest.NewServer(
 		http.HandlerFunc(
 			func(w http.ResponseWriter, _ *http.Request) {
-				w.WriteHeader(status)
+				w.WriteHeader(http.StatusForbidden)
 			}),
 	)
 	defer srv.Close()
 
 	svc := notify.NewTestService(srv.Client().Transport)
-	target, _ := url.Parse(srv.URL)
+	topicURL, _ := url.Parse(srv.URL)
 
-	err := send(svc, target)
+	err := svc.SendNtfy(
+		context.Background(), topicURL, "t", "m", "info",
+	)
 	if err == nil {
-		t.Fatalf("expected error for %d response", status)
+		t.Fatal("expected error for 403 response")
 	}
 
-	if !errors.Is(err, wantErr) {
-		t.Errorf("error = %v, want %v", err, wantErr)
+	if !errors.Is(err, notify.ErrNtfyFailed) {
+		t.Errorf("error = %v, want ErrNtfyFailed", err)
 	}
 }
 
-func sendNtfyInfo(
-	svc *notify.Service, target *url.URL,
-) error {
-	return svc.SendNtfy(
-		context.Background(), target, "t", "m", prioInfo,
-	)
-}
-
-func sendSlackInfo(
-	svc *notify.Service, target *url.URL,
-) error {
-	return svc.SendSlack(
-		context.Background(), target, "t", "m", prioInfo,
-	)
-}
-
-func TestSendNtfyClientError(t *testing.T) {
-	t.Parallel()
-
-	assertSendStatusError(
-		t, http.StatusForbidden,
-		notify.ErrNtfyFailed, sendNtfyInfo,
-	)
-}
-
 func TestSendNtfyServerError(t *testing.T) {
 	t.Parallel()
 
-	assertSendStatusError(
-		t, http.StatusInternalServerError,
-		notify.ErrNtfyFailed, sendNtfyInfo,
+	srv := httptest.NewServer(
+		http.HandlerFunc(
+			func(w http.ResponseWriter, _ *http.Request) {
+				w.WriteHeader(http.StatusInternalServerError)
+			}),
 	)
+	defer srv.Close()
+
+	svc := notify.NewTestService(srv.Client().Transport)
+	topicURL, _ := url.Parse(srv.URL)
+
+	err := svc.SendNtfy(
+		context.Background(), topicURL, "t", "m", "info",
+	)
+	if err == nil {
+		t.Fatal("expected error for 500 response")
+	}
+
+	if !errors.Is(err, notify.ErrNtfyFailed) {
+		t.Errorf("error = %v, want ErrNtfyFailed", err)
+	}
 }
 
 func TestSendNtfySuccess(t *testing.T) {
@@ -577,11 +550,11 @@ func TestSendSlackAllColors(t *testing.T) {
 		priority string
 		want     string
 	}{
-		{prioError, colorError},
-		{prioWarning, colorWarning},
-		{prioSuccess, colorSuccess},
-		{prioInfo, colorInfo},
-		{prioUnknown, colorDefault},
+		{"error", colorError},
+		{"warning", colorWarning},
+		{"success", colorSuccess},
+		{"info", colorInfo},
+		{"unknown", colorDefault},
 	}
 
 	for _, tc := range colors {
@@ -633,19 +606,53 @@ func TestSendSlackAllColors(t *testing.T) {
 func TestSendSlackClientError(t *testing.T) {
 	t.Parallel()
 
-	assertSendStatusError(
-		t, http.StatusBadRequest,
-		notify.ErrSlackFailed, sendSlackInfo,
+	srv := httptest.NewServer(
+		http.HandlerFunc(
+			func(w http.ResponseWriter, _ *http.Request) {
+				w.WriteHeader(http.StatusBadRequest)
+			}),
 	)
+	defer srv.Close()
+
+	svc := notify.NewTestService(srv.Client().Transport)
+	webhookURL, _ := url.Parse(srv.URL)
+
+	err := svc.SendSlack(
+		context.Background(), webhookURL, "t", "m", "info",
+	)
+	if err == nil {
+		t.Fatal("expected error for 400 response")
+	}
+
+	if !errors.Is(err, notify.ErrSlackFailed) {
+		t.Errorf("error = %v, want ErrSlackFailed", err)
+	}
 }
 
 func TestSendSlackServerError(t *testing.T) {
 	t.Parallel()
 
-	assertSendStatusError(
-		t, http.StatusBadGateway,
-		notify.ErrSlackFailed, sendSlackInfo,
+	srv := httptest.NewServer(
+		http.HandlerFunc(
+			func(w http.ResponseWriter, _ *http.Request) {
+				w.WriteHeader(http.StatusBadGateway)
+			}),
 	)
+	defer srv.Close()
+
+	svc := notify.NewTestService(srv.Client().Transport)
+	webhookURL, _ := url.Parse(srv.URL)
+
+	err := svc.SendSlack(
+		context.Background(), webhookURL, "t", "m", "error",
+	)
+	if err == nil {
+		t.Fatal("expected error for 502 response")
+	}
+
+	if !errors.Is(err, notify.ErrSlackFailed) {
+		t.Errorf("error = %v, want ErrSlackFailed", err)
+	}
 }
 
 func TestSendSlackNetworkError(t *testing.T) {
@@ -970,62 +977,74 @@ func TestSendNotificationMattermostOnly(t *testing.T) {
 	}
 }
 
-// assertSendNotificationTolerates verifies SendNotification
-// neither panics nor blocks when the endpoint configured by
-// setURL responds with status.
-func assertSendNotificationTolerates(
-	t *testing.T,
-	status int,
-	priority string,
-	setURL func(*notify.Service, *url.URL),
-) {
-	t.Helper()
+func TestSendNotificationNtfyError(t *testing.T) {
+	t.Parallel()
 
 	srv := httptest.NewServer(
 		http.HandlerFunc(
 			func(w http.ResponseWriter, _ *http.Request) {
-				w.WriteHeader(status)
+				w.WriteHeader(http.StatusInternalServerError)
 			}),
 	)
 	defer srv.Close()
 
-	target, _ := url.Parse(srv.URL)
+	ntfyURL, _ := url.Parse(srv.URL)
 
 	svc := notify.NewTestService(http.DefaultTransport)
-	setURL(svc, target)
+	svc.SetNtfyURL(ntfyURL)
 
+	// Should not panic or block.
 	svc.SendNotification(
-		context.Background(), "t", "m", priority,
+		context.Background(), "t", "m", "error",
 	)
 
 	time.Sleep(100 * time.Millisecond)
 }
 
-func TestSendNotificationNtfyError(t *testing.T) {
-	t.Parallel()
-
-	assertSendNotificationTolerates(
-		t, http.StatusInternalServerError, prioError,
-		(*notify.Service).SetNtfyURL,
-	)
-}
-
 func TestSendNotificationSlackError(t *testing.T) {
 	t.Parallel()
 
-	assertSendNotificationTolerates(
-		t, http.StatusForbidden, prioError,
-		(*notify.Service).SetSlackWebhookURL,
+	srv := httptest.NewServer(
+		http.HandlerFunc(
+			func(w http.ResponseWriter, _ *http.Request) {
+				w.WriteHeader(http.StatusForbidden)
+			}),
 	)
+	defer srv.Close()
+
+	slackURL, _ := url.Parse(srv.URL)
+
+	svc := notify.NewTestService(http.DefaultTransport)
+	svc.SetSlackWebhookURL(slackURL)
+
+	svc.SendNotification(
+		context.Background(), "t", "m", "error",
+	)
+
+	time.Sleep(100 * time.Millisecond)
 }
 
 func TestSendNotificationMattermostError(t *testing.T) {
 	t.Parallel()
 
-	assertSendNotificationTolerates(
-		t, http.StatusBadGateway, prioWarning,
-		(*notify.Service).SetMattermostWebhookURL,
+	srv := httptest.NewServer(
+		http.HandlerFunc(
+			func(w http.ResponseWriter, _ *http.Request) {
+				w.WriteHeader(http.StatusBadGateway)
+			}),
 	)
+	defer srv.Close()
+
+	mmURL, _ := url.Parse(srv.URL)
+
+	svc := notify.NewTestService(http.DefaultTransport)
+	svc.SetMattermostWebhookURL(mmURL)
+
+	svc.SendNotification(
+		context.Background(), "t", "m", "warning",
+	)
+
+	time.Sleep(100 * time.Millisecond)
 }
 
 // ── SlackPayload JSON marshaling ──────────────────────────

internal/notify/history_test.go

@@ -29,14 +29,14 @@ func TestAlertHistoryAddAndRecent(t *testing.T) {
 		Timestamp: now.Add(-2 * time.Minute),
 		Title:     "first",
 		Message:   "msg1",
-		Priority:  prioInfo,
+		Priority:  "info",
 	})
 
 	h.Add(notify.AlertEntry{
 		Timestamp: now.Add(-1 * time.Minute),
 		Title:     "second",
 		Message:   "msg2",
-		Priority:  prioWarning,
+		Priority:  "warning",
 	})
 
 	entries := h.Recent()

internal/notify/retry.go

@@ -69,7 +69,7 @@ func (rc RetryConfig) backoff(attempt int) time.Duration {
 	lo := raw * (1 - jitterFraction)
 	hi := raw * (1 + jitterFraction)
 
-	jittered := lo + rand.Float64()*(hi-lo) //nolint:gosec // jitter needs no crypto/rand
+	jittered := lo + rand.Float64()*(hi-lo) //nolint:gosec // jitter does not need crypto/rand
 
 	return time.Duration(jittered)
 }

internal/state/state_test.go

@@ -13,16 +13,6 @@ import (
 
 const testHostname = "www.example.com"
 
-// Shared fixture values used across tests.
-const (
-	testNS1     = "ns1.example.com."
-	testNS2     = "ns2.example.com."
-	testAltNS1  = "ns1.test.com."
-	testIPv4    = "93.184.216.34"
-	testIP      = "1.2.3.4"
-	statusError = "error"
-)
-
 // populateState fills a State with representative test data across all categories.
 func populateState(t *testing.T, s *state.State) {
 	t.Helper()
@@ -30,7 +20,7 @@ func populateState(t *testing.T, s *state.State) {
 	now := time.Now().UTC().Truncate(time.Second)
 
 	s.SetDomainState("example.com", &state.DomainState{
-		Nameservers: []string{testNS1, testNS2},
+		Nameservers: []string{"ns1.example.com.", "ns2.example.com."},
 		LastChecked: now,
 	})
 
@@ -41,17 +31,17 @@ func populateState(t *testing.T, s *state.State) {
 
 	s.SetHostnameState(testHostname, &state.HostnameState{
 		RecordsByNameserver: map[string]*state.NameserverRecordState{
-			testNS1: {
+			"ns1.example.com.": {
 				Records: map[string][]string{
-					"A":    {testIPv4},
+					"A":    {"93.184.216.34"},
 					"AAAA": {"2606:2800:220:1:248:1893:25c8:1946"},
 				},
 				Status:      "ok",
 				LastChecked: now,
 			},
-			testNS2: {
+			"ns2.example.com.": {
 				Records: map[string][]string{
-					"A": {testIPv4},
+					"A": {"93.184.216.34"},
 				},
 				Status:      "ok",
 				LastChecked: now,
@@ -162,13 +152,13 @@ func TestSaveLoadRoundTrip_Hostnames(t *testing.T) {
 func verifyNS1Records(t *testing.T, hn *state.HostnameState) {
 	t.Helper()
 
-	ns1, ok := hn.RecordsByNameserver[testNS1]
+	ns1, ok := hn.RecordsByNameserver["ns1.example.com."]
 	if !ok {
 		t.Fatal("missing nameserver ns1.example.com.")
 	}
 
 	aRecords := ns1.Records["A"]
-	if len(aRecords) != 1 || aRecords[0] != testIPv4 {
+	if len(aRecords) != 1 || aRecords[0] != "93.184.216.34" {
 		t.Errorf("ns1 A records: got %v", aRecords)
 	}
 
@@ -223,8 +213,7 @@ func TestSaveLoadRoundTrip_Ports(t *testing.T) {
 	}
 }
 
-// TestSaveLoadRoundTrip_Certificates verifies certificate data
-// survives a save/load cycle.
+// TestSaveLoadRoundTrip_Certificates verifies certificate data survives a save/load cycle.
 func TestSaveLoadRoundTrip_Certificates(t *testing.T) {
 	t.Parallel()
 
@@ -664,7 +653,7 @@ func TestDomainState_GetSet(t *testing.T) {
 
 	now := time.Now().UTC().Truncate(time.Second)
 	ds := &state.DomainState{
-		Nameservers: []string{testAltNS1},
+		Nameservers: []string{"ns1.test.com."},
 		LastChecked: now,
 	}
 
@@ -675,7 +664,7 @@ func TestDomainState_GetSet(t *testing.T) {
 		t.Fatal("expected true for existing domain")
 	}
 
-	if len(got.Nameservers) != 1 || got.Nameservers[0] != testAltNS1 {
+	if len(got.Nameservers) != 1 || got.Nameservers[0] != "ns1.test.com." {
 		t.Errorf("nameservers: got %v", got.Nameservers)
 	}
 
@@ -685,7 +674,7 @@ func TestDomainState_GetSet(t *testing.T) {
 
 	// Overwrite.
 	ds2 := &state.DomainState{
-		Nameservers: []string{testAltNS1, "ns2.test.com."},
+		Nameservers: []string{"ns1.test.com.", "ns2.test.com."},
 		LastChecked: now.Add(time.Hour),
 	}
 
@@ -715,8 +704,8 @@ func TestHostnameState_GetSet(t *testing.T) {
 	now := time.Now().UTC().Truncate(time.Second)
 	hs := &state.HostnameState{
 		RecordsByNameserver: map[string]*state.NameserverRecordState{
-			testNS1: {
-				Records:     map[string][]string{"A": {testIP}},
+			"ns1.example.com.": {
+				Records:     map[string][]string{"A": {"1.2.3.4"}},
 				Status:      "ok",
 				LastChecked: now,
 			},
@@ -731,7 +720,7 @@ func TestHostnameState_GetSet(t *testing.T) {
 		t.Fatal("expected true for existing hostname")
 	}
 
-	nsState, ok := got.RecordsByNameserver[testNS1]
+	nsState, ok := got.RecordsByNameserver["ns1.example.com."]
 	if !ok {
 		t.Fatal("missing nameserver entry")
 	}
@@ -741,7 +730,7 @@ func TestHostnameState_GetSet(t *testing.T) {
 	}
 
 	aRecords := nsState.Records["A"]
-	if len(aRecords) != 1 || aRecords[0] != testIP {
+	if len(aRecords) != 1 || aRecords[0] != "1.2.3.4" {
 		t.Errorf("A records: got %v", aRecords)
 	}
 }
@@ -880,7 +869,7 @@ func TestCertificateState_ErrorField(t *testing.T) {
 
 	now := time.Now().UTC().Truncate(time.Second)
 	cs := &state.CertificateState{
-		Status:      statusError,
+		Status:      "error",
 		Error:       "connection refused",
 		LastChecked: now,
 	}
@@ -904,8 +893,8 @@ func TestCertificateState_ErrorField(t *testing.T) {
 		t.Fatal("missing certificate after load")
 	}
 
-	if got.Status != statusError {
-		t.Errorf("status: got %q, want %q", got.Status, statusError)
+	if got.Status != "error" {
+		t.Errorf("status: got %q, want %q", got.Status, "error")
 	}
 
 	if got.Error != "connection refused" {
@@ -923,9 +912,9 @@ func TestHostnameState_ErrorField(t *testing.T) {
 	now := time.Now().UTC().Truncate(time.Second)
 	hs := &state.HostnameState{
 		RecordsByNameserver: map[string]*state.NameserverRecordState{
-			testNS1: {
+			"ns1.example.com.": {
 				Records:     nil,
-				Status:      statusError,
+				Status:      "error",
 				Error:       "SERVFAIL",
 				LastChecked: now,
 			},
@@ -952,9 +941,9 @@ func TestHostnameState_ErrorField(t *testing.T) {
 		t.Fatal("missing hostname after load")
 	}
 
-	nsState := got.RecordsByNameserver[testNS1]
-	if nsState.Status != statusError {
-		t.Errorf("status: got %q, want %q", nsState.Status, statusError)
+	nsState := got.RecordsByNameserver["ns1.example.com."]
+	if nsState.Status != "error" {
+		t.Errorf("status: got %q, want %q", nsState.Status, "error")
 	}
 
 	if nsState.Error != "SERVFAIL" {
@@ -1073,8 +1062,7 @@ func TestConcurrentGetSet(t *testing.T) {
 	wg.Wait()
 }
 
-// runConcurrentOps performs a series of get/set/delete
-// operations for concurrency testing.
+// runConcurrentOps performs a series of get/set/delete operations for concurrency testing.
 func runConcurrentOps(s *state.State, key string, now time.Time) {
 	const iterations = 50
 
@@ -1097,7 +1085,7 @@ func runConcurrentOps(s *state.State, key string, now time.Time) {
 		s.SetHostnameState(key+".example.com", &state.HostnameState{
 			RecordsByNameserver: map[string]*state.NameserverRecordState{
 				"ns1.test.": {
-					Records:     map[string][]string{"A": {testIP}},
+					Records:     map[string][]string{"A": {"1.2.3.4"}},
 					Status:      "ok",
 					LastChecked: now,
 				},

internal/watcher/watcher.go

@@ -26,12 +26,6 @@ const tlsPort = 443
 // hoursPerDay converts days to hours for duration calculations.
 const hoursPerDay = 24
 
-// Status values recorded for nameserver and certificate checks.
-const (
-	statusOK    = "ok"
-	statusError = "error"
-)
-
 // Params contains dependencies for Watcher.
 type Params struct {
 	fx.In
@@ -350,7 +344,7 @@ func buildHostnameState(
 	for ns, recs := range records {
 		hs.RecordsByNameserver[ns] = &state.NameserverRecordState{
 			Records:     recs,
-			Status:      statusOK,
+			Status:      "ok",
 			LastChecked: now,
 		}
 	}
@@ -408,7 +402,7 @@ func (w *Watcher) detectNSDisappearances(
 	current map[string]map[string][]string,
 ) {
 	for ns, prevNS := range prev.RecordsByNameserver {
-		if _, ok := current[ns]; ok || prevNS.Status != statusOK {
+		if _, ok := current[ns]; ok || prevNS.Status != "ok" {
 			continue
 		}
 
@@ -427,7 +421,7 @@ func (w *Watcher) detectNSDisappearances(
 
 	for ns := range current {
 		prevNS, ok := prev.RecordsByNameserver[ns]
-		if !ok || prevNS.Status != statusError {
+		if !ok || prevNS.Status != "error" {
 			continue
 		}
 
@@ -711,7 +705,7 @@ func (w *Watcher) handleTLSError(
 	now time.Time,
 	err error,
 ) {
-	if hasPrev && !w.firstRun && prev.Status == statusOK {
+	if hasPrev && !w.firstRun && prev.Status == "ok" {
 		msg := fmt.Sprintf(
 			"Host: %s\nIP: %s\nError: %s",
 			hostname, ip, err,
@@ -727,7 +721,7 @@ func (w *Watcher) handleTLSError(
 
 	w.state.SetCertificateState(
 		certKey, &state.CertificateState{
-			Status:      statusError,
+			Status:      "error",
 			Error:       err.Error(),
 			LastChecked: now,
 		},
@@ -754,7 +748,7 @@ func (w *Watcher) handleTLSSuccess(
 			Issuer:                  cert.Issuer,
 			NotAfter:                cert.NotAfter,
 			SubjectAlternativeNames: cert.SubjectAlternativeNames,
-			Status:                  statusOK,
+			Status:                  "ok",
 			LastChecked:             now,
 		},
 	)
@@ -766,7 +760,7 @@ func (w *Watcher) detectTLSChanges(
 	prev *state.CertificateState,
 	cert *tlscheck.CertificateInfo,
 ) {
-	if prev.Status == statusError {
+	if prev.Status == "error" {
 		msg := fmt.Sprintf(
 			"Host: %s\nIP: %s\nTLS recovered",
 			hostname, ip,

internal/watcher/watcher_test.go

@@ -18,17 +18,6 @@ import (
 // errNotFound is returned when mock data is missing.
 var errNotFound = errors.New("not found")
 
-// Fixture values shared across tests.
-const (
-	testDomain = "example.com"
-	testHost   = "www.example.com"
-	testNS1    = "ns1.example.com."
-	testNS2    = "ns2.example.com."
-	testIPv4   = "93.184.216.34"
-	testIP     = "1.2.3.4"
-	testIssuer = "DigiCert"
-)
-
 // --- Mock implementations ---
 
 type mockResolver struct {
@@ -267,8 +256,8 @@ func TestFirstRunBaseline(t *testing.T) {
 	t.Parallel()
 
 	cfg := defaultTestConfig(t)
-	cfg.Domains = []string{testDomain}
-	cfg.Hostnames = []string{testHost}
+	cfg.Domains = []string{"example.com"}
+	cfg.Hostnames = []string{"www.example.com"}
 
 	w, deps := newTestWatcher(t, cfg)
 	setupBaselineMocks(deps)
@@ -280,37 +269,37 @@ func TestFirstRunBaseline(t *testing.T) {
 }
 
 func setupBaselineMocks(deps *testDeps) {
-	deps.resolver.nsRecords[testDomain] = []string{
-		testNS1,
-		testNS2,
+	deps.resolver.nsRecords["example.com"] = []string{
+		"ns1.example.com.",
+		"ns2.example.com.",
 	}
-	deps.resolver.allRecords[testDomain] = map[string]map[string][]string{
-		testNS1: {"A": {testIPv4}},
-		testNS2: {"A": {testIPv4}},
+	deps.resolver.allRecords["example.com"] = map[string]map[string][]string{
+		"ns1.example.com.": {"A": {"93.184.216.34"}},
+		"ns2.example.com.": {"A": {"93.184.216.34"}},
 	}
-	deps.resolver.allRecords[testHost] = map[string]map[string][]string{
-		testNS1: {"A": {testIPv4}},
-		testNS2: {"A": {testIPv4}},
+	deps.resolver.allRecords["www.example.com"] = map[string]map[string][]string{
+		"ns1.example.com.": {"A": {"93.184.216.34"}},
+		"ns2.example.com.": {"A": {"93.184.216.34"}},
 	}
-	deps.resolver.ipAddresses[testHost] = []string{
-		testIPv4,
+	deps.resolver.ipAddresses["www.example.com"] = []string{
+		"93.184.216.34",
 	}
 	deps.portChecker.results["93.184.216.34:80"] = true
 	deps.portChecker.results["93.184.216.34:443"] = true
 	deps.tlsChecker.certs["93.184.216.34:www.example.com"] = &tlscheck.CertificateInfo{
-		CommonName: testHost,
-		Issuer:     testIssuer,
+		CommonName: "www.example.com",
+		Issuer:     "DigiCert",
 		NotAfter:   time.Now().Add(90 * 24 * time.Hour),
 		SubjectAlternativeNames: []string{
-			testHost,
+			"www.example.com",
 		},
 	}
 	deps.tlsChecker.certs["93.184.216.34:example.com"] = &tlscheck.CertificateInfo{
-		CommonName: testDomain,
-		Issuer:     testIssuer,
+		CommonName: "example.com",
+		Issuer:     "DigiCert",
 		NotAfter:   time.Now().Add(90 * 24 * time.Hour),
 		SubjectAlternativeNames: []string{
-			testDomain,
+			"example.com",
 		},
 	}
 }
@@ -359,24 +348,24 @@ func TestDomainPortAndTLSChecks(t *testing.T) {
 	t.Parallel()
 
 	cfg := defaultTestConfig(t)
-	cfg.Domains = []string{testDomain}
+	cfg.Domains = []string{"example.com"}
 
 	w, deps := newTestWatcher(t, cfg)
 
-	deps.resolver.nsRecords[testDomain] = []string{
-		testNS1,
+	deps.resolver.nsRecords["example.com"] = []string{
+		"ns1.example.com.",
 	}
-	deps.resolver.allRecords[testDomain] = map[string]map[string][]string{
-		testNS1: {"A": {testIPv4}},
+	deps.resolver.allRecords["example.com"] = map[string]map[string][]string{
+		"ns1.example.com.": {"A": {"93.184.216.34"}},
 	}
 	deps.portChecker.results["93.184.216.34:80"] = true
 	deps.portChecker.results["93.184.216.34:443"] = true
 	deps.tlsChecker.certs["93.184.216.34:example.com"] = &tlscheck.CertificateInfo{
-		CommonName: testDomain,
-		Issuer:     testIssuer,
+		CommonName: "example.com",
+		Issuer:     "DigiCert",
 		NotAfter:   time.Now().Add(90 * 24 * time.Hour),
 		SubjectAlternativeNames: []string{
-			testDomain,
+			"example.com",
 		},
 	}
 
@@ -417,17 +406,17 @@ func TestNSChangeDetection(t *testing.T) {
 	t.Parallel()
 
 	cfg := defaultTestConfig(t)
-	cfg.Domains = []string{testDomain}
+	cfg.Domains = []string{"example.com"}
 
 	w, deps := newTestWatcher(t, cfg)
 
-	deps.resolver.nsRecords[testDomain] = []string{
-		testNS1,
-		testNS2,
+	deps.resolver.nsRecords["example.com"] = []string{
+		"ns1.example.com.",
+		"ns2.example.com.",
 	}
-	deps.resolver.allRecords[testDomain] = map[string]map[string][]string{
-		testNS1: {"A": {testIP}},
-		testNS2: {"A": {testIP}},
+	deps.resolver.allRecords["example.com"] = map[string]map[string][]string{
+		"ns1.example.com.": {"A": {"1.2.3.4"}},
+		"ns2.example.com.": {"A": {"1.2.3.4"}},
 	}
 	deps.portChecker.results["1.2.3.4:80"] = false
 	deps.portChecker.results["1.2.3.4:443"] = false
@@ -436,13 +425,13 @@ func TestNSChangeDetection(t *testing.T) {
 	w.RunOnce(ctx)
 
 	deps.resolver.mu.Lock()
-	deps.resolver.nsRecords[testDomain] = []string{
-		testNS1,
+	deps.resolver.nsRecords["example.com"] = []string{
+		"ns1.example.com.",
 		"ns3.example.com.",
 	}
-	deps.resolver.allRecords[testDomain] = map[string]map[string][]string{
-		testNS1:            {"A": {testIP}},
-		"ns3.example.com.": {"A": {testIP}},
+	deps.resolver.allRecords["example.com"] = map[string]map[string][]string{
+		"ns1.example.com.": {"A": {"1.2.3.4"}},
+		"ns3.example.com.": {"A": {"1.2.3.4"}},
 	}
 	deps.resolver.mu.Unlock()
 
@@ -470,15 +459,15 @@ func TestRecordChangeDetection(t *testing.T) {
 	t.Parallel()
 
 	cfg := defaultTestConfig(t)
-	cfg.Hostnames = []string{testHost}
+	cfg.Hostnames = []string{"www.example.com"}
 
 	w, deps := newTestWatcher(t, cfg)
 
-	deps.resolver.allRecords[testHost] = map[string]map[string][]string{
-		testNS1: {"A": {testIPv4}},
+	deps.resolver.allRecords["www.example.com"] = map[string]map[string][]string{
+		"ns1.example.com.": {"A": {"93.184.216.34"}},
 	}
-	deps.resolver.ipAddresses[testHost] = []string{
-		testIPv4,
+	deps.resolver.ipAddresses["www.example.com"] = []string{
+		"93.184.216.34",
 	}
 	deps.portChecker.results["93.184.216.34:80"] = false
 	deps.portChecker.results["93.184.216.34:443"] = false
@@ -487,10 +476,10 @@ func TestRecordChangeDetection(t *testing.T) {
 	w.RunOnce(ctx)
 
 	deps.resolver.mu.Lock()
-	deps.resolver.allRecords[testHost] = map[string]map[string][]string{
-		testNS1: {"A": {"93.184.216.35"}},
+	deps.resolver.allRecords["www.example.com"] = map[string]map[string][]string{
+		"ns1.example.com.": {"A": {"93.184.216.35"}},
 	}
-	deps.resolver.ipAddresses[testHost] = []string{
+	deps.resolver.ipAddresses["www.example.com"] = []string{
 		"93.184.216.35",
 	}
 	deps.resolver.mu.Unlock()
@@ -512,24 +501,24 @@ func TestPortStateChange(t *testing.T) {
 	t.Parallel()
 
 	cfg := defaultTestConfig(t)
-	cfg.Hostnames = []string{testHost}
+	cfg.Hostnames = []string{"www.example.com"}
 
 	w, deps := newTestWatcher(t, cfg)
 
-	deps.resolver.allRecords[testHost] = map[string]map[string][]string{
-		testNS1: {"A": {testIP}},
+	deps.resolver.allRecords["www.example.com"] = map[string]map[string][]string{
+		"ns1.example.com.": {"A": {"1.2.3.4"}},
 	}
-	deps.resolver.ipAddresses[testHost] = []string{
-		testIP,
+	deps.resolver.ipAddresses["www.example.com"] = []string{
+		"1.2.3.4",
 	}
 	deps.portChecker.results["1.2.3.4:80"] = true
 	deps.portChecker.results["1.2.3.4:443"] = true
 	deps.tlsChecker.certs["1.2.3.4:www.example.com"] = &tlscheck.CertificateInfo{
-		CommonName: testHost,
-		Issuer:     testIssuer,
+		CommonName: "www.example.com",
+		Issuer:     "DigiCert",
 		NotAfter:   time.Now().Add(90 * 24 * time.Hour),
 		SubjectAlternativeNames: []string{
-			testHost,
+			"www.example.com",
 		},
 	}
 
@@ -552,24 +541,24 @@ func TestTLSExpiryWarning(t *testing.T) {
 	t.Parallel()
 
 	cfg := defaultTestConfig(t)
-	cfg.Hostnames = []string{testHost}
+	cfg.Hostnames = []string{"www.example.com"}
 
 	w, deps := newTestWatcher(t, cfg)
 
-	deps.resolver.allRecords[testHost] = map[string]map[string][]string{
-		testNS1: {"A": {testIP}},
+	deps.resolver.allRecords["www.example.com"] = map[string]map[string][]string{
+		"ns1.example.com.": {"A": {"1.2.3.4"}},
 	}
-	deps.resolver.ipAddresses[testHost] = []string{
-		testIP,
+	deps.resolver.ipAddresses["www.example.com"] = []string{
+		"1.2.3.4",
 	}
 	deps.portChecker.results["1.2.3.4:80"] = true
 	deps.portChecker.results["1.2.3.4:443"] = true
 	deps.tlsChecker.certs["1.2.3.4:www.example.com"] = &tlscheck.CertificateInfo{
-		CommonName: testHost,
-		Issuer:     testIssuer,
+		CommonName: "www.example.com",
+		Issuer:     "DigiCert",
 		NotAfter:   time.Now().Add(3 * 24 * time.Hour),
 		SubjectAlternativeNames: []string{
-			testHost,
+			"www.example.com",
 		},
 	}
 
@@ -603,25 +592,25 @@ func TestTLSExpiryWarningDedup(t *testing.T) {
 	t.Parallel()
 
 	cfg := defaultTestConfig(t)
-	cfg.Hostnames = []string{testHost}
+	cfg.Hostnames = []string{"www.example.com"}
 	cfg.TLSInterval = 24 * time.Hour
 
 	w, deps := newTestWatcher(t, cfg)
 
-	deps.resolver.allRecords[testHost] = map[string]map[string][]string{
-		testNS1: {"A": {testIP}},
+	deps.resolver.allRecords["www.example.com"] = map[string]map[string][]string{
+		"ns1.example.com.": {"A": {"1.2.3.4"}},
 	}
-	deps.resolver.ipAddresses[testHost] = []string{
-		testIP,
+	deps.resolver.ipAddresses["www.example.com"] = []string{
+		"1.2.3.4",
 	}
 	deps.portChecker.results["1.2.3.4:80"] = true
 	deps.portChecker.results["1.2.3.4:443"] = true
 	deps.tlsChecker.certs["1.2.3.4:www.example.com"] = &tlscheck.CertificateInfo{
-		CommonName: testHost,
-		Issuer:     testIssuer,
+		CommonName: "www.example.com",
+		Issuer:     "DigiCert",
 		NotAfter:   time.Now().Add(3 * 24 * time.Hour),
 		SubjectAlternativeNames: []string{
-			testHost,
+			"www.example.com",
 		},
 	}
 
@@ -658,17 +647,17 @@ func TestGracefulShutdown(t *testing.T) {
 	t.Parallel()
 
 	cfg := defaultTestConfig(t)
-	cfg.Domains = []string{testDomain}
+	cfg.Domains = []string{"example.com"}
 	cfg.DNSInterval = 100 * time.Millisecond
 	cfg.TLSInterval = 100 * time.Millisecond
 
 	w, deps := newTestWatcher(t, cfg)
 
-	deps.resolver.nsRecords[testDomain] = []string{
-		testNS1,
+	deps.resolver.nsRecords["example.com"] = []string{
+		"ns1.example.com.",
 	}
-	deps.resolver.allRecords[testDomain] = map[string]map[string][]string{
-		testNS1: {"A": {testIP}},
+	deps.resolver.allRecords["example.com"] = map[string]map[string][]string{
+		"ns1.example.com.": {"A": {"1.2.3.4"}},
 	}
 	deps.portChecker.results["1.2.3.4:80"] = false
 	deps.portChecker.results["1.2.3.4:443"] = false
@@ -698,13 +687,13 @@ func setupHostnameIP(
 	hostname, ip string,
 ) {
 	deps.resolver.allRecords[hostname] = map[string]map[string][]string{
-		testNS1: {"A": {ip}},
+		"ns1.example.com.": {"A": {ip}},
 	}
 	deps.portChecker.results[ip+":80"] = true
 	deps.portChecker.results[ip+":443"] = true
 	deps.tlsChecker.certs[ip+":"+hostname] = &tlscheck.CertificateInfo{
 		CommonName:              hostname,
-		Issuer:                  testIssuer,
+		Issuer:                  "DigiCert",
 		NotAfter:                time.Now().Add(90 * 24 * time.Hour),
 		SubjectAlternativeNames: []string{hostname},
 	}
@@ -713,7 +702,7 @@ func setupHostnameIP(
 func updateHostnameIP(deps *testDeps, hostname, ip string) {
 	deps.resolver.mu.Lock()
 	deps.resolver.allRecords[hostname] = map[string]map[string][]string{
-		testNS1: {"A": {ip}},
+		"ns1.example.com.": {"A": {ip}},
 	}
 	deps.resolver.mu.Unlock()
 
@@ -725,7 +714,7 @@ func updateHostnameIP(deps *testDeps, hostname, ip string) {
 	deps.tlsChecker.mu.Lock()
 	deps.tlsChecker.certs[ip+":"+hostname] = &tlscheck.CertificateInfo{
 		CommonName:              hostname,
-		Issuer:                  testIssuer,
+		Issuer:                  "DigiCert",
 		NotAfter:                time.Now().Add(90 * 24 * time.Hour),
 		SubjectAlternativeNames: []string{hostname},
 	}
@@ -736,11 +725,11 @@ func TestDNSRunsBeforePortAndTLSChecks(t *testing.T) {
 	t.Parallel()
 
 	cfg := defaultTestConfig(t)
-	cfg.Hostnames = []string{testHost}
+	cfg.Hostnames = []string{"www.example.com"}
 
 	w, deps := newTestWatcher(t, cfg)
 
-	setupHostnameIP(deps, testHost, "10.0.0.1")
+	setupHostnameIP(deps, "www.example.com", "10.0.0.1")
 
 	ctx := t.Context()
 	w.RunOnce(ctx)
@@ -751,7 +740,7 @@ func TestDNSRunsBeforePortAndTLSChecks(t *testing.T) {
 	}
 
 	// DNS changes to a new IP; port and TLS must pick it up.
-	updateHostnameIP(deps, testHost, "10.0.0.2")
+	updateHostnameIP(deps, "www.example.com", "10.0.0.2")
 
 	w.RunOnce(ctx)
 
@@ -771,8 +760,8 @@ func TestSendTestNotification_Enabled(t *testing.T) {
 	t.Parallel()
 
 	cfg := defaultTestConfig(t)
-	cfg.Domains = []string{testDomain}
-	cfg.Hostnames = []string{testHost}
+	cfg.Domains = []string{"example.com"}
+	cfg.Hostnames = []string{"www.example.com"}
 	cfg.SendTestNotification = true
 
 	w, deps := newTestWatcher(t, cfg)
@@ -797,8 +786,8 @@ func TestSendTestNotification_ViaRun(t *testing.T) {
 	t.Parallel()
 
 	cfg := defaultTestConfig(t)
-	cfg.Domains = []string{testDomain}
-	cfg.Hostnames = []string{testHost}
+	cfg.Domains = []string{"example.com"}
+	cfg.Hostnames = []string{"www.example.com"}
 	cfg.SendTestNotification = true
 	cfg.DNSInterval = 24 * time.Hour
 	cfg.TLSInterval = 24 * time.Hour
@@ -844,8 +833,8 @@ func TestSendTestNotification_Disabled(t *testing.T) {
 	t.Parallel()
 
 	cfg := defaultTestConfig(t)
-	cfg.Domains = []string{testDomain}
-	cfg.Hostnames = []string{testHost}
+	cfg.Domains = []string{"example.com"}
+	cfg.Hostnames = []string{"www.example.com"}
 	cfg.SendTestNotification = false
 	cfg.DNSInterval = 24 * time.Hour
 	cfg.TLSInterval = 24 * time.Hour
@@ -882,16 +871,16 @@ func TestNSFailureAndRecovery(t *testing.T) {
 	t.Parallel()
 
 	cfg := defaultTestConfig(t)
-	cfg.Hostnames = []string{testHost}
+	cfg.Hostnames = []string{"www.example.com"}
 
 	w, deps := newTestWatcher(t, cfg)
 
-	deps.resolver.allRecords[testHost] = map[string]map[string][]string{
-		testNS1: {"A": {testIP}},
-		testNS2: {"A": {testIP}},
+	deps.resolver.allRecords["www.example.com"] = map[string]map[string][]string{
+		"ns1.example.com.": {"A": {"1.2.3.4"}},
+		"ns2.example.com.": {"A": {"1.2.3.4"}},
 	}
-	deps.resolver.ipAddresses[testHost] = []string{
-		testIP,
+	deps.resolver.ipAddresses["www.example.com"] = []string{
+		"1.2.3.4",
 	}
 	deps.portChecker.results["1.2.3.4:80"] = false
 	deps.portChecker.results["1.2.3.4:443"] = false
@@ -901,8 +890,8 @@ func TestNSFailureAndRecovery(t *testing.T) {
 	w.RunOnce(ctx)
 
 	deps.resolver.mu.Lock()
-	deps.resolver.allRecords[testHost] = map[string]map[string][]string{
-		testNS1: {"A": {testIP}},
+	deps.resolver.allRecords["www.example.com"] = map[string]map[string][]string{
+		"ns1.example.com.": {"A": {"1.2.3.4"}},
 	}
 	deps.resolver.mu.Unlock()
 

script/bootstrap

@@ -1,20 +1,17 @@
 #!/bin/sh
 # script/bootstrap: install all dependencies needed to build and develop
-# this repo. Base tooling (git, make, go) comes from nix, apt, brew, or
-# apk (detected in that order) and is installed only when absent;
-# assumes nothing is present. golangci-lint and goimports are always
-# (re)installed via `go install` at the same pinned commits the
-# Dockerfile uses (never "latest") -- a presence check cannot tell the
-# pinned build from an arbitrary one already on PATH, so guarding them
-# would make the pins inert. Idempotent either way: running this twice
-# succeeds both times and leaves the same result.
+# this repo. Idempotent: every install is guarded by a check so already
+# installed tools are skipped. Base tooling comes from nix, apt, brew,
+# or apk (detected in that order); assumes nothing is present.
+# golangci-lint and goimports are installed via `go install` at the same
+# pinned commits the Dockerfile uses (never "latest").
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
-# Pinned versions, 2026-08-07 (same pins as the Dockerfile)
-# golangci-lint v2.12.2
-GOLANGCI_LINT_REF="github.com/golangci/golangci-lint/v2/cmd/golangci-lint@c0d3ddc9cf3faa61a4e378e879ece580256d76e5"
+# Pinned versions, 2026-07-07 (same pins as the Dockerfile)
+# golangci-lint v2.10.1
+GOLANGCI_LINT_REF="github.com/golangci/golangci-lint/v2/cmd/golangci-lint@5d1e709b7be35cb2025444e19de266b056b7b7ee"
 # goimports v0.42.0
 GOIMPORTS_REF="golang.org/x/tools/cmd/goimports@009367f5c17a8d4c45a961a3a509277190a9a6f0"
 
@@ -65,31 +62,6 @@ missing() {
     ! command -v "$1" >/dev/null 2>&1
 }
 
-# go_bin_dir: directory `go install` writes binaries to.
-go_bin_dir() {
-    gobin="$(go env GOBIN)"
-    if [ -n "$gobin" ]; then
-        echo "$gobin"
-    else
-        echo "$(go env GOPATH)/bin"
-    fi
-}
-
-# warn_if_shadowed <tool> <dir>: the pinned build was just installed
-# into <dir>. If PATH resolves <tool> anywhere else, that other copy is
-# what `make lint` and `make fmt` will actually run, and it is not the
-# pinned version. Warn loudly rather than failing, since the fix is the
-# user's PATH and not anything this script can do.
-warn_if_shadowed() {
-    resolved="$(command -v "$1" 2>/dev/null || true)"
-    if [ "$resolved" != "$2/$1" ]; then
-        echo "bootstrap: WARNING: installed pinned $1 to $2/$1, but PATH" >&2
-        echo "bootstrap: WARNING: resolves $1 to ${resolved:-(not on PATH)};" >&2
-        echo "bootstrap: WARNING: put $2 first on PATH or lint results will" >&2
-        echo "bootstrap: WARNING: not match CI." >&2
-    fi
-}
-
 main() {
     cd "$ROOT"
 
@@ -97,17 +69,10 @@ main() {
     if missing make; then pkg_install gnumake make make make; fi
     if missing go; then pkg_install go golang go go; fi
 
-    # Lint/format tools, pinned via go install. These are installed
-    # unconditionally: `command -v` only proves *some* build is on PATH,
-    # and a wrong golangci-lint either cannot parse our v2-schema
-    # .golangci.yml at all or silently disagrees with CI. Installing at
-    # a fixed commit ref is idempotent and cheap with a warm module
-    # cache, so there is nothing to save by skipping it.
-    GOBIN_DIR="$(go_bin_dir)"
-    go install "$GOLANGCI_LINT_REF"
-    go install "$GOIMPORTS_REF"
-    warn_if_shadowed golangci-lint "$GOBIN_DIR"
-    warn_if_shadowed goimports "$GOBIN_DIR"
+    # Lint/format tools, pinned via go install (installs into
+    # "$(go env GOPATH)/bin"; ensure that is on your PATH).
+    if missing golangci-lint; then go install "$GOLANGCI_LINT_REF"; fi
+    if missing goimports; then go install "$GOIMPORTS_REF"; fi
 
     go mod download