build: update golangci-lint to v2.12.2 with commit-pinned installs

Pin golangci-lint to commit c0d3ddc9cf3faa61a4e378e879ece580256d76e5
(v2.12.2) in Dockerfile and script/bootstrap. Fix the goconst findings
the new version reports under the unchanged canonical .golangci.yml by
extracting shared test fixture constants and a statusError constant in
the watcher.

.golangci.yml

@@ -1,9 +1,5 @@
 version: "2"
 
-# Config schema uses the golangci-lint v2 layout (settings live under
-# linters.settings, not top-level linters-settings) so that the
-# thresholds below are actually applied by golangci-lint >= v2.
-
 run:
   timeout: 5m
   modules-download-mode: readonly
@@ -18,7 +14,8 @@ linters:
     - wsl              # Deprecated, replaced by wsl_v5
     - wrapcheck        # Too verbose for internal packages
     - varnamelen       # Short names like db, id are idiomatic Go
-  settings:
+
+linters-settings:
   lll:
     line-length: 88
   funlen:
@@ -30,5 +27,6 @@ linters:
     threshold: 100
 
 issues:
+  exclude-use-default: false
   max-issues-per-linter: 0
   max-same-issues: 0

README.md

@@ -17,26 +17,6 @@ without requiring an external database.
 
 ---
 
-## No DNS mocking. Ever.
-
-**DNS is never mocked in this project — not in tests, not anywhere else.**
-No mock resolvers, no fake DNS servers, no stubbed lookups.
-
-dnswatcher's entire purpose is correct behavior against the real DNS.
-Tests exercise real iterative resolution against live nameservers by
-design; a test suite that passes against a mock proves nothing about the
-one thing this program exists to do.
-
-When live tests are flaky, that is a robustness problem, and it gets
-fixed with robustness: retries with backoff, querying multiple
-independent nameservers, longer timeouts — or explicit opt-in gating
-decided by the project owner. Never with mocks.
-
-Contributions that introduce mocked, faked, or stubbed DNS will be
-rejected.
-
----
-
 ## Features
 
 ### DNS Domain Monitoring (Apex Domains)
@@ -182,27 +162,6 @@ dnswatcher exposes a lightweight HTTP API for operational visibility:
 | `GET /api/v1/status`                  | Current monitoring state       |
 | `GET /metrics`                        | Prometheus metrics (optional)  |
 
-#### Server timeouts
-
-The HTTP server sets all four socket-level timeouts. These are compile-time
-constants in `internal/server/server.go`, not configurable via environment
-variables.
-
-| Timeout             | Value | Purpose                                       |
-|---------------------|-------|-----------------------------------------------|
-| `ReadHeaderTimeout` | 10s   | Bounds the request header read (slowloris)    |
-| `ReadTimeout`       | 15s   | Bounds the whole request read, headers + body |
-| `WriteTimeout`      | 75s   | Bounds handler execution plus response flush  |
-| `IdleTimeout`       | 120s  | Reaps idle keep-alive connections             |
-
-These are distinct from the 60s per-request handler budget applied by
-`chimw.Timeout` in `internal/server/routes.go`, which cancels the request
-context but does not touch the socket. `WriteTimeout` is deliberately
-larger than that budget: the write deadline is armed once request headers
-are read, so a smaller value would sever the connection before a handler
-using its full budget could respond. `IdleTimeout` exceeds common
-Prometheus scrape intervals so the scraper reuses its connection.
-
 ---
 
 ## Architecture

TODO.md

@@ -25,22 +25,9 @@ confirm make check still passes.
 
 # Completed Steps
 
-- 2026-08-09: `http.Server` now sets all four socket-level timeouts
-  (`ReadTimeout` 15s, `ReadHeaderTimeout` 10s, `WriteTimeout` 75s,
-  `IdleTimeout` 120s) as named constants in `internal/server/server.go`,
-  closing the slowloris / unreaped-keep-alive exposure required by
-  `REPO_POLICIES.md` before 1.0; `WriteTimeout` is deliberately greater
-  than the 60s `chimw.Timeout` handler budget so that budget stays
-  reachable, and tests in `internal/server` pin both the non-zero
-  values and that relationship (#99)
 - 2026-08-07: golangci-lint bumped to v2.12.2 (commit-pinned installs
-  in `Dockerfile` and `script/bootstrap`); `.golangci.yml` set to the
+  in `Dockerfile` and `script/bootstrap`); fixed the resulting
-  org-standard v2-schema config used across the org's repos
+  `goconst` findings. `.golangci.yml` unchanged (canonical)
-  (owner-authorized; same file is being landed as canonical via prompts
-  PR #24), with settings under `linters.settings` so the
-  lll/funlen/cyclop/dupl thresholds apply; fixed the resulting
-  `goconst`, `dupl`, and `lll` findings; the informational `gomodguard`
-  deprecation warning under this config is accepted
 - 2026-07-07 Adopted scripts-to-rule-them-all: `script/` entrypoints,
   Makefile shims, README Entrypoints section
 - 2026-02-20: iterative DNS resolver implemented; tests made hermetic

internal/config/classify_test.go

@@ -17,33 +17,13 @@ func TestClassifyDNSName(t *testing.T) {
 	}{
 		{name: "apex domain simple", input: "example.com", want: config.DNSNameTypeDomain},
 		{name: "hostname simple", input: "www.example.com", want: config.DNSNameTypeHostname},
-		{
+		{name: "apex domain multi-part TLD", input: "example.co.uk", want: config.DNSNameTypeDomain},
-			name:  "apex domain multi-part TLD",
+		{name: "hostname multi-part TLD", input: "api.example.co.uk", want: config.DNSNameTypeHostname},
-			input: "example.co.uk",
-			want:  config.DNSNameTypeDomain,
-		},
-		{
-			name:  "hostname multi-part TLD",
-			input: "api.example.co.uk",
-			want:  config.DNSNameTypeHostname,
-		},
 		{name: "public suffix itself", input: "co.uk", wantErr: true},
 		{name: "empty string", input: "", wantErr: true},
-		{
+		{name: "deeply nested hostname", input: "a.b.c.example.com", want: config.DNSNameTypeHostname},
-			name:  "deeply nested hostname",
+		{name: "trailing dot stripped", input: "example.com.", want: config.DNSNameTypeDomain},
-			input: "a.b.c.example.com",
+		{name: "uppercase normalized", input: "WWW.Example.COM", want: config.DNSNameTypeHostname},
-			want:  config.DNSNameTypeHostname,
-		},
-		{
-			name:  "trailing dot stripped",
-			input: "example.com.",
-			want:  config.DNSNameTypeDomain,
-		},
-		{
-			name:  "uppercase normalized",
-			input: "WWW.Example.COM",
-			want:  config.DNSNameTypeHostname,
-		},
 	}
 
 	for _, tt := range tests {

internal/notify/delivery_test.go

@@ -25,20 +25,18 @@ const (
 	colorDefault = "#6c757d"
 )
 
-// Priority strings used across multiple tests.
+// Priority and fixture values shared across tests.
 const (
 	prioError   = "error"
 	prioWarning = "warning"
-	prioSuccess = "success"
 	prioInfo    = "info"
+	prioSuccess = "success"
 	prioUnknown = "unknown"
-	prioDefault = "default"
+	ntfyUrgent  = "urgent"
-	prioUrgent  = "urgent"
+	ntfyDefault = "default"
+	testHost    = "example.com"
 )
 
-// testHost is the hostname used in request construction tests.
-const testHost = "example.com"
-
 // errSimulated is a static error for transport failures.
 var errSimulated = errors.New("simulated transport failure")
 
@@ -115,13 +113,13 @@ func TestNtfyPriority(t *testing.T) {
 		input string
 		want  string
 	}{
-		{prioError, prioUrgent},
+		{prioError, ntfyUrgent},
 		{prioWarning, "high"},
-		{prioSuccess, prioDefault},
+		{prioSuccess, ntfyDefault},
 		{prioInfo, "low"},
-		{"", prioDefault},
+		{"", ntfyDefault},
-		{prioUnknown, prioDefault},
+		{prioUnknown, ntfyDefault},
-		{"critical", prioDefault},
+		{"critical", ntfyDefault},
 	}
 
 	for _, tc := range cases {
@@ -303,10 +301,10 @@ func TestSendNtfyHeaders(t *testing.T) {
 		)
 	}
 
-	if captured.priority != prioUrgent {
+	if captured.priority != ntfyUrgent {
 		t.Errorf(
 			"Priority header = %q, want %q",
-			captured.priority, prioUrgent,
+			captured.priority, ntfyUrgent,
 		)
 	}
 
@@ -325,9 +323,9 @@ func TestSendNtfyAllPriorities(t *testing.T) {
 		input string
 		want  string
 	}{
-		{prioError, prioUrgent},
+		{prioError, ntfyUrgent},
 		{prioWarning, "high"},
-		{prioSuccess, prioDefault},
+		{prioSuccess, ntfyDefault},
 		{prioInfo, "low"},
 	}
 
@@ -370,69 +368,56 @@ func TestSendNtfyAllPriorities(t *testing.T) {
 	}
 }
 
-// assertSendStatusError verifies that send returns an error
+func TestSendNtfyClientError(t *testing.T) {
-// wrapping wantErr when the server responds with status.
+	t.Parallel()
-func assertSendStatusError(
-	t *testing.T,
-	status int,
-	wantErr error,
-	send func(*notify.Service, *url.URL) error,
-) {
-	t.Helper()
 
 	srv := httptest.NewServer(
 		http.HandlerFunc(
 			func(w http.ResponseWriter, _ *http.Request) {
-				w.WriteHeader(status)
+				w.WriteHeader(http.StatusForbidden)
 			}),
 	)
 	defer srv.Close()
 
 	svc := notify.NewTestService(srv.Client().Transport)
-	target, _ := url.Parse(srv.URL)
+	topicURL, _ := url.Parse(srv.URL)
 
-	err := send(svc, target)
+	err := svc.SendNtfy(
+		context.Background(), topicURL, "t", "m", "info",
+	)
 	if err == nil {
-		t.Fatalf("expected error for %d response", status)
+		t.Fatal("expected error for 403 response")
 	}
 
-	if !errors.Is(err, wantErr) {
+	if !errors.Is(err, notify.ErrNtfyFailed) {
-		t.Errorf("error = %v, want %v", err, wantErr)
+		t.Errorf("error = %v, want ErrNtfyFailed", err)
 	}
 }
 
-func sendNtfyInfo(
-	svc *notify.Service, target *url.URL,
-) error {
-	return svc.SendNtfy(
-		context.Background(), target, "t", "m", prioInfo,
-	)
-}
-
-func sendSlackInfo(
-	svc *notify.Service, target *url.URL,
-) error {
-	return svc.SendSlack(
-		context.Background(), target, "t", "m", prioInfo,
-	)
-}
-
-func TestSendNtfyClientError(t *testing.T) {
-	t.Parallel()
-
-	assertSendStatusError(
-		t, http.StatusForbidden,
-		notify.ErrNtfyFailed, sendNtfyInfo,
-	)
-}
-
 func TestSendNtfyServerError(t *testing.T) {
 	t.Parallel()
 
-	assertSendStatusError(
+	srv := httptest.NewServer(
-		t, http.StatusInternalServerError,
+		http.HandlerFunc(
-		notify.ErrNtfyFailed, sendNtfyInfo,
+			func(w http.ResponseWriter, _ *http.Request) {
+				w.WriteHeader(http.StatusInternalServerError)
+			}),
 	)
+	defer srv.Close()
+
+	svc := notify.NewTestService(srv.Client().Transport)
+	topicURL, _ := url.Parse(srv.URL)
+
+	err := svc.SendNtfy(
+		context.Background(), topicURL, "t", "m", "info",
+	)
+	if err == nil {
+		t.Fatal("expected error for 500 response")
+	}
+
+	if !errors.Is(err, notify.ErrNtfyFailed) {
+		t.Errorf("error = %v, want ErrNtfyFailed", err)
+	}
 }
 
 func TestSendNtfySuccess(t *testing.T) {
@@ -633,19 +618,53 @@ func TestSendSlackAllColors(t *testing.T) {
 func TestSendSlackClientError(t *testing.T) {
 	t.Parallel()
 
-	assertSendStatusError(
+	srv := httptest.NewServer(
-		t, http.StatusBadRequest,
+		http.HandlerFunc(
-		notify.ErrSlackFailed, sendSlackInfo,
+			func(w http.ResponseWriter, _ *http.Request) {
+				w.WriteHeader(http.StatusBadRequest)
+			}),
 	)
+	defer srv.Close()
+
+	svc := notify.NewTestService(srv.Client().Transport)
+	webhookURL, _ := url.Parse(srv.URL)
+
+	err := svc.SendSlack(
+		context.Background(), webhookURL, "t", "m", "info",
+	)
+	if err == nil {
+		t.Fatal("expected error for 400 response")
+	}
+
+	if !errors.Is(err, notify.ErrSlackFailed) {
+		t.Errorf("error = %v, want ErrSlackFailed", err)
+	}
 }
 
 func TestSendSlackServerError(t *testing.T) {
 	t.Parallel()
 
-	assertSendStatusError(
+	srv := httptest.NewServer(
-		t, http.StatusBadGateway,
+		http.HandlerFunc(
-		notify.ErrSlackFailed, sendSlackInfo,
+			func(w http.ResponseWriter, _ *http.Request) {
+				w.WriteHeader(http.StatusBadGateway)
+			}),
 	)
+	defer srv.Close()
+
+	svc := notify.NewTestService(srv.Client().Transport)
+	webhookURL, _ := url.Parse(srv.URL)
+
+	err := svc.SendSlack(
+		context.Background(), webhookURL, "t", "m", "error",
+	)
+	if err == nil {
+		t.Fatal("expected error for 502 response")
+	}
+
+	if !errors.Is(err, notify.ErrSlackFailed) {
+		t.Errorf("error = %v, want ErrSlackFailed", err)
+	}
 }
 
 func TestSendSlackNetworkError(t *testing.T) {
@@ -970,62 +989,74 @@ func TestSendNotificationMattermostOnly(t *testing.T) {
 	}
 }
 
-// assertSendNotificationTolerates verifies SendNotification
+func TestSendNotificationNtfyError(t *testing.T) {
-// neither panics nor blocks when the endpoint configured by
+	t.Parallel()
-// setURL responds with status.
-func assertSendNotificationTolerates(
-	t *testing.T,
-	status int,
-	priority string,
-	setURL func(*notify.Service, *url.URL),
-) {
-	t.Helper()
 
 	srv := httptest.NewServer(
 		http.HandlerFunc(
 			func(w http.ResponseWriter, _ *http.Request) {
-				w.WriteHeader(status)
+				w.WriteHeader(http.StatusInternalServerError)
 			}),
 	)
 	defer srv.Close()
 
-	target, _ := url.Parse(srv.URL)
+	ntfyURL, _ := url.Parse(srv.URL)
 
 	svc := notify.NewTestService(http.DefaultTransport)
-	setURL(svc, target)
+	svc.SetNtfyURL(ntfyURL)
 
+	// Should not panic or block.
 	svc.SendNotification(
-		context.Background(), "t", "m", priority,
+		context.Background(), "t", "m", "error",
 	)
 
 	time.Sleep(100 * time.Millisecond)
 }
 
-func TestSendNotificationNtfyError(t *testing.T) {
-	t.Parallel()
-
-	assertSendNotificationTolerates(
-		t, http.StatusInternalServerError, prioError,
-		(*notify.Service).SetNtfyURL,
-	)
-}
-
 func TestSendNotificationSlackError(t *testing.T) {
 	t.Parallel()
 
-	assertSendNotificationTolerates(
+	srv := httptest.NewServer(
-		t, http.StatusForbidden, prioError,
+		http.HandlerFunc(
-		(*notify.Service).SetSlackWebhookURL,
+			func(w http.ResponseWriter, _ *http.Request) {
+				w.WriteHeader(http.StatusForbidden)
+			}),
 	)
+	defer srv.Close()
+
+	slackURL, _ := url.Parse(srv.URL)
+
+	svc := notify.NewTestService(http.DefaultTransport)
+	svc.SetSlackWebhookURL(slackURL)
+
+	svc.SendNotification(
+		context.Background(), "t", "m", "error",
+	)
+
+	time.Sleep(100 * time.Millisecond)
 }
 
 func TestSendNotificationMattermostError(t *testing.T) {
 	t.Parallel()
 
-	assertSendNotificationTolerates(
+	srv := httptest.NewServer(
-		t, http.StatusBadGateway, prioWarning,
+		http.HandlerFunc(
-		(*notify.Service).SetMattermostWebhookURL,
+			func(w http.ResponseWriter, _ *http.Request) {
+				w.WriteHeader(http.StatusBadGateway)
+			}),
 	)
+	defer srv.Close()
+
+	mmURL, _ := url.Parse(srv.URL)
+
+	svc := notify.NewTestService(http.DefaultTransport)
+	svc.SetMattermostWebhookURL(mmURL)
+
+	svc.SendNotification(
+		context.Background(), "t", "m", "warning",
+	)
+
+	time.Sleep(100 * time.Millisecond)
 }
 
 // ── SlackPayload JSON marshaling ──────────────────────────

internal/notify/retry.go

@@ -69,7 +69,7 @@ func (rc RetryConfig) backoff(attempt int) time.Duration {
 	lo := raw * (1 - jitterFraction)
 	hi := raw * (1 + jitterFraction)
 
-	jittered := lo + rand.Float64()*(hi-lo) //nolint:gosec // jitter needs no crypto/rand
+	jittered := lo + rand.Float64()*(hi-lo) //nolint:gosec // jitter does not need crypto/rand
 
 	return time.Duration(jittered)
 }

internal/server/export_test.go

@@ -1,19 +0,0 @@
-package server
-
-import (
-	"net/http"
-	"time"
-)
-
-// NewHTTPServer exports newHTTPServer for testing.
-func NewHTTPServer(
-	listenAddr string,
-	handler http.Handler,
-) *http.Server {
-	return newHTTPServer(listenAddr, handler)
-}
-
-// RequestTimeout exports the handler execution budget applied by
-// chimw.Timeout in SetupRoutes, so tests can assert the relationship
-// between it and the server's WriteTimeout.
-const RequestTimeout time.Duration = requestTimeout

internal/server/server.go

@@ -33,52 +33,8 @@ type Params struct {
 // shutdownTimeout is how long to wait for graceful shutdown.
 const shutdownTimeout = 30 * time.Second
 
-// Socket-level timeouts for the HTTP server.
+// readHeaderTimeout is the max duration for reading request headers.
-//
+const readHeaderTimeout = 10 * time.Second
-// These bound time spent on the connection itself and are a distinct
-// control from the per-request handler budget enforced by
-// chimw.Timeout(requestTimeout) in routes.go: that one cancels the
-// request context after requestTimeout but never touches the socket,
-// so without the values below a peer can hold a connection open
-// forever (slowloris, unreaped keep-alives).
-//
-// The one hard constraint between the two controls is
-// writeTimeout > requestTimeout. net/http arms the write deadline
-// once the request headers have been read, so on a plaintext
-// connection it covers handler execution AND the response flush. If
-// writeTimeout were <= requestTimeout the server would sever the
-// connection before a handler that legitimately consumed its full
-// budget could emit anything, making the 60s budget unreachable in
-// practice. The margin between them is the response-flush allowance.
-//
-// The only clients of this service are browsers loading the dashboard
-// and a Prometheus scraper; the values are sized for those.
-const (
-	// readHeaderTimeout is the max duration for reading request
-	// headers.
-	readHeaderTimeout = 10 * time.Second
-
-	// readTimeout bounds reading the entire request, headers plus
-	// body. Every route here is a GET with no body, so this only
-	// ever needs to cover headers; the extra 5s over
-	// readHeaderTimeout is slack, not a real allowance, and keeps a
-	// body dribbled one byte at a time from holding the read side
-	// open indefinitely.
-	readTimeout = 15 * time.Second
-
-	// writeTimeout must exceed the requestTimeout handler budget
-	// (60s) per the note above. The 15s difference is the allowance
-	// for flushing a completed response to a slow client.
-	writeTimeout = 75 * time.Second
-
-	// idleTimeout reaps keep-alive connections between requests. It
-	// is deliberately longer than the common Prometheus scrape
-	// intervals (15s/30s/60s) so the scraper reuses its connection
-	// rather than reconnecting every cycle, while a browser tab
-	// left open on the dashboard stops occupying a connection
-	// within two minutes of going quiet.
-	idleTimeout = 120 * time.Second
-)
 
 // Server is the HTTP server.
 type Server struct {
@@ -120,29 +76,16 @@ func New(
 	return srv, nil
 }
 
-// newHTTPServer builds the listening http.Server with every
-// socket-level timeout set. All four are set deliberately: a zero
-// value in net/http means "no limit", not "some default".
-func newHTTPServer(
-	listenAddr string,
-	handler http.Handler,
-) *http.Server {
-	return &http.Server{
-		Addr:              listenAddr,
-		Handler:           handler,
-		ReadTimeout:       readTimeout,
-		ReadHeaderTimeout: readHeaderTimeout,
-		WriteTimeout:      writeTimeout,
-		IdleTimeout:       idleTimeout,
-	}
-}
-
 // Run starts the HTTP server.
 func (s *Server) Run() {
 	s.SetupRoutes()
 
 	listenAddr := fmt.Sprintf(":%d", s.port)
-	s.httpServer = newHTTPServer(listenAddr, s)
+	s.httpServer = &http.Server{
+		Addr:              listenAddr,
+		Handler:           s,
+		ReadHeaderTimeout: readHeaderTimeout,
+	}
 
 	s.log.Info("http server starting", "addr", listenAddr)
 

internal/server/server_test.go

@@ -1,112 +0,0 @@
-package server_test
-
-import (
-	"net/http"
-	"testing"
-
-	"sneak.berlin/go/dnswatcher/internal/server"
-)
-
-// noopHandler stands in for the router; newHTTPServer only stores it.
-func noopHandler() http.Handler {
-	return http.HandlerFunc(
-		func(w http.ResponseWriter, _ *http.Request) {
-			w.WriteHeader(http.StatusOK)
-		},
-	)
-}
-
-// TestHTTPServerTimeoutsAreSet asserts that every socket-level
-// timeout is configured. A zero value in net/http means "no limit",
-// so a refactor that silently drops one of these reintroduces the
-// slowloris / unreaped-keep-alive exposure this guards against.
-//
-// The assertions are on the configured field values only; nothing
-// here measures elapsed time, so the test cannot flake on timing.
-func TestHTTPServerTimeoutsAreSet(t *testing.T) {
-	t.Parallel()
-
-	srv := server.NewHTTPServer(":8080", noopHandler())
-
-	if srv.ReadTimeout <= 0 {
-		t.Errorf(
-			"ReadTimeout must be non-zero, got %v",
-			srv.ReadTimeout,
-		)
-	}
-
-	if srv.ReadHeaderTimeout <= 0 {
-		t.Errorf(
-			"ReadHeaderTimeout must be non-zero, got %v",
-			srv.ReadHeaderTimeout,
-		)
-	}
-
-	if srv.WriteTimeout <= 0 {
-		t.Errorf(
-			"WriteTimeout must be non-zero, got %v",
-			srv.WriteTimeout,
-		)
-	}
-
-	if srv.IdleTimeout <= 0 {
-		t.Errorf(
-			"IdleTimeout must be non-zero, got %v",
-			srv.IdleTimeout,
-		)
-	}
-}
-
-// TestWriteTimeoutExceedsHandlerBudget pins the one relationship the
-// values must satisfy. net/http arms the write deadline once request
-// headers are read, so it covers handler execution plus the response
-// flush. If WriteTimeout were not greater than the chimw.Timeout
-// handler budget, the connection would be severed before a handler
-// that used its full budget could respond, making that budget
-// unreachable.
-func TestWriteTimeoutExceedsHandlerBudget(t *testing.T) {
-	t.Parallel()
-
-	srv := server.NewHTTPServer(":8080", noopHandler())
-
-	if srv.WriteTimeout <= server.RequestTimeout {
-		t.Errorf(
-			"WriteTimeout (%v) must exceed handler budget (%v)",
-			srv.WriteTimeout,
-			server.RequestTimeout,
-		)
-	}
-}
-
-// TestReadTimeoutCoversHeaderTimeout asserts the read deadline for
-// the whole request is at least as long as the header-only deadline;
-// a smaller ReadTimeout would make ReadHeaderTimeout unreachable.
-func TestReadTimeoutCoversHeaderTimeout(t *testing.T) {
-	t.Parallel()
-
-	srv := server.NewHTTPServer(":8080", noopHandler())
-
-	if srv.ReadTimeout < srv.ReadHeaderTimeout {
-		t.Errorf(
-			"ReadTimeout (%v) must be >= ReadHeaderTimeout (%v)",
-			srv.ReadTimeout,
-			srv.ReadHeaderTimeout,
-		)
-	}
-}
-
-// TestHTTPServerAddrAndHandler covers the rest of the constructor so
-// a future edit cannot drop the listen address or the handler.
-func TestHTTPServerAddrAndHandler(t *testing.T) {
-	t.Parallel()
-
-	srv := server.NewHTTPServer(":9999", noopHandler())
-
-	if srv.Addr != ":9999" {
-		t.Errorf("Addr = %q, want %q", srv.Addr, ":9999")
-	}
-
-	if srv.Handler == nil {
-		t.Error("Handler must not be nil")
-	}
-}

internal/state/state_test.go

@@ -223,8 +223,7 @@ func TestSaveLoadRoundTrip_Ports(t *testing.T) {
 	}
 }
 
-// TestSaveLoadRoundTrip_Certificates verifies certificate data
+// TestSaveLoadRoundTrip_Certificates verifies certificate data survives a save/load cycle.
-// survives a save/load cycle.
 func TestSaveLoadRoundTrip_Certificates(t *testing.T) {
 	t.Parallel()
 
@@ -1073,8 +1072,7 @@ func TestConcurrentGetSet(t *testing.T) {
 	wg.Wait()
 }
 
-// runConcurrentOps performs a series of get/set/delete
+// runConcurrentOps performs a series of get/set/delete operations for concurrency testing.
-// operations for concurrency testing.
 func runConcurrentOps(s *state.State, key string, now time.Time) {
 	const iterations = 50
 

internal/watcher/watcher.go

@@ -26,11 +26,8 @@ const tlsPort = 443
 // hoursPerDay converts days to hours for duration calculations.
 const hoursPerDay = 24
 
-// Status values recorded for nameserver and certificate checks.
+// statusError is the status value recorded for failed checks.
-const (
+const statusError = "error"
-	statusOK    = "ok"
-	statusError = "error"
-)
 
 // Params contains dependencies for Watcher.
 type Params struct {
@@ -350,7 +347,7 @@ func buildHostnameState(
 	for ns, recs := range records {
 		hs.RecordsByNameserver[ns] = &state.NameserverRecordState{
 			Records:     recs,
-			Status:      statusOK,
+			Status:      "ok",
 			LastChecked: now,
 		}
 	}
@@ -408,7 +405,7 @@ func (w *Watcher) detectNSDisappearances(
 	current map[string]map[string][]string,
 ) {
 	for ns, prevNS := range prev.RecordsByNameserver {
-		if _, ok := current[ns]; ok || prevNS.Status != statusOK {
+		if _, ok := current[ns]; ok || prevNS.Status != "ok" {
 			continue
 		}
 
@@ -711,7 +708,7 @@ func (w *Watcher) handleTLSError(
 	now time.Time,
 	err error,
 ) {
-	if hasPrev && !w.firstRun && prev.Status == statusOK {
+	if hasPrev && !w.firstRun && prev.Status == "ok" {
 		msg := fmt.Sprintf(
 			"Host: %s\nIP: %s\nError: %s",
 			hostname, ip, err,
@@ -754,7 +751,7 @@ func (w *Watcher) handleTLSSuccess(
 			Issuer:                  cert.Issuer,
 			NotAfter:                cert.NotAfter,
 			SubjectAlternativeNames: cert.SubjectAlternativeNames,
-			Status:                  statusOK,
+			Status:                  "ok",
 			LastChecked:             now,
 		},
 	)