script: force lint and test to run in cibuild and docker (closes #115 )

script/cibuild and script/docker were plain docker build. On an unchanged tree the lint stage and the builder stage, which runs make test, came from the layer cache, so the build passed without linting or querying live DNS. Both scripts now pass --no-cache-filter=lint,builder so those stages run on every build, as script/lint already does for its own lint stage. Dependency downloads inside those stages re-run each build. Each of the two stages in the Dockerfile now notes that the scripts name it. README and TODO.md updated to match. Model: opus-4-8 (implementation); opus-5-5 (rework)
2026-09-28 20:32:29 +00:00
18 changed files with 811 additions and 980 deletions
@@ -10,20 +10,14 @@ run:
 linters:
  default: all
  enable:
    # Successor to the deprecated gomodguard. Named explicitly, rather than
    # left to `default: all`, because it carries the module policy below.
    - gomodguard_v2
  disable:
    # Genuinely incompatible with project patterns
    - exhaustruct      # Requires all struct fields
    - depguard         # Dependency allow/block lists
    - godot            # Requires comments to end with periods
    - wsl              # Deprecated, replaced by wsl_v5
    - wrapcheck        # Too verbose for internal packages
    - varnamelen       # Short names like db, id are idiomatic Go
    # Deprecated: the warning is attached to the old name, so it is
    # silenced by disabling that name, not by enabling the successor.
    - wsl              # Deprecated, replaced by wsl_v5
    - gomodguard       # Deprecated, replaced by gomodguard_v2
  settings:
    lll:
      line-length: 88
@@ -34,68 +28,6 @@ linters:
      max-complexity: 15
    dupl:
      threshold: 100
    depguard:
      # Test-support code must not be compiled into the shipped binary. A
      # test-support package exists to hand a test privileges the program
      # itself must never have, so a file that is not a test must not import
      # one. Test files, and the files inside a package whose directory name
      # ends in `test`, are where that code belongs, and are exempt.
      #
      # The deny list below is the one part of this file a repository is
      # expected to extend, and the only part it may. depguard matches an
      # import path against a list of prefixes, so it cannot be told "any path
      # whose last segment ends in test"; a repository's own test-support
      # packages have to be named here one at a time, by full import path,
      # under a module path that differs from repository to repository. Add
      # them; change nothing else.
      rules:
        test-support:
          list-mode: lax
          files:
            - "$all"
            - "!$test"
            - "!**/*test/**"
          deny:
            - pkg: net/http/httptest
              desc: >-
                Test-support code belongs in test files and in packages whose
                directory name ends in test, not in the shipped binary.
            - pkg: sneak.berlin/go/dnswatcher/internal/livednstest
              desc: >-
                Live-DNS test support belongs in test files and in packages
                whose directory name ends in test, not in the shipped binary.
    # Only decisions already recorded in the Go package defaults are
    # listed here. Every entry matches the module path exactly.
    gomodguard_v2:
      blocked:
        - module: github.com/rs/zerolog
          recommendations:
            - log/slog
          reason: "Structured logging is stdlib log/slog."
        # One entry per pre-fork module path, because the later releases
        # are separate paths. A prefix match would be shorter but would
        # also reach github.com/go-redis/redismock, the test double for
        # the successor these entries recommend.
        - module: github.com/go-redis/redis
          recommendations:
            - github.com/redis/go-redis/v9
          reason: "Pre-fork module; use the maintained go-redis v9."
        - module: github.com/go-redis/redis/v7
          recommendations:
            - github.com/redis/go-redis/v9
          reason: "Pre-fork module; use the maintained go-redis v9."
        - module: github.com/go-redis/redis/v8
          recommendations:
            - github.com/redis/go-redis/v9
          reason: "Pre-fork module; use the maintained go-redis v9."
        - module: github.com/sergi/go-diff
          recommendations:
            - github.com/aymanbagabas/go-udiff
          reason: "No unified diff output; use go-udiff."
        - module: github.com/hexops/gotextdiff
          recommendations:
            - github.com/aymanbagabas/go-udiff
          reason: "Unmaintained fork; use go-udiff."
 issues:
  max-issues-per-linter: 0
@@ -61,10 +61,6 @@ rejected.
  record types: A, AAAA, CNAME, MX, TXT, SRV, CAA, NS.
 - Stores results **per nameserver**. The state for a hostname is not a
  merged view — it is a map from nameserver to record set.
 - DNS names inside record values (CNAME, MX, SRV and NS targets) are
  stored in lower case, because names are case-insensitive and
  nameservers may answer in any letter case. TXT and CAA values keep
  their letter case; they are not lower-cased.
 - Any observable change in any nameserver's response triggers a
  notification. This includes:
  - **Record change**: A nameserver returns different records than it
@@ -74,15 +70,8 @@ rejected.
    This is distinct from "responded with no records."
  - **NS recovery**: A previously-unreachable nameserver starts
    responding again.
-  - **Inconsistency detected**: Two nameservers return different record
+  - **Inconsistency detected**: Two nameservers that previously agreed
-    sets for the same hostname and did not already differ on the previous
+    now return different record sets for the same hostname.
    check. Every pair of nameservers is compared. The alert is sent once
    for each such pair, on the check where they start to disagree, and not
    again while they keep disagreeing, including after a restart. A
    nameserver that was not in the previous check (newly added, or back
    after dropping out) and answers differently is reported on the check
    where it appears. If a pair agrees again and later disagrees, the
    alert is sent again.
 ### TCP Port Monitoring
@@ -278,8 +267,6 @@ internal/
  tlscheck/tlscheck.go        TLS certificate inspector
  notify/notify.go             Notification service (Slack, Mattermost, ntfy)
  watcher/watcher.go           Main monitoring orchestrator and scheduler
  livednstest/livednstest.go   Retry and concurrency limit for tests
                               against live DNS (imported only by tests)
 ```
 ### Design Principles
@@ -2,12 +2,8 @@
 ## DNS Resolution Tests
-DNS is never mocked in this project, not in tests and not anywhere
+All resolver tests **MUST** use live queries against real DNS servers.
-else; see the README section "No DNS mocking. Ever." Every test that
+No mocking of the DNS client layer is permitted.
 looks something up in DNS **MUST** query live DNS servers, never a
 stand-in. Logic that works on record data, such as comparing or
 formatting records, may be tested on that data directly with no
 lookup.
 ### Rationale
@@ -25,18 +21,14 @@ real servers ensures the resolver works correctly in production.
 - Query timeout is calibrated to 3× maximum antipodal RTT (~300ms)
  plus processing margin
 - Root server fan-out is limited to reduce parallel query load
 - Live lookups that expect an answer go through `internal/livednstest`,
  which limits how many run at once in a test binary and retries a
  lookup that got none
 - Flaky failures from transient network issues are acceptable and
  should be investigated as potential resolver bugs, not papered over
  with mocks or skip flags
 ### What NOT to do
- **Do not mock, fake or stub DNS** anywhere: no stand-in `DNSClient`,
+- **Do not mock `DNSClient`** for resolver tests (the mock constructor
-  no stand-in for the watcher's `DNSResolver`, no fake DNS server, no
+  exists for unit-testing other packages that consume the resolver)
  canned responses
 - **Do not add `-short` flags** to skip slow tests
 - **Do not increase `-timeout`** to hide hanging queries
 - **Do not remove `-count=1` from `script/test`** — Go's test cache
@@ -10,7 +10,11 @@
 # Status
-pre-1.0. No git tags.
+pre-1.0. No git tags. Core resolver work in flight on feature/resolver
 (dirty: internal/resolver/resolver_test.go). Local checkout has diverged
 from origin: origin/main is 8 commits ahead (watcher orchestrator,
 unified TARGETS) and origin/feature/resolver already contains the full
 iterative resolver implementation with hermetic mocked tests.
 # Next Step
@@ -19,30 +23,6 @@ Rationale, Design, TODO, License, Author) if any are still missing.
 # Completed Steps
 - 2026-09-29: the live-DNS test package is renamed `internal/livednstest` and
  added to the `test-support` `deny` list in `.golangci.yml`, so `make lint`
  fails when program code imports it (closes #164).
 - 2026-09-29: `.golangci.yml` re-fetched unchanged from `sneak/prompts`. It
  replaces the deprecated `gomodguard` with `gomodguard_v2`, so `make lint` no
  longer warns about it, and turns on `depguard` with the org `test-support`
  rule, which rejects `net/http/httptest` except in test files and in files
  under a directory whose name ends in `test`. This repo had no `deny` entries
  of its own to carry forward (closes #123).
 - 2026-09-29: nothing stands in for DNS any more. Watcher tests that look
  something up in DNS use the real resolver against live DNS servers and test
  record and nameserver changes by preparing the saved state a check starts
  from; the resolver timeout test queries an address that never answers, and
  `NewFromLoggerWithClient`, used only by its stand-in client, is gone. The
  live-DNS retry and concurrency limit moved to `internal/livednstest`, which
  both test packages use. `TESTING.md` states the README's rule (closes #159).
 - 2026-09-28: the inconsistency alert is sent once, on the check where two
  nameservers start to disagree or where a nameserver that disagrees first
  appears, instead of on every check while they disagree, and not again after
  a restart. Every pair of nameservers is compared, not only neighbours in
  sorted order of name (closes #158).
 - 2026-09-28: DNS names in record values (CNAME, MX, SRV and NS targets) are
  lower-cased, so nameservers that answer in different letter case no longer
  count as inconsistent or as a record change (closes #157).
 - 2026-09-28: `script/cibuild` and `script/docker` now pass
  `--no-cache-filter=lint,builder` so lint and tests run every build (closes
  #115).
@@ -273,5 +253,6 @@ Infrastructure notes (from untracked TODO.md):
 - Module path sneak.berlin/go/dnswatcher differs from the git.eeqj.de
  remote intentionally; do not "fix" it
 - Dependencies: github.com/miekg/dns, golang.org/x/net/publicsuffix
- DNS is never mocked; tests that look something up in DNS query live DNS
+- Resolver tests originally used live DNS against *.dns.sneak.cloud
-  servers (README, "No DNS mocking. Ever.")
+  (required records documented in the test file header); origin now has
  mocked hermetic tests, keep them hermetic
@@ -1,121 +0,0 @@
 // Package livednstest runs the live DNS operations of tests. Tests that
 // look something up in DNS query live DNS servers, never a stand-in —
 // see TESTING.md. Nothing here mocks, fakes, stubs, records or replays
 // DNS, and nothing here skips a test: it only changes *how* the live
 // queries are issued, so that a single dropped UDP packet or one slow
 // authoritative server does not turn correct code into a red build.
 //
 // Two mechanisms:
 //
 //  1. Bounded concurrency. Tests run in parallel and the build hosts
 //     have many cores, so without a limit every test starts its own
 //     iterative resolution at the same instant and they all hit the
 //     first root server within a few milliseconds of each other. Root
 //     servers rate-limit that, which shows up as a different arbitrary
 //     subset of tests failing on each run. Run caps how many live
 //     operations are in flight at once in one test binary.
 //
 //  2. Retry with exponential backoff. Each live operation gets several
 //     attempts with its own timeout. An attempt is retried when it
 //     obtained nothing to check, never because of what the test
 //     asserts about the result, so a wrong result still fails on the
 //     first attempt. A fault in the code under test that leaves
 //     nothing to check looks the same as live DNS not answering, and
 //     fails only after the last attempt.
 package livednstest
 import (
 	"context"
 	"errors"
 	"testing"
 	"time"
 )
 const (
 	// attempts is how many times a live DNS operation is attempted
 	// before the test fails.
 	attempts = 3
 	// AttemptTimeout bounds one attempt. Worst case for an operation
 	// is attempts * AttemptTimeout plus the backoff — about 26
 	// seconds, well inside the 90-second `go test -timeout` backstop
 	// even when several operations exhaust their attempts.
 	AttemptTimeout = 8 * time.Second
 	// backoffBase is the delay after the first failed attempt; it is
 	// multiplied by backoffFactor each time.
 	backoffBase = 500 * time.Millisecond
 	// backoffFactor is the exponential backoff multiplier.
 	backoffFactor = 2
 	// Concurrency caps how many live operations may be in flight
 	// across one test binary at once.
 	Concurrency = 6
 )
 // gate bounds concurrent live operations. It has to be package scoped:
 // the whole point is that it is shared by every parallel test in the
 // test binary.
 //
 //nolint:gochecknoglobals // package-wide live query rate limit
 var gate = make(chan struct{}, Concurrency)
 // ErrNoAnswer reports that a live operation produced no usable answer,
 // which is retried rather than asserted on.
 var ErrNoAnswer = errors.New("no answer from live DNS")
 // Run executes one attempt of a live operation, holding a slot in gate
 // for its duration and bounding it with its own timeout.
 func Run(op func(ctx context.Context) error) error {
 	gate <- struct{}{}
 	defer func() { <-gate }()
 	ctx, cancel := context.WithTimeout(
 		context.Background(), AttemptTimeout,
 	)
 	defer cancel()
 	return op(ctx)
 }
 // Retry runs op until it reports success, retrying failures with
 // exponential backoff, and fails the test if every attempt fails. op
 // returns an error only for a failure to obtain an answer — never for
 // an answer the test disagrees with, which belongs in an assertion so
 // that it fails immediately. op stores whatever it obtained where its
 // caller can find it.
 func Retry(
 	t *testing.T,
 	what string,
 	op func(ctx context.Context) error,
 ) {
 	t.Helper()
 	var last error
 	backoff := backoffBase
 	for attempt := range attempts {
 		if attempt > 0 {
 			t.Logf(
 				"%s: attempt %d of %d failed (%v), "+
 					"retrying in %s",
 				what, attempt, attempts, last, backoff,
 			)
 			time.Sleep(backoff)
 			backoff *= backoffFactor
 		}
 		last = Run(op)
 		if last == nil {
 			return
 		}
 	}
 	t.Fatalf(
 		"%s: all %d live attempts failed: %v",
 		what, attempts, last,
 	)
 }
@@ -1,103 +0,0 @@
 package livednstest_test
 import (
 	"context"
 	"sync"
 	"testing"
 	"time"
 	"github.com/stretchr/testify/assert"
 	"sneak.berlin/go/dnswatcher/internal/livednstest"
 )
 // Tests for the retry and the concurrency limit themselves. They
 // perform no DNS resolution of any kind.
 func TestRetryRecoversFromTransientFailure(t *testing.T) {
 	t.Parallel()
 	const wantAttempts = 2
 	attempts := 0
 	livednstest.Retry(t, "transient", func(_ context.Context) error {
 		attempts++
 		if attempts < wantAttempts {
 			return livednstest.ErrNoAnswer
 		}
 		return nil
 	})
 	assert.Equal(t, wantAttempts, attempts)
 }
 func TestRetryGivesEachAttemptADeadline(t *testing.T) {
 	t.Parallel()
 	livednstest.Retry(t, "deadline", func(ctx context.Context) error {
 		deadline, ok := ctx.Deadline()
 		assert.True(t, ok, "attempt should carry a deadline")
 		remaining := time.Until(deadline)
 		assert.LessOrEqual(t, remaining, livednstest.AttemptTimeout)
 		// Lower bound too: without one this passes for a
 		// deadline far shorter than intended, which would
 		// silently turn every live attempt into an instant
 		// timeout.
 		assert.Greater(t, remaining, livednstest.AttemptTimeout/2)
 		return nil
 	})
 }
 func TestRunBoundsConcurrency(t *testing.T) {
 	t.Parallel()
 	const workers = 24
 	var (
 		mu       sync.Mutex
 		wg       sync.WaitGroup
 		inFlight int
 		maxSeen  int
 	)
 	wg.Add(workers)
 	for range workers {
 		go func() {
 			defer wg.Done()
 			_ = livednstest.Run(func(_ context.Context) error {
 				mu.Lock()
 				inFlight++
 				if inFlight > maxSeen {
 					maxSeen = inFlight
 				}
 				mu.Unlock()
 				time.Sleep(time.Millisecond)
 				mu.Lock()
 				inFlight--
 				mu.Unlock()
 				return nil
 			})
 		}()
 	}
 	wg.Wait()
 	assert.Positive(t, maxSeen)
 	assert.LessOrEqual(
 		t, maxSeen, livednstest.Concurrency,
 		"live queries must stay under the package-wide gate",
 	)
 }
@@ -7,8 +7,8 @@ import (
 	"github.com/miekg/dns"
 )
-// DNSClient sends one DNS message to a nameserver and returns the
+// DNSClient abstracts DNS wire-protocol exchanges so the resolver
-// reply. The resolver holds one for UDP and one for TCP.
+// can be tested without hitting real nameservers.
 type DNSClient interface {
 	ExchangeContext(
 		ctx context.Context,
@@ -1,8 +0,0 @@
 package resolver
 import "github.com/miekg/dns"
 // ExtractRecordValue exports extractRecordValue for testing.
 func ExtractRecordValue(rr dns.RR) string {
 	return extractRecordValue(rr)
 }
@@ -608,10 +608,7 @@ func classifyResponse(resp *NameserverResponse, state queryState) {
 	}
 }
-// extractRecordValue formats a DNS RR value as a string. DNS names
+// extractRecordValue formats a DNS RR value as a string.
 // are case-insensitive and nameservers may answer in any letter case,
 // so names are lower-cased to compare equal. TXT and CAA values keep
 // their letter case.
 func extractRecordValue(rr dns.RR) string {
 	switch r := rr.(type) {
 	case *dns.A:
@@ -619,22 +616,22 @@ func extractRecordValue(rr dns.RR) string {
 	case *dns.AAAA:
 		return r.AAAA.String()
 	case *dns.CNAME:
-		return strings.ToLower(r.Target)
+		return r.Target
 	case *dns.MX:
-		return fmt.Sprintf("%d %s", r.Preference, strings.ToLower(r.Mx))
+		return fmt.Sprintf("%d %s", r.Preference, r.Mx)
 	case *dns.TXT:
 		return strings.Join(r.Txt, "")
 	case *dns.SRV:
 		return fmt.Sprintf(
 			"%d %d %d %s",
-			r.Priority, r.Weight, r.Port, strings.ToLower(r.Target),
+			r.Priority, r.Weight, r.Port, r.Target,
 		)
 	case *dns.CAA:
 		return fmt.Sprintf(
 			"%d %s \"%s\"", r.Flag, r.Tag, r.Value,
 		)
 	case *dns.NS:
-		return strings.ToLower(r.Ns)
+		return r.Ns
 	default:
 		return ""
 	}
@@ -1,62 +0,0 @@
 package resolver_test
 import (
 	"testing"
 	"github.com/miekg/dns"
 	"github.com/stretchr/testify/assert"
 	"sneak.berlin/go/dnswatcher/internal/resolver"
 )
 func TestExtractRecordValue_LetterCase(t *testing.T) {
 	t.Parallel()
 	tests := []struct {
 		name string
 		rr   dns.RR
 		want string
 	}{
 		{
 			name: "MX target lower-cased",
 			rr:   &dns.MX{Preference: 1, Mx: "ASPMX.L.GOOGLE.COM."},
 			want: "1 aspmx.l.google.com.",
 		},
 		{
 			name: "NS target lower-cased",
 			rr:   &dns.NS{Ns: "x.ns.joker.COM."},
 			want: "x.ns.joker.com.",
 		},
 		{
 			name: "CNAME target lower-cased",
 			rr:   &dns.CNAME{Target: "WWW.Example.Com."},
 			want: "www.example.com.",
 		},
 		{
 			name: "SRV target lower-cased",
 			rr: &dns.SRV{
 				Priority: 10, Weight: 5, Port: 443,
 				Target: "SIP.Example.Com.",
 			},
 			want: "10 5 443 sip.example.com.",
 		},
 		{
 			name: "TXT value keeps its case",
 			rr:   &dns.TXT{Txt: []string{"Verify=AbC123"}},
 			want: "Verify=AbC123",
 		},
 		{
 			name: "CAA value keeps its case",
 			rr:   &dns.CAA{Flag: 0, Tag: "issue", Value: "LetsEncrypt.org"},
 			want: `0 issue "LetsEncrypt.org"`,
 		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 			assert.Equal(t, tt.want, resolver.ExtractRecordValue(tt.rr))
 		})
 	}
 }
@@ -1,7 +1,10 @@
 package resolver_test
 import (
 	"context"
 	"sync"
 	"testing"
 	"time"
 	"github.com/stretchr/testify/assert"
@@ -9,8 +12,9 @@ import (
 )
 // Tests for the live-DNS harness in livedns_test.go itself. These
-// exercise pure logic; they perform no DNS resolution of any kind, so
+// exercise pure logic and the retry/concurrency plumbing; they
-// they neither mock DNS nor depend on it.
+// perform no DNS resolution of any kind, so they neither mock DNS
 // nor depend on it.
 // Names for the synthetic status maps below. Nothing is ever queried
 // at them: they are map keys handed to the package's pure counting
@@ -86,6 +90,47 @@ func TestStatusCountingIgnoresSilentNameservers(t *testing.T) {
 	)
 }
 func TestRetryLiveRecoversFromTransientFailure(t *testing.T) {
 	t.Parallel()
 	const wantAttempts = 2
 	attempts := 0
 	retryLive(t, "transient", func(_ context.Context) error {
 		attempts++
 		if attempts < wantAttempts {
 			return errLiveNoAnswer
 		}
 		return nil
 	})
 	assert.Equal(t, wantAttempts, attempts)
 }
 func TestRetryLiveGivesEachAttemptADeadline(t *testing.T) {
 	t.Parallel()
 	retryLive(t, "deadline", func(ctx context.Context) error {
 		deadline, ok := ctx.Deadline()
 		assert.True(t, ok, "attempt should carry a deadline")
 		remaining := time.Until(deadline)
 		assert.LessOrEqual(t, remaining, liveAttemptTimeout)
 		// Lower bound too: without one this passes for a
 		// deadline far shorter than intended, which would
 		// silently turn every live attempt into an instant
 		// timeout.
 		assert.Greater(t, remaining, liveAttemptTimeout/2)
 		return nil
 	})
 }
 // TestUnsanctionedStatusesRejectsWrongAnswers is the regression test
 // for the defect this allowlist exists to prevent: a minority of
 // nameservers answering WRONGLY while quorum keeps the suite green.
@@ -190,3 +235,50 @@ func TestUnsanctionedStatusesToleratesSilenceOnly(t *testing.T) {
 		unsanctionedStatuses(results, allowed...),
 	)
 }
 func TestRunLiveBoundsConcurrency(t *testing.T) {
 	t.Parallel()
 	const workers = 24
 	var (
 		mu       sync.Mutex
 		wg       sync.WaitGroup
 		inFlight int
 		maxSeen  int
 	)
 	wg.Add(workers)
 	for range workers {
 		go func() {
 			defer wg.Done()
 			_ = runLive(func(_ context.Context) error {
 				mu.Lock()
 				inFlight++
 				if inFlight > maxSeen {
 					maxSeen = inFlight
 				}
 				mu.Unlock()
 				time.Sleep(time.Millisecond)
 				mu.Lock()
 				inFlight--
 				mu.Unlock()
 				return nil
 			})
 		}()
 	}
 	wg.Wait()
 	assert.Positive(t, maxSeen)
 	assert.LessOrEqual(
 		t, maxSeen, liveConcurrency,
 		"live queries must stay under the package-wide gate",
 	)
 }
@@ -8,8 +8,8 @@ import (
 	"sort"
 	"strings"
 	"testing"
 	"time"
 	"sneak.berlin/go/dnswatcher/internal/livednstest"
 	"sneak.berlin/go/dnswatcher/internal/resolver"
 )
@@ -17,34 +17,144 @@ import (
 // Live DNS test support
 // ----------------------------------------------------------------
 //
-// Tests that look something up in DNS query live DNS servers, never a
+// Every test in this package resolves against the real, live DNS —
-// stand-in; logic that works on record data may be tested on that
+// see TESTING.md. Nothing here mocks, fakes, stubs, records or
-// data with no lookup (see TESTING.md). Each live operation below goes
+// replays DNS, and nothing here skips or gates a test: the helpers
-// through livednstest.Retry, which bounds how many resolutions are in
+// below only change *how* the live queries are issued, so that a
-// flight at once and retries an operation that got no answer (see
+// single dropped UDP packet or one slow authoritative server does
-// package livednstest).
+// not turn a correct resolver into a red build.
 //
-// Where an assertion spans several independent nameservers, a quorum
+// Three mechanisms, all test-side:
 // is enough: a strict majority answering as expected. A server that
 // fails to answer is tolerated, while a server that answers *wrongly*
 // still fails the test.
 //
-// That tolerance is expressed as an ALLOWLIST of sanctioned statuses,
+//  1. Bounded concurrency. The package's tests are parallel and the
-// never as a blocklist of known-bad ones. A blocklist bans the one
+//     build hosts have many cores, so without a limit every test
-// wrong answer its author thought of and silently admits every other
+//     starts its own iterative resolution at the same instant and
-// status, including any added to the resolver later; an allowlist
+//     they all hit the first root server in rootServerList() within
-// fails on anything nobody explicitly sanctioned. Silence (timeout,
+//     a few milliseconds of each other. Root servers rate-limit
-// error) is the only thing quorum exists to tolerate. A *wrong
+//     that, which shows up as a different arbitrary subset of tests
-// answer* — nxdomain for a name that exists, ok for one that does
+//     failing on each run. liveGate caps how many resolutions are
-// not, nodata for either — is never tolerated at any count.
+//     in flight at once.
 //
 //  2. Retry with exponential backoff. Each live operation gets
 //     several attempts with its own timeout. The retry predicate is
 //     strictly transport-level — "did a nameserver answer at all" —
 //     never the assertion the test is making. A resolver that
 //     answers incorrectly still fails on the first attempt.
 //
 //  3. Quorum. Where an assertion spans several independent
 //     nameservers, a strict majority answering as expected is
 //     enough; a server that fails to answer is tolerated, while a
 //     server that answers *wrongly* still fails the test.
 //
 // The tolerance in (3) is expressed as an ALLOWLIST of sanctioned
 // statuses, never as a blocklist of known-bad ones. A blocklist bans
 // the one wrong answer its author thought of and silently admits
 // every other status, including any added to the resolver later; an
 // allowlist fails on anything nobody explicitly sanctioned. Silence
 // (timeout, error) is the only thing quorum exists to tolerate. A
 // *wrong answer* — nxdomain for a name that exists, ok for one that
 // does not, nodata for either — is never tolerated at any count.
-// minNameservers is the smallest nameserver count a well-run zone is
+const (
-// expected to publish.
+	// liveAttempts is how many times a live DNS operation is
-const minNameservers = 2
+	// attempted before the test fails.
 	liveAttempts = 3
-// errLiveNoQuorum reports that too few of a domain's nameservers
+	// liveAttemptTimeout bounds one attempt. Worst case for an
-// answered for a quorum assertion to be made.
+	// operation is liveAttempts * liveAttemptTimeout plus the
-var errLiveNoQuorum = errors.New("no nameserver quorum")
+	// backoff — about 26 seconds, well inside the 90-second
 	// `go test -timeout` backstop even when several operations
 	// exhaust their attempts.
 	liveAttemptTimeout = 8 * time.Second
 	// liveBackoffBase is the delay after the first failed
 	// attempt; it is multiplied by liveBackoffFactor each time.
 	liveBackoffBase = 500 * time.Millisecond
 	// liveBackoffFactor is the exponential backoff multiplier.
 	liveBackoffFactor = 2
 	// liveConcurrency caps how many live resolutions may be in
 	// flight across the whole package at once.
 	liveConcurrency = 6
 	// minNameservers is the smallest nameserver count a
 	// well-run zone is expected to publish.
 	minNameservers = 2
 )
 // liveGate bounds concurrent live resolutions package-wide. It has
 // to be package scoped: the whole point is that it is shared by
 // every parallel test in the package.
 //
 //nolint:gochecknoglobals // package-wide live query rate limit
 var liveGate = make(chan struct{}, liveConcurrency)
 var (
 	// errLiveNoAnswer reports that a live operation produced no
 	// usable answer, which is retried rather than asserted on.
 	errLiveNoAnswer = errors.New("no answer from live DNS")
 	// errLiveNoQuorum reports that too few of a domain's
 	// nameservers answered for a quorum assertion to be made.
 	errLiveNoQuorum = errors.New("no nameserver quorum")
 )
 // runLive executes one attempt of a live operation, holding a slot
 // in liveGate for its duration and bounding it with its own
 // timeout.
 func runLive(op func(ctx context.Context) error) error {
 	liveGate <- struct{}{}
 	defer func() { <-liveGate }()
 	ctx, cancel := context.WithTimeout(
 		context.Background(), liveAttemptTimeout,
 	)
 	defer cancel()
 	return op(ctx)
 }
 // retryLive runs op until it reports success, retrying transport
 // failures with exponential backoff, and fails the test if every
 // attempt fails. op returns an error only for a failure to obtain
 // an answer — never for an answer the test disagrees with, which
 // belongs in an assertion so that it fails immediately. op stores
 // whatever it obtained where its caller can find it.
 func retryLive(
 	t *testing.T,
 	what string,
 	op func(ctx context.Context) error,
 ) {
 	t.Helper()
 	var last error
 	backoff := liveBackoffBase
 	for attempt := range liveAttempts {
 		if attempt > 0 {
 			t.Logf(
 				"%s: attempt %d of %d failed (%v), "+
 					"retrying in %s",
 				what, attempt, liveAttempts, last, backoff,
 			)
 			time.Sleep(backoff)
 			backoff *= liveBackoffFactor
 		}
 		last = runLive(op)
 		if last == nil {
 			return
 		}
 	}
 	t.Fatalf(
 		"%s: no answer after %d live attempts: %v",
 		what, liveAttempts, last,
 	)
 }
 // liveQuorum is how many of total nameservers must agree for a
 // multi-nameserver assertion to hold: a strict majority.
@@ -162,7 +272,7 @@ func liveFindAuthoritative(
 	var out []string
-	livednstest.Retry(
+	retryLive(
 		t,
 		"FindAuthoritativeNameservers("+domain+")",
 		func(ctx context.Context) error {
@@ -174,7 +284,7 @@ func liveFindAuthoritative(
 			if len(ns) == 0 {
 				return fmt.Errorf(
 					"%w: %s has no nameservers",
-					livednstest.ErrNoAnswer, domain,
+					errLiveNoAnswer, domain,
 				)
 			}
@@ -198,7 +308,7 @@ func liveLookupNS(
 	var out []string
-	livednstest.Retry(
+	retryLive(
 		t,
 		"LookupNS("+domain+")",
 		func(ctx context.Context) error {
@@ -210,7 +320,7 @@ func liveLookupNS(
 			if len(ns) == 0 {
 				return fmt.Errorf(
 					"%w: %s has no nameservers",
-					livednstest.ErrNoAnswer, domain,
+					errLiveNoAnswer, domain,
 				)
 			}
@@ -240,7 +350,7 @@ func liveQueryNameserver(
 	var out *resolver.NameserverResponse
-	livednstest.Retry(
+	retryLive(
 		t,
 		what,
 		func(ctx context.Context) error {
@@ -255,7 +365,7 @@ func liveQueryNameserver(
 				resp.Status == resolver.StatusError {
 				return fmt.Errorf(
 					"%w: %s returned %s: %s",
-					livednstest.ErrNoAnswer, nameserver,
+					errLiveNoAnswer, nameserver,
 					resp.Status, resp.Error,
 				)
 			}
@@ -282,7 +392,7 @@ func liveQueryAllNameservers(
 	var out map[string]*resolver.NameserverResponse
-	livednstest.Retry(
+	retryLive(
 		t,
 		"QueryAllNameservers("+hostname+")",
 		func(ctx context.Context) error {
@@ -294,7 +404,7 @@ func liveQueryAllNameservers(
 			if len(results) == 0 {
 				return fmt.Errorf(
 					"%w: no nameservers queried for %s",
-					livednstest.ErrNoAnswer, hostname,
+					errLiveNoAnswer, hostname,
 				)
 			}
@@ -327,7 +437,7 @@ func liveResolveIPs(
 	var out []string
-	livednstest.Retry(
+	retryLive(
 		t,
 		"ResolveIPAddresses("+hostname+")",
 		func(ctx context.Context) error {
@@ -339,7 +449,7 @@ func liveResolveIPs(
 			if len(ips) == 0 {
 				return fmt.Errorf(
 					"%w: no addresses for %s",
-					livednstest.ErrNoAnswer, hostname,
+					errLiveNoAnswer, hostname,
 				)
 			}
@@ -366,7 +476,7 @@ func liveResolveIPsAllowingEmpty(
 	var out []string
-	livednstest.Retry(
+	retryLive(
 		t,
 		"ResolveIPAddresses("+hostname+")",
 		func(ctx context.Context) error {
@@ -67,4 +67,17 @@ func NewFromLogger(log *slog.Logger) *Resolver {
 	}
 }
 // NewFromLoggerWithClient creates a Resolver with a custom DNS
 // client, useful for testing with mock DNS responses.
 func NewFromLoggerWithClient(
 	log *slog.Logger,
 	client DNSClient,
 ) *Resolver {
 	return &Resolver{
 		log:    log,
 		client: client,
 		tcp:    client,
 	}
 }
 // Method implementations are in iterative.go.
@@ -10,6 +10,7 @@ import (
 	"testing"
 	"time"
 	"github.com/miekg/dns"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -32,8 +33,8 @@ func newTestResolver(t *testing.T) *resolver.Resolver {
 }
 // findOneNSForDomain picks one authoritative nameserver to aim a
-// test at. Quorum handling lives in livedns_test.go, and the live-DNS
+// test at. Live-DNS retry, concurrency and quorum handling live in
-// retry and concurrency limit in package livednstest.
+// livedns_test.go.
 func findOneNSForDomain(
 	t *testing.T,
 	r *resolver.Resolver,
@@ -525,18 +526,21 @@ func TestQueryAllNameservers_ContextCanceled(t *testing.T) {
 func TestQueryNameserverIP_Timeout(t *testing.T) {
 	t.Parallel()
-	r := newTestResolver(t)
+	log := slog.New(slog.NewTextHandler(
 		os.Stderr,
 		&slog.HandlerOptions{Level: slog.LevelDebug},
 	))
 	r := resolver.NewFromLoggerWithClient(
 		log, &timeoutClient{},
 	)
 	// Nothing answers at 192.0.2.1, a documentation address. The
 	// resolver tries each query twice, and the first try gives up
 	// after two seconds. A deadline that ends during the first try
 	// makes the status vary from run to run between nodata and
 	// timeout, so the deadline must outlast the first try.
 	ctx, cancel := context.WithTimeout(
-		context.Background(), 3*time.Second,
+		context.Background(), 10*time.Second,
 	)
 	t.Cleanup(cancel)
 	// Query any IP — the client always returns a timeout error.
 	resp, err := r.QueryNameserverIP(
 		ctx, "unreachable.test.", "192.0.2.1",
 		"example.com",
@@ -547,6 +551,27 @@ func TestQueryNameserverIP_Timeout(t *testing.T) {
 	assert.NotEmpty(t, resp.Error)
 }
 // timeoutClient simulates DNS timeout errors for testing.
 type timeoutClient struct{}
 func (c *timeoutClient) ExchangeContext(
 	_ context.Context,
 	_ *dns.Msg,
 	_ string,
 ) (*dns.Msg, time.Duration, error) {
 	return nil, 0, &net.OpError{
 		Op:  "read",
 		Net: "udp",
 		Err: &timeoutError{},
 	}
 }
 type timeoutError struct{}
 func (e *timeoutError) Error() string   { return "i/o timeout" }
 func (e *timeoutError) Timeout() bool   { return true }
 func (e *timeoutError) Temporary() bool { return true }
 func TestResolveIPAddresses_ContextCanceled(t *testing.T) {
 	t.Parallel()
@@ -1,25 +0,0 @@
 package watcher
 import (
 	"context"
 	"sneak.berlin/go/dnswatcher/internal/state"
 )
 // NewlyDisagreeingPairs exports newlyDisagreeingPairs for testing.
 func NewlyDisagreeingPairs(
 	prev *state.HostnameState,
 	current map[string]map[string][]string,
 ) [][2]string {
 	return newlyDisagreeingPairs(prev, current)
 }
 // DetectHostnameChanges exports detectHostnameChanges for testing.
 func (w *Watcher) DetectHostnameChanges(
 	ctx context.Context,
 	hostname string,
 	prev *state.HostnameState,
 	current map[string]map[string][]string,
 ) {
 	w.detectHostnameChanges(ctx, hostname, prev, current)
 }
@@ -1,182 +0,0 @@
 package watcher_test
 import (
 	"slices"
 	"testing"
 	"sneak.berlin/go/dnswatcher/internal/state"
 	"sneak.berlin/go/dnswatcher/internal/watcher"
 )
 const (
 	host = "www.example.net"
 	nsA  = "a.ns.example.net."
 	nsB  = "b.ns.example.net."
 	nsC  = "c.ns.example.net."
 	ip1  = "192.0.2.1"
 	ip2  = "192.0.2.2"
 	ip3  = "192.0.2.3"
 )
 // hostnameState builds the state a check with these records leaves behind.
 func hostnameState(
 	records map[string]map[string][]string,
 ) *state.HostnameState {
 	hs := &state.HostnameState{
 		RecordsByNameserver: make(map[string]*state.NameserverRecordState),
 	}
 	for ns, recs := range records {
 		hs.RecordsByNameserver[ns] = &state.NameserverRecordState{
 			Records: recs,
 			Status:  "ok",
 		}
 	}
 	return hs
 }
 func TestNewlyDisagreeingPairs(t *testing.T) {
 	t.Parallel()
 	onlyA := map[string]map[string][]string{nsA: {"A": {ip1}}}
 	agree := map[string]map[string][]string{nsA: {"A": {ip1}}, nsB: {"A": {ip1}}}
 	disagree := map[string]map[string][]string{nsA: {"A": {ip1}}, nsB: {"A": {ip2}}}
 	alert := [][2]string{{nsA, nsB}}
 	// b already disagrees with a and c; then c changes, so a and c,
 	// which agreed, now differ.
 	bDiffers := map[string]map[string][]string{
 		nsA: {"A": {ip1}}, nsB: {"A": {ip2}}, nsC: {"A": {ip1}},
 	}
 	cChanges := map[string]map[string][]string{
 		nsA: {"A": {ip1}}, nsB: {"A": {ip2}}, nsC: {"A": {ip3}},
 	}
 	// Each case starts from the state loaded at startup and runs the
 	// checks in order; want[i] is what check i alerts for.
 	tests := []struct {
 		name   string
 		loaded map[string]map[string][]string
 		checks []map[string]map[string][]string
 		want   [][][2]string
 	}{
 		{
 			name:   "disagreement persisting across checks alerts once",
 			loaded: agree,
 			checks: []map[string]map[string][]string{disagree, disagree, disagree},
 			want:   [][][2]string{alert, nil, nil},
 		},
 		{
 			name:   "disagreement starting on a later check alerts on it",
 			loaded: agree,
 			checks: []map[string]map[string][]string{agree, agree, disagree},
 			want:   [][][2]string{nil, nil, alert},
 		},
 		{
 			name:   "disagreement in the loaded state does not alert",
 			loaded: disagree,
 			checks: []map[string]map[string][]string{disagree, disagree},
 			want:   [][][2]string{nil, nil},
 		},
 		{
 			name:   "nameserver new on the first check and disagreeing alerts once",
 			loaded: onlyA,
 			checks: []map[string]map[string][]string{disagree, disagree},
 			want:   [][][2]string{alert, nil},
 		},
 		{
 			name:   "disagreement after agreeing again alerts again",
 			loaded: agree,
 			checks: []map[string]map[string][]string{disagree, agree, disagree},
 			want:   [][][2]string{alert, nil, alert},
 		},
 		{
 			name:   "new disagreement while another nameserver differs alerts",
 			loaded: bDiffers,
 			checks: []map[string]map[string][]string{cChanges, cChanges},
 			want:   [][][2]string{{{nsA, nsC}}, nil},
 		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 			prev := hostnameState(tt.loaded)
 			for i, current := range tt.checks {
 				got := watcher.NewlyDisagreeingPairs(prev, current)
 				if !slices.Equal(got, tt.want[i]) {
 					t.Errorf(
 						"check %d: alerted for %v, want %v",
 						i, got, tt.want[i],
 					)
 				}
 				prev = hostnameState(current)
 			}
 		})
 	}
 }
 func TestInconsistencyAlert(t *testing.T) {
 	t.Parallel()
 	onlyA := map[string]map[string][]string{nsA: {"A": {ip1}}}
 	agree := map[string]map[string][]string{nsA: {"A": {ip1}}, nsB: {"A": {ip1}}}
 	disagree := map[string]map[string][]string{nsA: {"A": {ip1}}, nsB: {"A": {ip2}}}
 	// Each case starts from the state loaded at startup and then sees
 	// the nameservers disagree on three checks in a row.
 	tests := []struct {
 		name   string
 		loaded map[string]map[string][]string
 		want   int
 	}{
 		{
 			name:   "disagreement lasting several checks alerts once",
 			loaded: agree,
 			want:   1,
 		},
 		{
 			name:   "disagreement in the loaded state does not alert",
 			loaded: disagree,
 			want:   0,
 		},
 		{
 			name:   "nameserver new on the first check and disagreeing alerts once",
 			loaded: onlyA,
 			want:   1,
 		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 			// The hostname change detection uses only the notifier.
 			notifier := &mockNotifier{}
 			w := watcher.NewForTest(nil, nil, nil, nil, nil, notifier)
 			prev := hostnameState(tt.loaded)
 			for range 3 {
 				w.DetectHostnameChanges(t.Context(), host, prev, disagree)
 				prev = hostnameState(disagree)
 			}
 			got := 0
 			for _, n := range notifier.getNotifications() {
 				if n.Title == "Inconsistency: "+host {
 					got++
 				}
 			}
 			if got != tt.want {
 				t.Errorf("sent %d inconsistency alerts, want %d", got, tt.want)
 			}
 		})
 	}
 }
@@ -366,7 +366,7 @@ func (w *Watcher) detectHostnameChanges(
 ) {
 	w.detectRecordChanges(ctx, hostname, prev, current)
 	w.detectNSDisappearances(ctx, hostname, prev, current)
-	w.detectInconsistencies(ctx, hostname, prev, current)
+	w.detectInconsistencies(ctx, hostname, current)
 }
 func (w *Watcher) detectRecordChanges(
@@ -448,11 +448,22 @@ func (w *Watcher) detectNSDisappearances(
 func (w *Watcher) detectInconsistencies(
 	ctx context.Context,
 	hostname string,
 	prev *state.HostnameState,
 	current map[string]map[string][]string,
 ) {
-	for _, pair := range newlyDisagreeingPairs(prev, current) {
+	nameservers := make([]string, 0, len(current))
-		ns1, ns2 := pair[0], pair[1]
+	for ns := range current {
 		nameservers = append(nameservers, ns)
 	}
 	sort.Strings(nameservers)
 	for i := range len(nameservers) - 1 {
 		ns1 := nameservers[i]
 		ns2 := nameservers[i+1]
 		if recordsEqual(current[ns1], current[ns2]) {
 			continue
 		}
 		msg := fmt.Sprintf(
 			"Hostname: %s\n%s: %v\n%s: %v",
@@ -470,43 +481,6 @@ func (w *Watcher) detectInconsistencies(
 	}
 }
 // newlyDisagreeingPairs returns every pair of nameservers whose records
 // differ in current, in sorted order of name, except pairs where both
 // nameservers were in prev and already differed there. A nameserver
 // missing from prev is paired with every nameserver it differs from.
 func newlyDisagreeingPairs(
 	prev *state.HostnameState,
 	current map[string]map[string][]string,
 ) [][2]string {
 	nameservers := make([]string, 0, len(current))
 	for ns := range current {
 		nameservers = append(nameservers, ns)
 	}
 	sort.Strings(nameservers)
 	var pairs [][2]string
 	for i, ns1 := range nameservers {
 		for _, ns2 := range nameservers[i+1:] {
 			if recordsEqual(current[ns1], current[ns2]) {
 				continue
 			}
 			prev1, ok1 := prev.RecordsByNameserver[ns1]
 			prev2, ok2 := prev.RecordsByNameserver[ns2]
 			if ok1 && ok2 && !recordsEqual(prev1.Records, prev2.Records) {
 				continue
 			}
 			pairs = append(pairs, [2]string{ns1, ns2})
 		}
 	}
 	return pairs
 }
 func (w *Watcher) checkAllPorts(ctx context.Context) {
 	// Phase 1: Build current IP:port → hostname associations
 	// from fresh DNS data.
@@ -2,77 +2,151 @@ package watcher_test
 import (
 	"context"
 	"errors"
 	"fmt"
 	"log/slog"
 	"slices"
 	"sync"
 	"testing"
 	"time"
 	"sneak.berlin/go/dnswatcher/internal/config"
 	"sneak.berlin/go/dnswatcher/internal/livednstest"
 	"sneak.berlin/go/dnswatcher/internal/portcheck"
 	"sneak.berlin/go/dnswatcher/internal/resolver"
 	"sneak.berlin/go/dnswatcher/internal/state"
 	"sneak.berlin/go/dnswatcher/internal/tlscheck"
 	"sneak.berlin/go/dnswatcher/internal/watcher"
 )
-// The watcher looks these names up in live DNS with the real resolver,
+// errNotFound is returned when mock data is missing.
-// so tests assert on what the watcher does with the answers, never on
+var errNotFound = errors.New("not found")
-// the records these zones publish. testHost's nameservers and addresses
+
-// stay the same from one check to the next, which the tests that check
+// Fixture values shared across tests.
 // it twice rely on.
 const (
-	testDomain = "google.com"
+	testDomain = "example.com"
-	testHost   = "cloudflare.com"
+	testHost   = "www.example.com"
 	testNS1    = "ns1.example.com."
 	testNS2    = "ns2.example.com."
 	testIPv4   = "93.184.216.34"
 	testIP     = "1.2.3.4"
 	testIssuer = "DigiCert"
 )
-// Saved-state values that live DNS never returns: nameserver names
+// --- Mock implementations ---
-// under .invalid and a documentation address.
+
-const (
+type mockResolver struct {
-	oldNS1 = "ns1.example.invalid."
+	mu             sync.Mutex
-	oldNS2 = "ns2.example.invalid."
+	nsRecords      map[string][]string
-	oldIP  = "192.0.2.1"
+	allRecords     map[string]map[string]map[string][]string
 	ipAddresses    map[string][]string
 	lookupNSErr    error
 	allRecordsErr  error
 	resolveIPErr   error
 	lookupNSCalls  int
 	allRecordCalls int
 }
 func (m *mockResolver) LookupNS(
 	_ context.Context,
 	domain string,
 ) ([]string, error) {
 	m.mu.Lock()
 	defer m.mu.Unlock()
 	m.lookupNSCalls++
 	if m.lookupNSErr != nil {
 		return nil, m.lookupNSErr
 	}
 	ns, ok := m.nsRecords[domain]
 	if !ok {
 		return nil, fmt.Errorf(
 			"%w: NS for %s", errNotFound, domain,
 		)
 	}
-// --- Stand-ins for the port checker, TLS checker and notifier ---
+	return ns, nil
-//
+}
-// DNS has none: the watchers built here use the real resolver (see
+
-// TESTING.md).
+func (m *mockResolver) LookupAllRecords(
 	_ context.Context,
 	hostname string,
 ) (map[string]map[string][]string, error) {
 	m.mu.Lock()
 	defer m.mu.Unlock()
 	m.allRecordCalls++
 	if m.allRecordsErr != nil {
 		return nil, m.allRecordsErr
 	}
 	recs, ok := m.allRecords[hostname]
 	if !ok {
 		return nil, fmt.Errorf(
 			"%w: records for %s", errNotFound, hostname,
 		)
 	}
 	return recs, nil
 }
 func (m *mockResolver) ResolveIPAddresses(
 	_ context.Context,
 	hostname string,
 ) ([]string, error) {
 	m.mu.Lock()
 	defer m.mu.Unlock()
 	if m.resolveIPErr != nil {
 		return nil, m.resolveIPErr
 	}
 	ips, ok := m.ipAddresses[hostname]
 	if !ok {
 		return nil, fmt.Errorf(
 			"%w: IPs for %s", errNotFound, hostname,
 		)
 	}
 	return ips, nil
 }
 // mockPortChecker reports every port open until closed is set.
 type mockPortChecker struct {
 	mu      sync.Mutex
-	closed bool
+	results map[string]bool
 	err     error
 	calls   int
 }
 func (m *mockPortChecker) CheckPort(
 	_ context.Context,
-	_ string,
+	address string,
-	_ int,
+	port int,
 ) (*portcheck.PortResult, error) {
 	m.mu.Lock()
 	defer m.mu.Unlock()
 	m.calls++
-	return &portcheck.PortResult{Open: !m.closed}, nil
+	if m.err != nil {
 		return nil, m.err
 	}
 	key := fmt.Sprintf("%s:%d", address, port)
 	open := m.results[key]
 	return &portcheck.PortResult{Open: open}, nil
 }
 // mockTLSChecker returns a certificate for the requested hostname that
 // expires at notAfter.
 type mockTLSChecker struct {
 	mu    sync.Mutex
-	notAfter time.Time
+	certs map[string]*tlscheck.CertificateInfo
 	err   error
 	calls int
 }
 func (m *mockTLSChecker) CheckCertificate(
 	_ context.Context,
-	_ string,
+	ip string,
 	hostname string,
 ) (*tlscheck.CertificateInfo, error) {
 	m.mu.Lock()
@@ -80,12 +154,20 @@ func (m *mockTLSChecker) CheckCertificate(
 	m.calls++
-	return &tlscheck.CertificateInfo{
+	if m.err != nil {
-		CommonName:              hostname,
+		return nil, m.err
-		Issuer:                  testIssuer,
+	}
-		NotAfter:                m.notAfter,
+
-		SubjectAlternativeNames: []string{hostname},
+	key := fmt.Sprintf("%s:%s", ip, hostname)
-	}, nil
+	cert, ok := m.certs[key]
 	if !ok {
 		return nil, fmt.Errorf(
 			"%w: cert for %s", errNotFound, key,
 		)
 	}
 	return cert, nil
 }
 type notification struct {
@@ -123,9 +205,10 @@ func (m *mockNotifier) getNotifications() []notification {
 	return result
 }
-// --- Helpers to build a Watcher and run its checks against live DNS ---
+// --- Helper to build a Watcher for testing ---
 type testDeps struct {
 	resolver    *mockResolver
 	portChecker *mockPortChecker
 	tlsChecker  *mockTLSChecker
 	notifier    *mockNotifier
@@ -140,9 +223,16 @@ func newTestWatcher(
 	t.Helper()
 	deps := &testDeps{
-		portChecker: &mockPortChecker{},
+		resolver: &mockResolver{
 			nsRecords:   make(map[string][]string),
 			allRecords:  make(map[string]map[string]map[string][]string),
 			ipAddresses: make(map[string][]string),
 		},
 		portChecker: &mockPortChecker{
 			results: make(map[string]bool),
 		},
 		tlsChecker: &mockTLSChecker{
-			notAfter: time.Now().Add(90 * 24 * time.Hour),
+			certs: make(map[string]*tlscheck.CertificateInfo),
 		},
 		notifier: &mockNotifier{},
 		config:   cfg,
@@ -153,7 +243,7 @@ func newTestWatcher(
 	w := watcher.NewForTest(
 		deps.config,
 		deps.state,
-		resolver.NewFromLogger(slog.Default()),
+		deps.resolver,
 		deps.portChecker,
 		deps.tlsChecker,
 		deps.notifier,
@@ -173,122 +263,6 @@ func defaultTestConfig(t *testing.T) *config.Config {
 	}
 }
 // checkOnce runs the watcher's checks once and returns an error when a
 // configured name has no hostname state saved by this check, or that
 // state holds no address. Either live DNS gave no answer for the name,
 // or the watcher saved no fresh result for it.
 func checkOnce(
 	ctx context.Context,
 	w *watcher.Watcher,
 	deps *testDeps,
 ) error {
 	started := time.Now()
 	w.RunOnce(ctx)
 	names := slices.Concat(deps.config.Domains, deps.config.Hostnames)
 	for _, name := range names {
 		hs, ok := deps.state.GetHostnameState(name)
 		if !ok || hs.LastChecked.Before(started) ||
 			len(addresses(hs)) == 0 {
 			return fmt.Errorf(
 				"%s: %w, or the watcher saved no fresh "+
 					"result for it",
 				name, livednstest.ErrNoAnswer,
 			)
 		}
 	}
 	return nil
 }
 // runChecks builds a watcher, lets prepare set up the saved state and
 // stand-ins it starts from, and runs its checks once against live DNS.
 // If change is not nil, change then alters the saved state or stand-ins
 // and the checks run a second time. When either check finds no fresh
 // address for a name (see checkOnce), the watcher is thrown away and
 // all of this runs again on a new one, so a failed attempt leaves
 // nothing behind in the saved state, the stand-ins or the notifications.
 func runChecks(
 	t *testing.T,
 	cfg *config.Config,
 	prepare, change func(deps *testDeps),
 ) *testDeps {
 	t.Helper()
 	var deps *testDeps
 	livednstest.Retry(t, "watcher checks", func(ctx context.Context) error {
 		var w *watcher.Watcher
 		w, deps = newTestWatcher(t, cfg)
 		if prepare != nil {
 			prepare(deps)
 		}
 		err := checkOnce(ctx, w, deps)
 		if err != nil || change == nil {
 			return err
 		}
 		change(deps)
 		return checkOnce(ctx, w, deps)
 	})
 	return deps
 }
 // addresses returns the A and AAAA values saved for a hostname.
 func addresses(hs *state.HostnameState) []string {
 	var ips []string
 	for _, nsState := range hs.RecordsByNameserver {
 		ips = append(ips, nsState.Records["A"]...)
 		ips = append(ips, nsState.Records["AAAA"]...)
 	}
 	return ips
 }
 // assertNotified checks that a notification with this title and
 // priority was sent.
 func assertNotified(
 	t *testing.T,
 	deps *testDeps,
 	title, priority string,
 ) {
 	t.Helper()
 	notifications := deps.notifier.getNotifications()
 	for _, n := range notifications {
 		if n.Title == title && n.Priority == priority {
 			return
 		}
 	}
 	t.Errorf(
 		"expected %s notification %q, got: %v",
 		priority, title, notifications,
 	)
 }
 // countNotifications counts the notifications sent with this title.
 func countNotifications(deps *testDeps, title string) int {
 	count := 0
 	for _, n := range deps.notifier.getNotifications() {
 		if n.Title == title {
 			count++
 		}
 	}
 	return count
 }
 func TestFirstRunBaseline(t *testing.T) {
 	t.Parallel()
@@ -296,12 +270,51 @@ func TestFirstRunBaseline(t *testing.T) {
 	cfg.Domains = []string{testDomain}
 	cfg.Hostnames = []string{testHost}
-	deps := runChecks(t, cfg, nil, nil)
+	w, deps := newTestWatcher(t, cfg)
 	setupBaselineMocks(deps)
 	w.RunOnce(t.Context())
 	assertNoNotifications(t, deps)
 	assertStatePopulated(t, deps)
 }
 func setupBaselineMocks(deps *testDeps) {
 	deps.resolver.nsRecords[testDomain] = []string{
 		testNS1,
 		testNS2,
 	}
 	deps.resolver.allRecords[testDomain] = map[string]map[string][]string{
 		testNS1: {"A": {testIPv4}},
 		testNS2: {"A": {testIPv4}},
 	}
 	deps.resolver.allRecords[testHost] = map[string]map[string][]string{
 		testNS1: {"A": {testIPv4}},
 		testNS2: {"A": {testIPv4}},
 	}
 	deps.resolver.ipAddresses[testHost] = []string{
 		testIPv4,
 	}
 	deps.portChecker.results["93.184.216.34:80"] = true
 	deps.portChecker.results["93.184.216.34:443"] = true
 	deps.tlsChecker.certs["93.184.216.34:www.example.com"] = &tlscheck.CertificateInfo{
 		CommonName: testHost,
 		Issuer:     testIssuer,
 		NotAfter:   time.Now().Add(90 * 24 * time.Hour),
 		SubjectAlternativeNames: []string{
 			testHost,
 		},
 	}
 	deps.tlsChecker.certs["93.184.216.34:example.com"] = &tlscheck.CertificateInfo{
 		CommonName: testDomain,
 		Issuer:     testIssuer,
 		NotAfter:   time.Now().Add(90 * 24 * time.Hour),
 		SubjectAlternativeNames: []string{
 			testDomain,
 		},
 	}
 }
 func assertNoNotifications(
 	t *testing.T,
 	deps *testDeps,
@@ -348,7 +361,26 @@ func TestDomainPortAndTLSChecks(t *testing.T) {
 	cfg := defaultTestConfig(t)
 	cfg.Domains = []string{testDomain}
-	deps := runChecks(t, cfg, nil, nil)
+	w, deps := newTestWatcher(t, cfg)
 	deps.resolver.nsRecords[testDomain] = []string{
 		testNS1,
 	}
 	deps.resolver.allRecords[testDomain] = map[string]map[string][]string{
 		testNS1: {"A": {testIPv4}},
 	}
 	deps.portChecker.results["93.184.216.34:80"] = true
 	deps.portChecker.results["93.184.216.34:443"] = true
 	deps.tlsChecker.certs["93.184.216.34:example.com"] = &tlscheck.CertificateInfo{
 		CommonName: testDomain,
 		Issuer:     testIssuer,
 		NotAfter:   time.Now().Add(90 * 24 * time.Hour),
 		SubjectAlternativeNames: []string{
 			testDomain,
 		},
 	}
 	w.RunOnce(t.Context())
 	snap := deps.state.GetSnapshot()
@@ -387,18 +419,50 @@ func TestNSChangeDetection(t *testing.T) {
 	cfg := defaultTestConfig(t)
 	cfg.Domains = []string{testDomain}
-	// The saved state lists nameservers that live DNS does not.
+	w, deps := newTestWatcher(t, cfg)
 	deps := runChecks(t, cfg, func(deps *testDeps) {
 		deps.state.SetDomainState(testDomain, &state.DomainState{
 			Nameservers: []string{oldNS1, oldNS2},
 		})
 	}, nil)
-	assertNotified(t, deps, "NS Change: "+testDomain, "warning")
+	deps.resolver.nsRecords[testDomain] = []string{
 		testNS1,
 		testNS2,
 	}
 	deps.resolver.allRecords[testDomain] = map[string]map[string][]string{
 		testNS1: {"A": {testIP}},
 		testNS2: {"A": {testIP}},
 	}
 	deps.portChecker.results["1.2.3.4:80"] = false
 	deps.portChecker.results["1.2.3.4:443"] = false
-	ds, _ := deps.state.GetDomainState(testDomain)
+	ctx := t.Context()
-	if slices.Contains(ds.Nameservers, oldNS1) {
+	w.RunOnce(ctx)
-		t.Errorf("saved nameservers not updated: %v", ds.Nameservers)
+
 	deps.resolver.mu.Lock()
 	deps.resolver.nsRecords[testDomain] = []string{
 		testNS1,
 		"ns3.example.com.",
 	}
 	deps.resolver.allRecords[testDomain] = map[string]map[string][]string{
 		testNS1:            {"A": {testIP}},
 		"ns3.example.com.": {"A": {testIP}},
 	}
 	deps.resolver.mu.Unlock()
 	w.RunOnce(ctx)
 	notifications := deps.notifier.getNotifications()
 	if len(notifications) == 0 {
 		t.Error("expected notification for NS change")
 	}
 	found := false
 	for _, n := range notifications {
 		if n.Priority == "warning" {
 			found = true
 		}
 	}
 	if !found {
 		t.Error("expected warning-priority NS change notification")
 	}
 }
@@ -408,18 +472,40 @@ func TestRecordChangeDetection(t *testing.T) {
 	cfg := defaultTestConfig(t)
 	cfg.Hostnames = []string{testHost}
-	// Between the checks, save for every nameserver an address live DNS
+	w, deps := newTestWatcher(t, cfg)
-	// never returns.
+
-	deps := runChecks(t, cfg, nil, func(deps *testDeps) {
+	deps.resolver.allRecords[testHost] = map[string]map[string][]string{
-		hs, _ := deps.state.GetHostnameState(testHost)
+		testNS1: {"A": {testIPv4}},
 		for _, nsState := range hs.RecordsByNameserver {
 			nsState.Records = map[string][]string{"A": {oldIP}}
 	}
 	deps.resolver.ipAddresses[testHost] = []string{
 		testIPv4,
 	}
 	deps.portChecker.results["93.184.216.34:80"] = false
 	deps.portChecker.results["93.184.216.34:443"] = false
-		deps.state.SetHostnameState(testHost, hs)
+	ctx := t.Context()
-	})
+	w.RunOnce(ctx)
-	assertNotified(t, deps, "Record Change: "+testHost, "warning")
+	deps.resolver.mu.Lock()
 	deps.resolver.allRecords[testHost] = map[string]map[string][]string{
 		testNS1: {"A": {"93.184.216.35"}},
 	}
 	deps.resolver.ipAddresses[testHost] = []string{
 		"93.184.216.35",
 	}
 	deps.resolver.mu.Unlock()
 	deps.portChecker.mu.Lock()
 	deps.portChecker.results["93.184.216.35:80"] = false
 	deps.portChecker.results["93.184.216.35:443"] = false
 	deps.portChecker.mu.Unlock()
 	w.RunOnce(ctx)
 	notifications := deps.notifier.getNotifications()
 	if len(notifications) == 0 {
 		t.Error("expected notification for record change")
 	}
 }
 func TestPortStateChange(t *testing.T) {
@@ -428,23 +514,38 @@ func TestPortStateChange(t *testing.T) {
 	cfg := defaultTestConfig(t)
 	cfg.Hostnames = []string{testHost}
-	// Between the checks, every port closes.
+	w, deps := newTestWatcher(t, cfg)
 	deps := runChecks(t, cfg, nil, func(deps *testDeps) {
 		deps.portChecker.mu.Lock()
 		deps.portChecker.closed = true
 		deps.portChecker.mu.Unlock()
 	})
-	hs, _ := deps.state.GetHostnameState(testHost)
+	deps.resolver.allRecords[testHost] = map[string]map[string][]string{
-	assertNotified(
+		testNS1: {"A": {testIP}},
-		t, deps, "Port Change: "+addresses(hs)[0]+":443", "warning",
+	}
-	)
+	deps.resolver.ipAddresses[testHost] = []string{
 		testIP,
 	}
 	deps.portChecker.results["1.2.3.4:80"] = true
 	deps.portChecker.results["1.2.3.4:443"] = true
 	deps.tlsChecker.certs["1.2.3.4:www.example.com"] = &tlscheck.CertificateInfo{
 		CommonName: testHost,
 		Issuer:     testIssuer,
 		NotAfter:   time.Now().Add(90 * 24 * time.Hour),
 		SubjectAlternativeNames: []string{
 			testHost,
 		},
 	}
-// expiresInThreeDays makes the TLS checker return certificates that
+	ctx := t.Context()
-// expire within the seven-day warning period.
+	w.RunOnce(ctx)
-func expiresInThreeDays(deps *testDeps) {
+
-	deps.tlsChecker.notAfter = time.Now().Add(3 * 24 * time.Hour)
+	deps.portChecker.mu.Lock()
 	deps.portChecker.results["1.2.3.4:443"] = false
 	deps.portChecker.mu.Unlock()
 	w.RunOnce(ctx)
 	notifications := deps.notifier.getNotifications()
 	if len(notifications) == 0 {
 		t.Error("expected notification for port state change")
 	}
 }
 func TestTLSExpiryWarning(t *testing.T) {
@@ -453,9 +554,49 @@ func TestTLSExpiryWarning(t *testing.T) {
 	cfg := defaultTestConfig(t)
 	cfg.Hostnames = []string{testHost}
-	deps := runChecks(t, cfg, expiresInThreeDays, nil)
+	w, deps := newTestWatcher(t, cfg)
-	assertNotified(t, deps, "TLS Expiry Warning: "+testHost, "warning")
+	deps.resolver.allRecords[testHost] = map[string]map[string][]string{
 		testNS1: {"A": {testIP}},
 	}
 	deps.resolver.ipAddresses[testHost] = []string{
 		testIP,
 	}
 	deps.portChecker.results["1.2.3.4:80"] = true
 	deps.portChecker.results["1.2.3.4:443"] = true
 	deps.tlsChecker.certs["1.2.3.4:www.example.com"] = &tlscheck.CertificateInfo{
 		CommonName: testHost,
 		Issuer:     testIssuer,
 		NotAfter:   time.Now().Add(3 * 24 * time.Hour),
 		SubjectAlternativeNames: []string{
 			testHost,
 		},
 	}
 	ctx := t.Context()
 	// First run = baseline
 	w.RunOnce(ctx)
 	// Second run should warn about expiry
 	w.RunOnce(ctx)
 	notifications := deps.notifier.getNotifications()
 	found := false
 	for _, n := range notifications {
 		if n.Priority == "warning" {
 			found = true
 		}
 	}
 	if !found {
 		t.Errorf(
 			"expected expiry warning, got: %v",
 			notifications,
 		)
 	}
 }
 func TestTLSExpiryWarningDedup(t *testing.T) {
@@ -465,25 +606,50 @@ func TestTLSExpiryWarningDedup(t *testing.T) {
 	cfg.Hostnames = []string{testHost}
 	cfg.TLSInterval = 24 * time.Hour
-	title := "TLS Expiry Warning: " + testHost
+	w, deps := newTestWatcher(t, cfg)
-	// The second check comes within the TLS interval of the first,
+	deps.resolver.allRecords[testHost] = map[string]map[string][]string{
-	// so it must not warn again.
+		testNS1: {"A": {testIP}},
-	var warnings int
+	}
-
+	deps.resolver.ipAddresses[testHost] = []string{
-	deps := runChecks(t, cfg, expiresInThreeDays, func(deps *testDeps) {
+		testIP,
-		warnings = countNotifications(deps, title)
+	}
-	})
+	deps.portChecker.results["1.2.3.4:80"] = true
-
+	deps.portChecker.results["1.2.3.4:443"] = true
-	if warnings == 0 {
+	deps.tlsChecker.certs["1.2.3.4:www.example.com"] = &tlscheck.CertificateInfo{
-		t.Fatal("expected expiry warnings from the first check")
+		CommonName: testHost,
 		Issuer:     testIssuer,
 		NotAfter:   time.Now().Add(3 * 24 * time.Hour),
 		SubjectAlternativeNames: []string{
 			testHost,
 		},
 	}
-	got := countNotifications(deps, title)
+	ctx := t.Context()
-	if got != warnings {
+
 	// First run = baseline, no notifications
 	w.RunOnce(ctx)
 	// Second run should fire one expiry warning
 	w.RunOnce(ctx)
 	// Third run should NOT fire another warning (dedup)
 	w.RunOnce(ctx)
 	notifications := deps.notifier.getNotifications()
 	expiryCount := 0
 	for _, n := range notifications {
 		if n.Title == "TLS Expiry Warning: www.example.com" {
 			expiryCount++
 		}
 	}
 	if expiryCount != 1 {
 		t.Errorf(
-			"expected %d expiry warnings (dedup), got %d",
+			"expected exactly 1 expiry warning (dedup), got %d",
-			warnings, got,
+			expiryCount,
 		)
 	}
 }
@@ -491,12 +657,21 @@ func TestTLSExpiryWarningDedup(t *testing.T) {
 func TestGracefulShutdown(t *testing.T) {
 	t.Parallel()
 	// No domains or hostnames: stopping does not involve DNS.
 	cfg := defaultTestConfig(t)
 	cfg.Domains = []string{testDomain}
 	cfg.DNSInterval = 100 * time.Millisecond
 	cfg.TLSInterval = 100 * time.Millisecond
-	w, _ := newTestWatcher(t, cfg)
+	w, deps := newTestWatcher(t, cfg)
 	deps.resolver.nsRecords[testDomain] = []string{
 		testNS1,
 	}
 	deps.resolver.allRecords[testDomain] = map[string]map[string][]string{
 		testNS1: {"A": {testIP}},
 	}
 	deps.portChecker.results["1.2.3.4:80"] = false
 	deps.portChecker.results["1.2.3.4:443"] = false
 	ctx, cancel := context.WithCancel(t.Context())
@@ -518,52 +693,90 @@ func TestGracefulShutdown(t *testing.T) {
 	}
 }
 func setupHostnameIP(
 	deps *testDeps,
 	hostname, ip string,
 ) {
 	deps.resolver.allRecords[hostname] = map[string]map[string][]string{
 		testNS1: {"A": {ip}},
 	}
 	deps.portChecker.results[ip+":80"] = true
 	deps.portChecker.results[ip+":443"] = true
 	deps.tlsChecker.certs[ip+":"+hostname] = &tlscheck.CertificateInfo{
 		CommonName:              hostname,
 		Issuer:                  testIssuer,
 		NotAfter:                time.Now().Add(90 * 24 * time.Hour),
 		SubjectAlternativeNames: []string{hostname},
 	}
 }
 func updateHostnameIP(deps *testDeps, hostname, ip string) {
 	deps.resolver.mu.Lock()
 	deps.resolver.allRecords[hostname] = map[string]map[string][]string{
 		testNS1: {"A": {ip}},
 	}
 	deps.resolver.mu.Unlock()
 	deps.portChecker.mu.Lock()
 	deps.portChecker.results[ip+":80"] = true
 	deps.portChecker.results[ip+":443"] = true
 	deps.portChecker.mu.Unlock()
 	deps.tlsChecker.mu.Lock()
 	deps.tlsChecker.certs[ip+":"+hostname] = &tlscheck.CertificateInfo{
 		CommonName:              hostname,
 		Issuer:                  testIssuer,
 		NotAfter:                time.Now().Add(90 * 24 * time.Hour),
 		SubjectAlternativeNames: []string{hostname},
 	}
 	deps.tlsChecker.mu.Unlock()
 }
 func TestDNSRunsBeforePortAndTLSChecks(t *testing.T) {
 	t.Parallel()
 	cfg := defaultTestConfig(t)
 	cfg.Hostnames = []string{testHost}
-	// The saved state says the last check found testHost at oldIP.
+	w, deps := newTestWatcher(t, cfg)
-	deps := runChecks(t, cfg, func(deps *testDeps) {
+
-		deps.state.SetHostnameState(testHost, &state.HostnameState{
+	setupHostnameIP(deps, testHost, "10.0.0.1")
-			RecordsByNameserver: map[string]*state.NameserverRecordState{
+
-				oldNS1: {
+	ctx := t.Context()
-					Records: map[string][]string{"A": {oldIP}},
+	w.RunOnce(ctx)
 					Status:  "ok",
 				},
 			},
 		})
 	}, nil)
 	snap := deps.state.GetSnapshot()
-
+	if _, ok := snap.Ports["10.0.0.1:80"]; !ok {
-	if _, ok := snap.Ports[oldIP+":80"]; ok {
+		t.Fatal("expected port state for 10.0.0.1:80")
 		t.Error("port check used stale DNS: found " + oldIP + ":80")
 	}
-	// Port and TLS checks must use the addresses this check found.
+	// DNS changes to a new IP; port and TLS must pick it up.
-	for _, ip := range addresses(snap.Hostnames[testHost]) {
+	updateHostnameIP(deps, testHost, "10.0.0.2")
-		if _, ok := snap.Ports[ip+":80"]; !ok {
+
-			t.Error("port check used stale DNS: missing " + ip + ":80")
+	w.RunOnce(ctx)
 	snap = deps.state.GetSnapshot()
 	if _, ok := snap.Ports["10.0.0.2:80"]; !ok {
 		t.Error("port check used stale DNS: missing 10.0.0.2:80")
 	}
-		certKey := ip + ":443:" + testHost
+	certKey := "10.0.0.2:443:www.example.com"
 	if _, ok := snap.Certificates[certKey]; !ok {
 		t.Error("TLS check used stale DNS: missing " + certKey)
 	}
 }
 }
 func TestSendTestNotification_Enabled(t *testing.T) {
 	t.Parallel()
 	// No domains or hostnames: the startup notification does not
 	// involve DNS.
 	cfg := defaultTestConfig(t)
 	cfg.Domains = []string{testDomain}
 	cfg.Hostnames = []string{testHost}
 	cfg.SendTestNotification = true
 	w, deps := newTestWatcher(t, cfg)
 	setupBaselineMocks(deps)
 	w.RunOnce(t.Context())
@@ -584,11 +797,14 @@ func TestSendTestNotification_ViaRun(t *testing.T) {
 	t.Parallel()
 	cfg := defaultTestConfig(t)
 	cfg.Domains = []string{testDomain}
 	cfg.Hostnames = []string{testHost}
 	cfg.SendTestNotification = true
 	cfg.DNSInterval = 24 * time.Hour
 	cfg.TLSInterval = 24 * time.Hour
 	w, deps := newTestWatcher(t, cfg)
 	setupBaselineMocks(deps)
 	ctx, cancel := context.WithCancel(t.Context())
@@ -628,11 +844,14 @@ func TestSendTestNotification_Disabled(t *testing.T) {
 	t.Parallel()
 	cfg := defaultTestConfig(t)
 	cfg.Domains = []string{testDomain}
 	cfg.Hostnames = []string{testHost}
 	cfg.SendTestNotification = false
 	cfg.DNSInterval = 24 * time.Hour
 	cfg.TLSInterval = 24 * time.Hour
 	w, deps := newTestWatcher(t, cfg)
 	setupBaselineMocks(deps)
 	ctx, cancel := context.WithCancel(t.Context())
@@ -665,22 +884,32 @@ func TestNSFailureAndRecovery(t *testing.T) {
 	cfg := defaultTestConfig(t)
 	cfg.Hostnames = []string{testHost}
-	// Between the checks, save every nameserver the first check found
+	w, deps := newTestWatcher(t, cfg)
 	// as failed, and add, as answering, one that live DNS does not list.
 	deps := runChecks(t, cfg, nil, func(deps *testDeps) {
 		hs, _ := deps.state.GetHostnameState(testHost)
 		for _, nsState := range hs.RecordsByNameserver {
 			nsState.Status = "error"
 		}
-		hs.RecordsByNameserver[oldNS1] = &state.NameserverRecordState{
+	deps.resolver.allRecords[testHost] = map[string]map[string][]string{
-			Records: map[string][]string{"A": {oldIP}},
+		testNS1: {"A": {testIP}},
-			Status:  "ok",
+		testNS2: {"A": {testIP}},
 	}
 	deps.resolver.ipAddresses[testHost] = []string{
 		testIP,
 	}
 	deps.portChecker.results["1.2.3.4:80"] = false
 	deps.portChecker.results["1.2.3.4:443"] = false
 	ctx := t.Context()
 	w.RunOnce(ctx)
 	deps.resolver.mu.Lock()
 	deps.resolver.allRecords[testHost] = map[string]map[string][]string{
 		testNS1: {"A": {testIP}},
 	}
 	deps.resolver.mu.Unlock()
 	w.RunOnce(ctx)
 	notifications := deps.notifier.getNotifications()
 	if len(notifications) == 0 {
 		t.Error("expected notification for NS disappearance")
 	}
 		deps.state.SetHostnameState(testHost, hs)
 	})
 	assertNotified(t, deps, "NS Failure: "+testHost, "error")
 	assertNotified(t, deps, "NS Recovery: "+testHost, "success")
 }