notify: fix flaky drain timing assertions, drop false abandon warn (closes #106 )

The drain tests measured elapsed time from an instant captured after the clock they compared it against had already started, so the lower bounds were structurally unreachable and passed only when the gap between the two statements rounded to zero. TestDrainBoundedByContext- Deadline failed the Docker gate outright (49.9ms against its own 50ms deadline) and roughly 1 run in 12 locally. - TestDrainBoundedByContextDeadline: capture start before context.WithTimeout, so the measured interval is a superset of the deadline interval and only an early return can fail the lower bound. The upper bound moves to a watchdog around the drain, which turns an unbounded drain into a prompt failure instead of a package-timeout hang. - TestDrainWaitsForInFlightDelivery: same ordering fix, ahead of the timer that releases the held delivery. - TestDrainWithoutDeliveriesReturnsImmediately: its 50ms ceiling was under the observed cost of the goroutine hop through inFlight.Wait() on a loaded box (57ms), and failed once in 20 runs. It now bounds the idle drain at 500ms, still well under the 2s deadline a stalled drain would hit. - drain: an OnStop context already expired on entry with nothing outstanding logged a WARN about abandoning deliveries with abandoned=0 and closed the abandon channel for no reason. The timeout branch now reports at debug level when the outstanding count is zero, and warns only when deliveries genuinely are abandoned. TestDrainWithCancelledContextDoesNotWarn covers it. Verified: script/cibuild passes; 25 consecutive cache-bypassed make test runs under -race, all clean; make check green at 5.2s. Both corrected assertions were confirmed non-vacuous by temporarily breaking drain and watching them fail.
notify: drain in-flight deliveries at shutdown (closes #106 )
2026-08-09 05:21:57 +00:00 · 2026-08-09 05:03:23 +00:00
19 changed files with 1023 additions and 1190 deletions
--- a/26
+++ b/26
@@ -1,27 +1,13 @@
-# Lint stage - fast feedback on lint issues, before the build starts.
-# The linter is invoked directly rather than through `make lint`: that
-# target shells out to `docker build -f Dockerfile.lint`, and there is
-# no docker daemon inside a docker build.
-# golangci/golangci-lint:v2.12.2 (Debian-based), 2026-08-10
-FROM golangci/golangci-lint:v2.12.2@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240 AS lint
-
-WORKDIR /src
-COPY go.mod go.sum ./
-RUN go mod download
-
-COPY . .
-
-RUN make fmt-check
-RUN golangci-lint run --config .golangci.yml ./...
-
 # Build stage
 # golang 1.25-alpine, 2026-02-28
 FROM golang@sha256:f6751d823c26342f9506c03797d2527668d095b0a15f1862cddb4d927a7a4ced AS builder

 RUN apk add --no-cache git make gcc musl-dev binutils-gold

-# Force BuildKit to run the lint stage before proceeding
-COPY --from=lint /src/go.sum /dev/null
+# golangci-lint v2.12.2, 2026-08-07
+RUN go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@c0d3ddc9cf3faa61a4e378e879ece580256d76e5
+# goimports v0.42.0
+RUN go install golang.org/x/tools/cmd/goimports@009367f5c17a8d4c45a961a3a509277190a9a6f0

 WORKDIR /src
 COPY go.mod go.sum ./
@@ -29,8 +15,8 @@ RUN go mod download

 COPY . .

-# Run the tests - build fails if any test fails
-RUN make test
+# Run all checks - build fails if any check fails
+RUN make check

 # Build the binary
 RUN make build
--- a/Dockerfile.lint
+++ b/Dockerfile.lint
@@ -1,29 +0,0 @@
-# Lint-only image: used by script/lint. golangci-lint is never run on
-# the host — the repo is COPYed into the build context and the linter
-# runs as a build step, so a successful build IS a clean lint. This
-# also works where the docker daemon is remote and bind mounts are
-# impossible.
-#
-# `golangci-lint config verify` is deliberately NOT run here: it
-# fetches its JSON schema over a live, unpinned HTTPS call, which would
-# make linting network-dependent and defeat hash-pinning. The cost of
-# that: unknown top-level keys in .golangci.yml are silently ignored,
-# so a mistyped or wrong-schema key lints clean while applying nothing.
-#
-# golangci/golangci-lint:v2.12.2 (Debian-based), 2026-08-10
-FROM golangci/golangci-lint:v2.12.2@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240 AS deps
-
-WORKDIR /src
-
-# Dependencies first, so this stage stays cached across lint runs.
-COPY go.mod go.sum ./
-RUN go mod download
-
-# Everything below is invalidated on every run by the
-# --no-cache-filter=lint that script/lint passes: caching is explicitly
-# waived for linting, and a cached build lints nothing.
-FROM deps AS lint
-
-COPY . .
-
-RUN golangci-lint run --config .golangci.yml ./...
--- a/21
+++ b/21
@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2026 sneak
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
--- a/README.md
+++ b/README.md
@@ -1,6 +1,6 @@
 # dnswatcher

-dnswatcher is an MIT-licensed, pre-1.0 Go daemon by [@sneak](https://sneak.berlin) that monitors DNS records, TCP port availability, and TLS certificates, delivering real-time change notifications via Slack, Mattermost, and ntfy webhooks.
+dnswatcher is a pre-1.0 Go daemon by [@sneak](https://sneak.berlin) that monitors DNS records, TCP port availability, and TLS certificates, delivering real-time change notifications via Slack, Mattermost, and ntfy webhooks.

 > ⚠️ Pre-1.0 software. APIs, configuration, and behavior may change without notice.

@@ -218,7 +218,8 @@ internal/
 - **Structured logging**: All logs use `log/slog` with JSON output in
  production (TTY detection for development).
 - **Graceful shutdown**: All background goroutines respect context
-  cancellation and the fx lifecycle.
+  cancellation and the fx lifecycle. In-flight notification deliveries
+  are drained on shutdown, bounded by the shutdown timeout.

 ---

@@ -380,25 +381,14 @@ standard: normalized scripts in `script/` are the entrypoints for the
 development workflow, and the Makefile targets are thin shims that call
 them. We provide:

- `script/bootstrap` — install all dependencies (go, pinned goimports,
-  `go mod download`). It does not install golangci-lint: see
-  `script/lint` below.
+- `script/bootstrap` — install all dependencies (go, pinned
+  golangci-lint and goimports, `go mod download`)
 - `script/setup` — make a fresh clone ready for development: bootstrap
  plus the git pre-commit hook
 - `script/projectname` — print the project name (used for the Docker
  image tag)
- `script/test` — run the test suite (race detector, coverage). Caching
-  is waived for testing, exactly as it is for linting: `-count=1`
-  forces every invocation to execute, because the suite queries live
-  DNS and a cached pass queries nothing. Failures are rerun with `-v`
-  automatically, and the build fails even if that rerun passes.
- `script/lint` — run golangci-lint, always inside Docker: it builds
-  `Dockerfile.lint`, which COPYs the repo into the digest-pinned
-  `golangci-lint` image and lints as a build step, so a successful
-  build is a clean lint. The linter is never installed or run on the
-  host, and Docker is the only prerequisite. Caching is waived for
-  linting: the lint stage is forced to execute on every run with
-  `--no-cache-filter`, because a cached build lints nothing.
+- `script/test` — run the test suite (race detector, coverage)
+- `script/lint` — run golangci-lint
 - `script/fmt` — format all code (gofmt -s, goimports)
 - `script/fmt-check` — check formatting (read-only)
 - `script/check` — run test, lint, and fmt-check
@@ -414,7 +404,7 @@ them. We provide:
 ```sh
 make build      # Build binary to bin/dnswatcher
 make test       # Run tests with race detector
-make lint       # Run golangci-lint in Docker (requires docker)
+make lint       # Run golangci-lint
 make fmt        # Format code
 make check      # Run all checks (test, lint, fmt-check)
 make clean      # Remove build artifacts
@@ -463,8 +453,14 @@ docker run -d \
     from a previous cycle.
 4. **On change detection**: Send notifications to all configured
   endpoints, update in-memory state, persist to disk.
-5. **Shutdown**: Persist final state to disk, complete in-flight
-   notifications, stop gracefully.
+5. **Shutdown**: Persist final state to disk, wait for in-flight
+   notification deliveries to complete, stop gracefully. The wait is
+   bounded by the fx shutdown timeout (15s by default): deliveries still
+   retrying against an unreachable endpoint when that expires are
+   abandoned, and the number abandoned is logged at warn level rather
+   than dropped silently. Notifications generated after shutdown has
+   begun are refused and logged, so a late burst cannot extend the
+   shutdown.

 ---

@@ -486,9 +482,8 @@ Viper for configuration.

 ## License

-dnswatcher is released under the MIT License, Copyright (c) 2026
-[@sneak](https://sneak.berlin). See the [`LICENSE`](./LICENSE) file in the
-repository root for the full text.
+License has not yet been chosen for this project. Pending decision by the
+author (MIT, GPL, or WTFPL).

 ## Author

--- a/REPO_POLICIES.md
+++ b/REPO_POLICIES.md
@@ -1,6 +1,6 @@
 ---
 title: Repository Policies
-last_modified: 2026-08-07
+last_modified: 2026-07-06
 ---

 This document covers repository structure, tooling, and workflow standards. Code
@@ -189,13 +189,8 @@ style conventions are in separate documents:
  module under test to verify it compiles/parses. There is no excuse for
  `make test` to be a no-op.

- `make test` must complete in under 60 seconds. That is the hard cap, and a
-  suite that exceeds it fails. Under 20 seconds is the target. A suite between
-  20 and 60 seconds is still green, but the overage must be filed as an
-  improvement bug against that repo. Add a 90-second timeout to the test
-  invocation in the Makefile (`go test -timeout 90s`). The backstop deliberately
-  sits above the hard cap so that it catches a genuinely hung test rather than a
-  merely slow one.
+- `make test` must complete in under 20 seconds. Add a 30-second timeout in the
+  Makefile.

 - **`make test` should use the conditional verbose rerun pattern.** Run tests
  without `-v` (verbose) first. If tests fail, automatically rerun with `-v` to
@@ -214,9 +209,9 @@ style conventions are in separate documents:

    ```makefile
    test:
-    	@go test -timeout 90s -race -cover ./... || \
+    	@go test -timeout 30s -race -cover ./... || \
    		{ echo "--- Rerunning with -v for details ---"; \
-    		  go test -timeout 90s -race -v ./...; exit 1; }
+    		  go test -timeout 30s -race -v ./...; exit 1; }
    ```

    Python example:
@@ -265,10 +260,7 @@ style conventions are in separate documents:

 - `.golangci.yml` is standardized and must _NEVER_ be modified by an agent, only
  manually by the user. Fetch from
-  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml`. The
-  canonical golangci-lint version is v2.12.2 (released 2026-05-06), installed
-  commit-pinned via
-  `go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@c0d3ddc9cf3faa61a4e378e879ece580256d76e5`.
+  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml`.

 - When pinning images or packages by hash, add a comment above the reference
  with the version and date (YYYY-MM-DD).
--- a/TESTING.md
+++ b/TESTING.md
@@ -17,7 +17,7 @@ real servers ensures the resolver works correctly in production.

 - Tests hit real DNS infrastructure and require network access
 - Test duration depends on network conditions; timeout tuning keeps
-  the suite within the 60-second target
+  the suite within the 30-second target
 - Query timeout is calibrated to 3× maximum antipodal RTT (~300ms)
  plus processing margin
 - Root server fan-out is limited to reduce parallel query load
@@ -31,7 +31,4 @@ real servers ensures the resolver works correctly in production.
  exists for unit-testing other packages that consume the resolver)
 - **Do not add `-short` flags** to skip slow tests
 - **Do not increase `-timeout`** to hide hanging queries
- **Do not remove `-count=1` from `script/test`** — Go's test cache
-  replays a previous run's output without querying anything, so a
-  cached pass is not evidence that live resolution works
 - **Do not modify linter configuration** to suppress findings
--- a/TODO.md
+++ b/TODO.md
@@ -18,80 +18,22 @@ iterative resolver implementation with hermetic mocked tests.

 # Next Step

-Add the README sections required by policy (Description, Getting Started,
-Rationale, Design, TODO, License, Author) if any are still missing.
+Policy scaffold commit: add LICENSE, REPO_POLICIES.md, .editorconfig,
+.dockerignore, and .gitea/workflows/check.yml, and add the missing
+fmt-check, docker, and hooks targets to the Makefile. One commit, then
+confirm make check still passes.

 # Completed Steps

- 2026-08-10: comment-only corrections to `script/bootstrap`,
-  `script/cibuild`, and `Dockerfile.lint`. The `goimports` pin in
-  `script/bootstrap` was justified by a claim that `script/fmt-check`
-  runs it on the host; it does not (it runs `gofmt -l .` only), so the
-  header now credits `script/fmt` alone. `script/cibuild` still claimed
-  the `Dockerfile` runs `make check`, which stopped being true when
-  linting moved to its own stage; it now describes the lint stage
-  (`make fmt-check` plus `golangci-lint`) and the builder stage
-  (`make test`, `make build`). The `docker`-missing warning in
-  `script/bootstrap` reads as one sentence instead of three fragments
-  each re-prefixed with `bootstrap:`. `Dockerfile.lint` now records the
-  residual risk of omitting `golangci-lint config verify`: unknown
-  top-level keys in `.golangci.yml` are silently ignored, so a mistyped
-  key lints clean while applying nothing. No behaviour changed
- 2026-08-10: MIT `LICENSE` added at the repository root, closing the
-  last gap in `REPO_POLICIES.md`'s required-minimum file list and
-  removing the all-rights-reserved default that would otherwise have
-  shipped with a 1.0 tag. The licence choice is the standing org policy
-  (any public repo lacking a licence gets MIT; a private repo with no
-  licence is already all-rights-reserved), and this repo is public. The
-  file holds the canonical MIT text byte-for-byte with only the
-  copyright line filled in (`Copyright (c) 2026 sneak`); no clauses were
-  added, removed, or reflowed. `README.md`'s first line now names the
-  licence, as the Description requirement demands, and the License
-  section states MIT and points at the file instead of saying the choice
-  is pending. `make fmt` covers only Go sources (`gofmt -s`,
-  `goimports`), so it cannot reflow `LICENSE`
- 2026-08-10: the policy scaffold (`REPO_POLICIES.md`, `.editorconfig`,
-  `.dockerignore`, `.gitea/workflows/check.yml`, and the `fmt-check`,
-  `docker`, and hooks Makefile targets) is present; it landed piecemeal
-  across the scripts-to-rule-them-all and policy commits rather than as
-  the single commit this file once planned
- 2026-08-10: Go's test cache disabled for `script/test` via `-count=1`,
-  so every invocation actually executes. A cached pass replays an
-  earlier run's output without querying DNS at all, which in this repo
-  means the suite's entire premise goes unexercised while the run
-  reports green in under a second. The conditional verbose rerun that
-  `REPO_POLICIES.md` mandates was added at the same time (the primary
-  run had been unconditionally `-v`): quiet first, `-v` only on
-  failure, `-count=1` on both, and exit 1 forced regardless of the
-  rerun's result so a flake passing the second time cannot turn the
-  build green. `-timeout 90s` left alone as the deliberate backstop
-  above the 60s hard cap. Uncached suite runs ~4s, well inside the 20s
-  target
- 2026-08-10: live-DNS test flakiness addressed by robustness rather
-  than gating, per the owner's ruling on #93: new
-  `internal/resolver/livedns_test.go` adds a package-wide concurrency
-  gate (so parallel tests stop bursting at the first root server),
-  retry with exponential backoff on transport failures only, and
-  quorum instead of unanimity for multi-nameserver assertions. Quorum
-  tolerates silence only: every per-nameserver status must be in a
-  closed allowlist (`ok`/`timeout`/`error`, or
-  `nxdomain`/`timeout`/`error`), so a wrong answer from a minority —
-  `nodata` today, any status added later — fails the test instead of
-  sliding through under the majority. The
-  `make test` cap moved to the new org-wide 60s hard cap / 20s target
-  with a 90s `-timeout` backstop; `REPO_POLICIES.md` re-vendored
-  byte-identical from `sneak/prompts`. No mocks, no `-short`, no build
-  tags, no skips, and no change to production resolver behaviour
- 2026-08-10: all linting moved into Docker: new root `Dockerfile.lint`
-  on the digest-pinned `golangci/golangci-lint:v2.12.2` image,
-  `script/lint` reduced to a thin wrapper that builds it with
-  `--no-cache-filter=lint` so the linter actually executes every run,
-  golangci-lint install dropped from `script/bootstrap` (goimports
-  stays, `script/fmt` needs it on the host), and the root `Dockerfile`
-  given its own lint stage so its build no longer recurses through
-  `make check` into `script/lint`. `golangci-lint config verify` is
-  deliberately omitted: it fetches its schema over an unpinned live
-  HTTPS call
+- 2026-08-09: in-flight notification deliveries are now drained at
+  shutdown (#106): `notify.New` registers an fx `OnStop` hook that waits
+  on a `sync.WaitGroup` of tracked delivery goroutines, bounded by the
+  `OnStop` context; on expiry the outstanding count is logged at warn
+  level and parked retry backoffs are released instead of being dropped
+  silently, and deliveries submitted after the drain begins are refused
+  so shutdown cannot be extended indefinitely; an `OnStop` context that
+  is already expired on entry with nothing outstanding drains quietly
+  rather than warning about deliveries that were never abandoned
 - 2026-08-07: golangci-lint bumped to v2.12.2 (commit-pinned installs
  in `Dockerfile` and `script/bootstrap`); `.golangci.yml` set to the
  org-standard v2-schema config used across the org's repos
@@ -120,6 +62,8 @@ Rationale, Design, TODO, License, Author) if any are still missing.

 Compliance:

+- Add README sections required by policy (Description, Getting Started,
+  Rationale, Design, TODO, License, Author) if any are missing
 - Pin Dockerfile base images by sha256 and ensure the Docker build runs
  make check

--- a/internal/notify/export_test.go
+++ b/internal/notify/export_test.go
@@ -32,11 +32,27 @@ func NewRequestForTest(
 // NewTestService creates a Service suitable for unit testing.
 // It discards log output and uses the given transport.
 func NewTestService(transport http.RoundTripper) *Service {
-	return &Service{
-		log:       slog.New(slog.DiscardHandler),
-		transport: transport,
-		history:   NewAlertHistory(),
-	}
+	return newService(slog.New(slog.DiscardHandler), transport)
+}
+
+// NewTestServiceWithLogger creates a Service that writes to the
+// given handler, so tests can assert on emitted log records.
+func NewTestServiceWithLogger(
+	transport http.RoundTripper,
+	handler slog.Handler,
+) *Service {
+	return newService(slog.New(handler), transport)
+}
+
+// Drain exports drain for testing.
+func (svc *Service) Drain(ctx context.Context) {
+	svc.drain(ctx)
+}
+
+// OutstandingDeliveries reports how many delivery goroutines
+// are currently tracked as in flight.
+func (svc *Service) OutstandingDeliveries() int64 {
+	return svc.outstanding.Load()
 }

 // SetNtfyURL sets the ntfy URL on a Service for testing.
--- a/internal/notify/notify.go
+++ b/internal/notify/notify.go
@@ -12,6 +12,8 @@ import (
 	"log/slog"
 	"net/http"
 	"net/url"
+	"sync"
+	"sync/atomic"
 	"time"

 	"go.uber.org/fx"
@@ -115,19 +117,41 @@ type Service struct {
 	history              *AlertHistory
 	retryConfig          RetryConfig
 	sleepFn              func(time.Duration) <-chan time.Time
+
+	// Shutdown draining state.  drainMu guards draining and
+	// serialises it against the counter increment in
+	// startDelivery; inFlight tracks the delivery goroutines
+	// themselves and outstanding mirrors its count so a timed
+	// out drain can report how many were abandoned.
+	drainMu     sync.Mutex
+	draining    bool
+	inFlight    sync.WaitGroup
+	outstanding atomic.Int64
+	abandon     chan struct{}
+	abandonOnce sync.Once
+}
+
+// newService builds a Service with the fields every Service
+// needs regardless of how it was constructed.
+func newService(
+	log *slog.Logger,
+	transport http.RoundTripper,
+) *Service {
+	return &Service{
+		log:       log,
+		transport: transport,
+		history:   NewAlertHistory(),
+		abandon:   make(chan struct{}),
+	}
 }

 // New creates a new notify Service.
 func New(
-	_ fx.Lifecycle,
+	lifecycle fx.Lifecycle,
 	params Params,
 ) (*Service, error) {
-	svc := &Service{
-		log:       params.Logger.Get(),
-		transport: http.DefaultTransport,
-		config:    params.Config,
-		history:   NewAlertHistory(),
-	}
+	svc := newService(params.Logger.Get(), http.DefaultTransport)
+	svc.config = params.Config

 	if params.Config.NtfyTopic != "" {
 		u, err := ValidateWebhookURL(
@@ -168,6 +192,14 @@ func New(
 		svc.mattermostWebhookURL = u
 	}

+	lifecycle.Append(fx.Hook{
+		OnStop: func(ctx context.Context) error {
+			svc.drain(ctx)
+
+			return nil
+		},
+	})
+
 	return svc, nil
 }

@@ -194,6 +226,32 @@ func (svc *Service) SendNotification(
 	svc.dispatchMattermost(ctx, title, message, priority)
 }

+// dispatch delivers a notification to one endpoint on a
+// tracked background goroutine.
+//
+// The delivery context is detached from ctx with
+// context.WithoutCancel so that a cancelled caller does not
+// kill a delivery already under way; the shutdown drain, not
+// the caller, decides how long deliveries may keep running.
+func (svc *Service) dispatch(
+	ctx context.Context,
+	endpoint string,
+	send func(context.Context) error,
+) {
+	notifyCtx := context.WithoutCancel(ctx)
+
+	svc.startDelivery(endpoint, func() {
+		err := svc.deliverWithRetry(notifyCtx, endpoint, send)
+		if err != nil {
+			svc.log.Error(
+				"failed to send notification after retries",
+				"endpoint", endpoint,
+				"error", err,
+			)
+		}
+	})
+}
+
 func (svc *Service) dispatchNtfy(
 	ctx context.Context,
 	title, message, priority string,
@@ -202,26 +260,11 @@ func (svc *Service) dispatchNtfy(
 		return
 	}

-	go func() {
-		notifyCtx := context.WithoutCancel(ctx)
-
-		err := svc.deliverWithRetry(
-			notifyCtx, "ntfy",
-			func(c context.Context) error {
-				return svc.sendNtfy(
-					c, svc.ntfyURL,
-					title, message, priority,
-				)
-			},
+	svc.dispatch(ctx, "ntfy", func(c context.Context) error {
+		return svc.sendNtfy(
+			c, svc.ntfyURL, title, message, priority,
 		)
-		if err != nil {
-			svc.log.Error(
-				"failed to send ntfy notification "+
-					"after retries",
-				"error", err,
-			)
-		}
-	}()
+	})
 }

 func (svc *Service) dispatchSlack(
@@ -232,26 +275,11 @@ func (svc *Service) dispatchSlack(
 		return
 	}

-	go func() {
-		notifyCtx := context.WithoutCancel(ctx)
-
-		err := svc.deliverWithRetry(
-			notifyCtx, "slack",
-			func(c context.Context) error {
-				return svc.sendSlack(
-					c, svc.slackWebhookURL,
-					title, message, priority,
-				)
-			},
+	svc.dispatch(ctx, "slack", func(c context.Context) error {
+		return svc.sendSlack(
+			c, svc.slackWebhookURL, title, message, priority,
 		)
-		if err != nil {
-			svc.log.Error(
-				"failed to send slack notification "+
-					"after retries",
-				"error", err,
-			)
-		}
-	}()
+	})
 }

 func (svc *Service) dispatchMattermost(
@@ -262,26 +290,15 @@ func (svc *Service) dispatchMattermost(
 		return
 	}

-	go func() {
-		notifyCtx := context.WithoutCancel(ctx)
-
-		err := svc.deliverWithRetry(
-			notifyCtx, "mattermost",
-			func(c context.Context) error {
-				return svc.sendSlack(
-					c, svc.mattermostWebhookURL,
-					title, message, priority,
-				)
-			},
-		)
-		if err != nil {
-			svc.log.Error(
-				"failed to send mattermost notification "+
-					"after retries",
-				"error", err,
+	svc.dispatch(
+		ctx, "mattermost",
+		func(c context.Context) error {
+			return svc.sendSlack(
+				c, svc.mattermostWebhookURL,
+				title, message, priority,
 			)
-		}
-	}()
+		},
+	)
 }

 func (svc *Service) sendNtfy(
--- a/internal/notify/retry.go
+++ b/internal/notify/retry.go
@@ -2,6 +2,7 @@ package notify

 import (
 	"context"
+	"fmt"
 	"math"
 	"math/rand/v2"
 	"time"
@@ -121,6 +122,14 @@ func (svc *Service) deliverWithRetry(
 		select {
 		case <-ctx.Done():
 			return ctx.Err()
+		case <-svc.abandon:
+			// Shutdown drained past its deadline; stop
+			// sleeping rather than outlive the process.
+			// A nil channel (Service built without a
+			// constructor) simply never fires.
+			return fmt.Errorf(
+				"%w: %s", ErrDeliveryAbandoned, endpoint,
+			)
 		case <-svc.sleepFunc(delay):
 		}
 	}
--- a/internal/notify/shutdown.go
+++ b/internal/notify/shutdown.go
@@ -0,0 +1,119 @@
+package notify
+
+import (
+	"context"
+	"errors"
+)
+
+// ErrDeliveryAbandoned is returned by a retry loop that was
+// cut short because shutdown drained past its deadline.
+var ErrDeliveryAbandoned = errors.New(
+	"notification delivery abandoned at shutdown",
+)
+
+// startDelivery runs fn on its own goroutine while tracking it,
+// so that drain can wait for it during shutdown.
+//
+// The WaitGroup counter is incremented here, on the caller's
+// goroutine, before the worker exists: incrementing it inside
+// the worker would race with drain's Wait and could let
+// shutdown sail past a delivery that had not started yet.
+//
+// Once draining has begun the delivery is refused outright
+// rather than queued, so a steady stream of newly submitted
+// notifications cannot keep extending the drain.
+func (svc *Service) startDelivery(endpoint string, fn func()) {
+	svc.drainMu.Lock()
+
+	if svc.draining {
+		svc.drainMu.Unlock()
+
+		svc.log.Warn(
+			"notification not dispatched: shutdown in progress",
+			"endpoint", endpoint,
+		)
+
+		return
+	}
+
+	svc.outstanding.Add(1)
+
+	// WaitGroup.Go increments the counter synchronously, here,
+	// and only then starts the goroutine.
+	svc.inFlight.Go(func() {
+		// Runs before the WaitGroup counter is decremented, so
+		// a drain that times out reports an accurate count.
+		defer svc.outstanding.Add(-1)
+
+		fn()
+	})
+
+	svc.drainMu.Unlock()
+}
+
+// drain waits for in-flight notification deliveries to finish.
+//
+// It first stops accepting new deliveries, then waits until
+// either every outstanding delivery has completed or ctx
+// expires — whichever comes first.  ctx is the context fx
+// passes to the OnStop hook, so a permanently dead webhook
+// cannot hang shutdown indefinitely.
+//
+// When the deadline arrives with deliveries still outstanding,
+// the count is logged at warn level and the abandon channel is
+// closed, which releases any retry loop sleeping in backoff.
+// Deliveries already inside an HTTP round trip are bounded by
+// the existing httpClientTimeout instead.
+//
+// A ctx that is already expired on entry is not by itself cause
+// for alarm: if nothing is outstanding there is nothing to
+// abandon, and the drain says so at debug level rather than
+// warning about deliveries that do not exist.
+func (svc *Service) drain(ctx context.Context) {
+	svc.drainMu.Lock()
+	svc.draining = true
+	svc.drainMu.Unlock()
+
+	done := make(chan struct{})
+
+	go func() {
+		svc.inFlight.Wait()
+		close(done)
+	}()
+
+	select {
+	case <-done:
+		svc.log.Debug(
+			"all in-flight notifications completed",
+		)
+	case <-ctx.Done():
+		// outstanding is decremented before the WaitGroup
+		// counter, and startDelivery can no longer add to it
+		// now that draining is set, so a zero here means every
+		// delivery really did finish.  ctx expiring in that
+		// state (an OnStop context that was already cancelled
+		// on entry is the usual way) abandons nothing, so it
+		// must not close abandon or warn about it.
+		abandoned := svc.outstanding.Load()
+		if abandoned == 0 {
+			svc.log.Debug(
+				"all in-flight notifications completed",
+			)
+
+			return
+		}
+
+		svc.abandonOnce.Do(func() {
+			if svc.abandon != nil {
+				close(svc.abandon)
+			}
+		})
+
+		svc.log.Warn(
+			"shutdown deadline reached with notifications "+
+				"still in flight; abandoning them",
+			"abandoned", abandoned,
+			"error", ctx.Err(),
+		)
+	}
+}
--- a/internal/notify/shutdown_test.go
+++ b/internal/notify/shutdown_test.go
@@ -0,0 +1,531 @@
+package notify_test
+
+import (
+	"bytes"
+	"context"
+	"log/slog"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"go.uber.org/fx"
+
+	"sneak.berlin/go/dnswatcher/internal/config"
+	"sneak.berlin/go/dnswatcher/internal/globals"
+	"sneak.berlin/go/dnswatcher/internal/logger"
+	"sneak.berlin/go/dnswatcher/internal/notify"
+)
+
+// Timings used by the drain tests.  They stay in the same
+// 10-100ms band as the retry tests so the suite never waits on
+// a real backoff delay.
+const (
+	// inFlightHold is how long a delivery is kept mid-request
+	// before the handler is released.
+	inFlightHold = 30 * time.Millisecond
+
+	// drainDeadline bounds a drain that is expected to time
+	// out.
+	drainDeadline = 50 * time.Millisecond
+
+	// drainSlack is the upper bound on how long a bounded
+	// drain may take; generous enough for a loaded CI box,
+	// still far below the 20s test ceiling.
+	drainSlack = 2 * time.Second
+
+	// settleDelay is how long to wait before asserting that
+	// something did *not* happen.
+	settleDelay = 50 * time.Millisecond
+
+	// idleDrainBound is the upper bound on a drain that has
+	// nothing in flight.  It is deliberately far above the cost
+	// of the goroutine hop through inFlight.Wait() — which
+	// reached 57ms on a loaded box under -race with the package's
+	// parallel tests — and far below drainSlack, the deadline
+	// such a drain is given.  A drain that blocked until its
+	// deadline instead of returning on the WaitGroup therefore
+	// still fails this bound, but scheduling delay alone cannot.
+	idleDrainBound = 500 * time.Millisecond
+)
+
+// syncBuffer is an io.Writer safe for concurrent use, so log
+// output written from delivery goroutines can be inspected.
+type syncBuffer struct {
+	mu  sync.Mutex
+	buf bytes.Buffer
+}
+
+func (sb *syncBuffer) Write(p []byte) (int, error) {
+	sb.mu.Lock()
+	defer sb.mu.Unlock()
+
+	return sb.buf.Write(p) //nolint:wrapcheck // test helper
+}
+
+func (sb *syncBuffer) String() string {
+	sb.mu.Lock()
+	defer sb.mu.Unlock()
+
+	return sb.buf.String()
+}
+
+// newLoggingService returns a Service writing JSON logs into
+// the returned buffer.
+func newLoggingService(
+	transport http.RoundTripper,
+) (*notify.Service, *syncBuffer) {
+	logs := &syncBuffer{}
+	handler := slog.NewJSONHandler(logs, nil)
+
+	return notify.NewTestServiceWithLogger(transport, handler),
+		logs
+}
+
+// blockingNtfyServer returns a server whose handler signals on
+// entered, waits for release, and then responds 200.
+func blockingNtfyServer(
+	entered chan<- struct{},
+	release <-chan struct{},
+	served *atomic.Bool,
+) *httptest.Server {
+	var once sync.Once
+
+	return httptest.NewServer(
+		http.HandlerFunc(
+			func(w http.ResponseWriter, _ *http.Request) {
+				once.Do(func() { close(entered) })
+				<-release
+
+				served.Store(true)
+
+				w.WriteHeader(http.StatusOK)
+			}),
+	)
+}
+
+// TestDrainWaitsForInFlightDelivery verifies that a delivery
+// already under way when shutdown starts is allowed to finish.
+func TestDrainWaitsForInFlightDelivery(t *testing.T) {
+	t.Parallel()
+
+	var served atomic.Bool
+
+	entered := make(chan struct{})
+	release := make(chan struct{})
+
+	srv := blockingNtfyServer(entered, release, &served)
+	defer srv.Close()
+
+	topicURL, _ := url.Parse(srv.URL)
+
+	svc := notify.NewTestService(http.DefaultTransport)
+	svc.SetNtfyURL(topicURL)
+
+	svc.SendNotification(
+		context.Background(), "t", "m", prioInfo,
+	)
+
+	// Make sure the delivery really is mid-request before the
+	// drain begins.
+	select {
+	case <-entered:
+	case <-time.After(drainSlack):
+		t.Fatal("delivery never reached the endpoint")
+	}
+
+	// As in TestDrainBoundedByContextDeadline: start is captured
+	// before the clock it is compared against, here the timer
+	// holding the delivery open, so elapsed covers the whole hold
+	// and the lower bound cannot come out short from scheduling
+	// delay alone.
+	start := time.Now()
+
+	timer := time.AfterFunc(inFlightHold, func() {
+		close(release)
+	})
+	defer timer.Stop()
+
+	ctx, cancel := context.WithTimeout(
+		context.Background(), drainSlack,
+	)
+	defer cancel()
+
+	svc.Drain(ctx)
+
+	elapsed := time.Since(start)
+
+	if !served.Load() {
+		t.Error(
+			"drain returned before the in-flight delivery " +
+				"completed",
+		)
+	}
+
+	if elapsed < inFlightHold {
+		t.Errorf(
+			"drain took %v, want at least %v",
+			elapsed, inFlightHold,
+		)
+	}
+
+	if got := svc.OutstandingDeliveries(); got != 0 {
+		t.Errorf("outstanding deliveries = %d, want 0", got)
+	}
+}
+
+// neverFires returns a channel that never delivers, standing in
+// for a long backoff sleep without actually sleeping.
+func neverFires(_ time.Duration) <-chan time.Time {
+	return make(chan time.Time)
+}
+
+// TestDrainBoundedByContextDeadline verifies that a delivery
+// stuck retrying against a dead endpoint does not hold shutdown
+// past the OnStop context deadline, and that the abandoned
+// deliveries are logged at warn level rather than dropped
+// silently.
+func TestDrainBoundedByContextDeadline(t *testing.T) {
+	t.Parallel()
+
+	var requests atomic.Int64
+
+	srv := httptest.NewServer(
+		http.HandlerFunc(
+			func(w http.ResponseWriter, _ *http.Request) {
+				requests.Add(1)
+
+				w.WriteHeader(http.StatusInternalServerError)
+			}),
+	)
+	defer srv.Close()
+
+	topicURL, _ := url.Parse(srv.URL)
+
+	svc, logs := newLoggingService(http.DefaultTransport)
+	svc.SetNtfyURL(topicURL)
+	// Never let the backoff sleep complete: the delivery is
+	// parked in its retry wait until shutdown releases it.
+	svc.SetSleepFunc(neverFires)
+	svc.SetRetryConfig(notify.RetryConfig{
+		MaxRetries: 5,
+		BaseDelay:  time.Hour,
+		MaxDelay:   time.Hour,
+	})
+
+	svc.SendNotification(
+		context.Background(), "t", "m", prioError,
+	)
+
+	waitForCondition(t, func() bool {
+		return requests.Load() >= 1 &&
+			svc.OutstandingDeliveries() == 1
+	})
+
+	// start must be captured *before* the deadline clock starts,
+	// so that the measured interval is a superset of the deadline
+	// interval.  Capturing it after context.WithTimeout would
+	// make elapsed structurally smaller than drainDeadline and
+	// the lower bound below unfalsifiable-by-luck: it would fail
+	// whenever the two statements were separated by any
+	// scheduling delay, and pass otherwise, regardless of what
+	// the drain did.
+	start := time.Now()
+
+	ctx, cancel := context.WithTimeout(
+		context.Background(), drainDeadline,
+	)
+	defer cancel()
+
+	// The upper bound is enforced by a watchdog rather than by
+	// measuring after the fact: a drain that is not bounded at
+	// all never returns here (the delivery is parked in a backoff
+	// that never fires), so an unbounded drain must fail this
+	// test promptly instead of hanging the package until the test
+	// binary's 30s timeout.
+	returned := make(chan struct{})
+
+	go func() {
+		defer close(returned)
+
+		svc.Drain(ctx)
+	}()
+
+	select {
+	case <-returned:
+	case <-time.After(drainSlack):
+		t.Fatalf(
+			"drain did not return within %v; its %v deadline "+
+				"did not bound it",
+			drainSlack, drainDeadline,
+		)
+	}
+
+	// The lower bound is the real assertion: the drain must have
+	// waited for its whole deadline rather than giving up on the
+	// outstanding delivery early.  With start captured above, an
+	// early return is the only thing that can make it fail.
+	if elapsed := time.Since(start); elapsed < drainDeadline {
+		t.Errorf(
+			"drain returned after %v, before its %v deadline",
+			elapsed, drainDeadline,
+		)
+	}
+
+	assertAbandonLogged(t, logs.String())
+
+	// The abandoned delivery must stop retrying rather than
+	// outlive the drain.
+	waitForCondition(t, func() bool {
+		return svc.OutstandingDeliveries() == 0
+	})
+}
+
+// assertAbandonLogged checks that the drain logged the
+// abandoned deliveries at warn level with a count.
+func assertAbandonLogged(t *testing.T, output string) {
+	t.Helper()
+
+	if !strings.Contains(output, `"level":"WARN"`) {
+		t.Errorf(
+			"abandoned deliveries not logged at warn level; "+
+				"log output: %s",
+			output,
+		)
+	}
+
+	if !strings.Contains(output, `"abandoned":1`) {
+		t.Errorf(
+			"abandoned delivery count not logged; "+
+				"log output: %s",
+			output,
+		)
+	}
+}
+
+// TestDrainRefusesNewDeliveries verifies that notifications
+// submitted after the drain has begun are refused and logged,
+// so a stream of new work cannot extend shutdown indefinitely.
+func TestDrainRefusesNewDeliveries(t *testing.T) {
+	t.Parallel()
+
+	var requests atomic.Int64
+
+	srv := httptest.NewServer(
+		http.HandlerFunc(
+			func(w http.ResponseWriter, _ *http.Request) {
+				requests.Add(1)
+
+				w.WriteHeader(http.StatusOK)
+			}),
+	)
+	defer srv.Close()
+
+	target, _ := url.Parse(srv.URL)
+
+	svc, logs := newLoggingService(http.DefaultTransport)
+	svc.SetNtfyURL(target)
+	svc.SetSlackWebhookURL(target)
+	svc.SetMattermostWebhookURL(target)
+
+	ctx, cancel := context.WithTimeout(
+		context.Background(), drainSlack,
+	)
+	defer cancel()
+
+	// Nothing is in flight, so this returns immediately and
+	// leaves the service refusing further deliveries.
+	svc.Drain(ctx)
+
+	for range 3 {
+		svc.SendNotification(
+			context.Background(), "t", "m", prioInfo,
+		)
+	}
+
+	time.Sleep(settleDelay)
+
+	if got := requests.Load(); got != 0 {
+		t.Errorf(
+			"%d requests reached the endpoint after drain, "+
+				"want 0",
+			got,
+		)
+	}
+
+	if got := svc.OutstandingDeliveries(); got != 0 {
+		t.Errorf("outstanding deliveries = %d, want 0", got)
+	}
+
+	output := logs.String()
+	if !strings.Contains(output, "shutdown in progress") {
+		t.Errorf(
+			"refused deliveries not logged; log output: %s",
+			output,
+		)
+	}
+}
+
+// recordingLifecycle is a minimal fx.Lifecycle that records the
+// hooks appended to it, so the wiring done by notify.New can be
+// inspected without standing up a whole fx application.
+type recordingLifecycle struct {
+	hooks []fx.Hook
+}
+
+func (l *recordingLifecycle) Append(hook fx.Hook) {
+	l.hooks = append(l.hooks, hook)
+}
+
+// newNotifyService builds a Service through the real
+// constructor, wired to the given lifecycle.
+func newNotifyService(
+	t *testing.T,
+	lifecycle fx.Lifecycle,
+	ntfyTopic string,
+) *notify.Service {
+	t.Helper()
+
+	g, err := globals.New(nil)
+	if err != nil {
+		t.Fatalf("globals.New: %v", err)
+	}
+
+	log, err := logger.New(nil, logger.Params{Globals: g})
+	if err != nil {
+		t.Fatalf("logger.New: %v", err)
+	}
+
+	svc, err := notify.New(lifecycle, notify.Params{
+		Logger: log,
+		Config: &config.Config{NtfyTopic: ntfyTopic},
+	})
+	if err != nil {
+		t.Fatalf("notify.New: %v", err)
+	}
+
+	return svc
+}
+
+// TestNewRegistersDrainingStopHook verifies that notify.New
+// wires an OnStop hook into the fx lifecycle and that the hook
+// waits for in-flight deliveries.
+func TestNewRegistersDrainingStopHook(t *testing.T) {
+	t.Parallel()
+
+	var served atomic.Bool
+
+	entered := make(chan struct{})
+	release := make(chan struct{})
+
+	srv := blockingNtfyServer(entered, release, &served)
+	defer srv.Close()
+
+	lifecycle := &recordingLifecycle{}
+	svc := newNotifyService(t, lifecycle, srv.URL)
+
+	if len(lifecycle.hooks) != 1 {
+		t.Fatalf(
+			"appended %d lifecycle hooks, want 1",
+			len(lifecycle.hooks),
+		)
+	}
+
+	stop := lifecycle.hooks[0].OnStop
+	if stop == nil {
+		t.Fatal("lifecycle hook has no OnStop function")
+	}
+
+	svc.SendNotification(
+		context.Background(), "t", "m", prioInfo,
+	)
+
+	select {
+	case <-entered:
+	case <-time.After(drainSlack):
+		t.Fatal("delivery never reached the endpoint")
+	}
+
+	timer := time.AfterFunc(inFlightHold, func() {
+		close(release)
+	})
+	defer timer.Stop()
+
+	ctx, cancel := context.WithTimeout(
+		context.Background(), drainSlack,
+	)
+	defer cancel()
+
+	err := stop(ctx)
+	if err != nil {
+		t.Fatalf("OnStop returned error: %v", err)
+	}
+
+	if !served.Load() {
+		t.Error(
+			"OnStop returned before the in-flight delivery " +
+				"completed",
+		)
+	}
+}
+
+// TestDrainWithoutDeliveriesReturnsImmediately verifies the
+// common case: nothing in flight, shutdown is not delayed.
+func TestDrainWithoutDeliveriesReturnsImmediately(t *testing.T) {
+	t.Parallel()
+
+	svc := notify.NewTestService(http.DefaultTransport)
+
+	// Captured before the deadline clock, as elsewhere in this
+	// file; for an upper bound that is the conservative
+	// direction, since the measured interval can then only be
+	// longer than the drain itself.
+	start := time.Now()
+
+	ctx, cancel := context.WithTimeout(
+		context.Background(), drainSlack,
+	)
+	defer cancel()
+
+	svc.Drain(ctx)
+
+	if elapsed := time.Since(start); elapsed > idleDrainBound {
+		t.Errorf(
+			"drain of an idle service took %v, want well "+
+				"under its %v deadline",
+			elapsed, drainSlack,
+		)
+	}
+}
+
+// TestDrainWithCancelledContextDoesNotWarn verifies that an
+// OnStop context that is already dead on entry does not produce
+// an "abandoning them" warning when there was nothing in flight
+// to abandon.  The expired context wins the select immediately,
+// so only the outstanding count can tell the difference between
+// a genuine timeout and a shutdown that had simply already run
+// out of time with no work left.
+func TestDrainWithCancelledContextDoesNotWarn(t *testing.T) {
+	t.Parallel()
+
+	svc, logs := newLoggingService(http.DefaultTransport)
+
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+
+	svc.Drain(ctx)
+
+	if output := logs.String(); strings.Contains(
+		output, `"level":"WARN"`,
+	) {
+		t.Errorf(
+			"drain with nothing in flight warned about "+
+				"abandoned deliveries; log output: %s",
+			output,
+		)
+	}
+}
--- a/internal/resolver/livedns_harness_test.go
+++ b/internal/resolver/livedns_harness_test.go
@@ -1,284 +0,0 @@
-package resolver_test
-
-import (
-	"context"
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-
-	"sneak.berlin/go/dnswatcher/internal/resolver"
-)
-
-// Tests for the live-DNS harness in livedns_test.go itself. These
-// exercise pure logic and the retry/concurrency plumbing; they
-// perform no DNS resolution of any kind, so they neither mock DNS
-// nor depend on it.
-
-// Names for the synthetic status maps below. Nothing is ever queried
-// at them: they are map keys handed to the package's pure counting
-// helpers, not a stand-in for a nameserver.
-const (
-	nsExample1 = "ns1.example."
-	nsExample2 = "ns2.example."
-	nsExample3 = "ns3.example."
-	nsExample4 = "ns4.example."
-)
-
-func TestLiveQuorumIsStrictMajority(t *testing.T) {
-	t.Parallel()
-
-	cases := map[int]int{
-		0:  1,
-		1:  1,
-		2:  2,
-		3:  2,
-		4:  3,
-		5:  3,
-		13: 7,
-	}
-
-	for total, want := range cases {
-		assert.Equal(
-			t, want, liveQuorum(total),
-			"liveQuorum(%d)", total,
-		)
-	}
-}
-
-func TestStatusCountingIgnoresSilentNameservers(t *testing.T) {
-	t.Parallel()
-
-	results := map[string]*resolver.NameserverResponse{
-		nsExample1: {
-			Nameserver: nsExample1,
-			Status:     resolver.StatusOK,
-		},
-		nsExample2: {
-			Nameserver: nsExample2,
-			Status:     resolver.StatusOK,
-		},
-		nsExample3: {
-			Nameserver: nsExample3,
-			Status:     resolver.StatusTimeout,
-		},
-		nsExample4: {
-			Nameserver: nsExample4,
-			Status:     resolver.StatusError,
-		},
-	}
-
-	assert.Equal(
-		t, 2, countStatus(results, resolver.StatusOK),
-	)
-	assert.Equal(
-		t, 0, countStatus(results, resolver.StatusNXDomain),
-	)
-
-	// Two of four answered, which is short of the quorum of
-	// three: this is the state that triggers a retry rather
-	// than an assertion failure.
-	assert.Equal(t, 2, answeredCount(results))
-	assert.Less(t, answeredCount(results), liveQuorum(len(results)))
-
-	assert.Equal(
-		t,
-		"ns1.example.=ok ns2.example.=ok "+
-			"ns3.example.=timeout ns4.example.=error",
-		describeStatuses(results),
-	)
-}
-
-func TestRetryLiveRecoversFromTransientFailure(t *testing.T) {
-	t.Parallel()
-
-	const wantAttempts = 2
-
-	attempts := 0
-
-	retryLive(t, "transient", func(_ context.Context) error {
-		attempts++
-
-		if attempts < wantAttempts {
-			return errLiveNoAnswer
-		}
-
-		return nil
-	})
-
-	assert.Equal(t, wantAttempts, attempts)
-}
-
-func TestRetryLiveGivesEachAttemptADeadline(t *testing.T) {
-	t.Parallel()
-
-	retryLive(t, "deadline", func(ctx context.Context) error {
-		deadline, ok := ctx.Deadline()
-		assert.True(t, ok, "attempt should carry a deadline")
-
-		remaining := time.Until(deadline)
-
-		assert.LessOrEqual(t, remaining, liveAttemptTimeout)
-
-		// Lower bound too: without one this passes for a
-		// deadline far shorter than intended, which would
-		// silently turn every live attempt into an instant
-		// timeout.
-		assert.Greater(t, remaining, liveAttemptTimeout/2)
-
-		return nil
-	})
-}
-
-// TestUnsanctionedStatusesRejectsWrongAnswers is the regression test
-// for the defect this allowlist exists to prevent: a minority of
-// nameservers answering WRONGLY while quorum keeps the suite green.
-// nodata is the case that motivated it — it is a wrong answer, not
-// silence, and it was previously banned by neither test.
-func TestUnsanctionedStatusesRejectsWrongAnswers(t *testing.T) {
-	t.Parallel()
-
-	// Four nameservers, three OK and one answering nodata: a
-	// quorum of three is satisfied and no NXDOMAIN is present, so
-	// the old blocklist assertions both passed on this input.
-	results := map[string]*resolver.NameserverResponse{
-		nsExample1: {
-			Nameserver: nsExample1,
-			Status:     resolver.StatusOK,
-		},
-		nsExample2: {
-			Nameserver: nsExample2,
-			Status:     resolver.StatusOK,
-		},
-		nsExample3: {
-			Nameserver: nsExample3,
-			Status:     resolver.StatusOK,
-		},
-		nsExample4: {
-			Nameserver: nsExample4,
-			Status:     resolver.StatusNoData,
-		},
-	}
-
-	assert.GreaterOrEqual(
-		t,
-		countStatus(results, resolver.StatusOK),
-		liveQuorum(len(results)),
-	)
-	assert.Zero(t, countStatus(results, resolver.StatusNXDomain))
-
-	// nodata is an ANSWER, so it never triggers a retry: nothing
-	// but the allowlist stands between it and a false green.
-	assert.Equal(t, len(results), answeredCount(results))
-
-	assert.Equal(
-		t,
-		[]string{nsExample4 + "=nodata"},
-		unsanctionedStatuses(
-			results,
-			resolver.StatusOK,
-			resolver.StatusTimeout,
-			resolver.StatusError,
-		),
-		"nodata must be reported as an unsanctioned status",
-	)
-}
-
-func TestUnsanctionedStatusesToleratesSilenceOnly(t *testing.T) {
-	t.Parallel()
-
-	results := map[string]*resolver.NameserverResponse{
-		nsExample1: {
-			Nameserver: nsExample1,
-			Status:     resolver.StatusNXDomain,
-		},
-		nsExample2: {
-			Nameserver: nsExample2,
-			Status:     resolver.StatusTimeout,
-		},
-		nsExample3: {
-			Nameserver: nsExample3,
-			Status:     resolver.StatusError,
-		},
-	}
-
-	allowed := []string{
-		resolver.StatusNXDomain,
-		resolver.StatusTimeout,
-		resolver.StatusError,
-	}
-
-	assert.Empty(
-		t,
-		unsanctionedStatuses(results, allowed...),
-		"timeout and error are non-answers and are tolerated",
-	)
-
-	// The same silent nameservers do not count towards a quorum.
-	assert.Equal(t, 1, answeredCount(results))
-
-	// An unknown status is treated as silence by answeredCount —
-	// so it retries and fails loudly — and is unsanctioned by the
-	// allowlist rather than quietly permitted.
-	const laterStatus = "some-status-added-later"
-
-	results[nsExample4] = &resolver.NameserverResponse{
-		Nameserver: nsExample4,
-		Status:     laterStatus,
-	}
-
-	assert.Equal(t, 1, answeredCount(results))
-	assert.Equal(
-		t,
-		[]string{nsExample4 + "=" + laterStatus},
-		unsanctionedStatuses(results, allowed...),
-	)
-}
-
-func TestRunLiveBoundsConcurrency(t *testing.T) {
-	t.Parallel()
-
-	const workers = 24
-
-	var (
-		mu       sync.Mutex
-		wg       sync.WaitGroup
-		inFlight int
-		maxSeen  int
-	)
-
-	wg.Add(workers)
-
-	for range workers {
-		go func() {
-			defer wg.Done()
-
-			_ = runLive(func(_ context.Context) error {
-				mu.Lock()
-				inFlight++
-
-				if inFlight > maxSeen {
-					maxSeen = inFlight
-				}
-				mu.Unlock()
-
-				time.Sleep(time.Millisecond)
-
-				mu.Lock()
-				inFlight--
-				mu.Unlock()
-
-				return nil
-			})
-		}()
-	}
-
-	wg.Wait()
-
-	assert.Positive(t, maxSeen)
-	assert.LessOrEqual(
-		t, maxSeen, liveConcurrency,
-		"live queries must stay under the package-wide gate",
-	)
-}
--- a/internal/resolver/livedns_test.go
+++ b/internal/resolver/livedns_test.go
@@ -1,495 +0,0 @@
-package resolver_test
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"slices"
-	"sort"
-	"strings"
-	"testing"
-	"time"
-
-	"sneak.berlin/go/dnswatcher/internal/resolver"
-)
-
-// ----------------------------------------------------------------
-// Live DNS test support
-// ----------------------------------------------------------------
-//
-// Every test in this package resolves against the real, live DNS —
-// see TESTING.md. Nothing here mocks, fakes, stubs, records or
-// replays DNS, and nothing here skips or gates a test: the helpers
-// below only change *how* the live queries are issued, so that a
-// single dropped UDP packet or one slow authoritative server does
-// not turn a correct resolver into a red build.
-//
-// Three mechanisms, all test-side:
-//
-//  1. Bounded concurrency. The package's tests are parallel and the
-//     build hosts have many cores, so without a limit every test
-//     starts its own iterative resolution at the same instant and
-//     they all hit the first root server in rootServerList() within
-//     a few milliseconds of each other. Root servers rate-limit
-//     that, which shows up as a different arbitrary subset of tests
-//     failing on each run. liveGate caps how many resolutions are
-//     in flight at once.
-//
-//  2. Retry with exponential backoff. Each live operation gets
-//     several attempts with its own timeout. The retry predicate is
-//     strictly transport-level — "did a nameserver answer at all" —
-//     never the assertion the test is making. A resolver that
-//     answers incorrectly still fails on the first attempt.
-//
-//  3. Quorum. Where an assertion spans several independent
-//     nameservers, a strict majority answering as expected is
-//     enough; a server that fails to answer is tolerated, while a
-//     server that answers *wrongly* still fails the test.
-//
-// The tolerance in (3) is expressed as an ALLOWLIST of sanctioned
-// statuses, never as a blocklist of known-bad ones. A blocklist bans
-// the one wrong answer its author thought of and silently admits
-// every other status, including any added to the resolver later; an
-// allowlist fails on anything nobody explicitly sanctioned. Silence
-// (timeout, error) is the only thing quorum exists to tolerate. A
-// *wrong answer* — nxdomain for a name that exists, ok for one that
-// does not, nodata for either — is never tolerated at any count.
-
-const (
-	// liveAttempts is how many times a live DNS operation is
-	// attempted before the test fails.
-	liveAttempts = 3
-
-	// liveAttemptTimeout bounds one attempt. Worst case for an
-	// operation is liveAttempts * liveAttemptTimeout plus the
-	// backoff — about 26 seconds, well inside the 90-second
-	// `go test -timeout` backstop even when several operations
-	// exhaust their attempts.
-	liveAttemptTimeout = 8 * time.Second
-
-	// liveBackoffBase is the delay after the first failed
-	// attempt; it is multiplied by liveBackoffFactor each time.
-	liveBackoffBase = 500 * time.Millisecond
-
-	// liveBackoffFactor is the exponential backoff multiplier.
-	liveBackoffFactor = 2
-
-	// liveConcurrency caps how many live resolutions may be in
-	// flight across the whole package at once.
-	liveConcurrency = 6
-
-	// minNameservers is the smallest nameserver count a
-	// well-run zone is expected to publish.
-	minNameservers = 2
-)
-
-// liveGate bounds concurrent live resolutions package-wide. It has
-// to be package scoped: the whole point is that it is shared by
-// every parallel test in the package.
-//
-//nolint:gochecknoglobals // package-wide live query rate limit
-var liveGate = make(chan struct{}, liveConcurrency)
-
-var (
-	// errLiveNoAnswer reports that a live operation produced no
-	// usable answer, which is retried rather than asserted on.
-	errLiveNoAnswer = errors.New("no answer from live DNS")
-
-	// errLiveNoQuorum reports that too few of a domain's
-	// nameservers answered for a quorum assertion to be made.
-	errLiveNoQuorum = errors.New("no nameserver quorum")
-)
-
-// runLive executes one attempt of a live operation, holding a slot
-// in liveGate for its duration and bounding it with its own
-// timeout.
-func runLive(op func(ctx context.Context) error) error {
-	liveGate <- struct{}{}
-	defer func() { <-liveGate }()
-
-	ctx, cancel := context.WithTimeout(
-		context.Background(), liveAttemptTimeout,
-	)
-	defer cancel()
-
-	return op(ctx)
-}
-
-// retryLive runs op until it reports success, retrying transport
-// failures with exponential backoff, and fails the test if every
-// attempt fails. op returns an error only for a failure to obtain
-// an answer — never for an answer the test disagrees with, which
-// belongs in an assertion so that it fails immediately. op stores
-// whatever it obtained where its caller can find it.
-func retryLive(
-	t *testing.T,
-	what string,
-	op func(ctx context.Context) error,
-) {
-	t.Helper()
-
-	var last error
-
-	backoff := liveBackoffBase
-
-	for attempt := range liveAttempts {
-		if attempt > 0 {
-			t.Logf(
-				"%s: attempt %d of %d failed (%v), "+
-					"retrying in %s",
-				what, attempt, liveAttempts, last, backoff,
-			)
-			time.Sleep(backoff)
-
-			backoff *= liveBackoffFactor
-		}
-
-		last = runLive(op)
-		if last == nil {
-			return
-		}
-	}
-
-	t.Fatalf(
-		"%s: no answer after %d live attempts: %v",
-		what, liveAttempts, last,
-	)
-}
-
-// liveQuorum is how many of total nameservers must agree for a
-// multi-nameserver assertion to hold: a strict majority.
-func liveQuorum(total int) int {
-	if total < 1 {
-		return 1
-	}
-
-	return total/2 + 1
-}
-
-// countStatus counts the responses carrying the given status.
-func countStatus(
-	results map[string]*resolver.NameserverResponse,
-	status string,
-) int {
-	n := 0
-
-	for _, resp := range results {
-		if resp.Status == status {
-			n++
-		}
-	}
-
-	return n
-}
-
-// liveAnswerStatuses is the closed set of statuses that count as a
-// nameserver having ANSWERED at all, whether or not the test agrees
-// with the answer. It is deliberately an allowlist: a status added
-// to the resolver later is treated as silence, so it can only ever
-// cause a retry and then a loud failure, never a quiet pass.
-func liveAnswerStatuses() []string {
-	return []string{
-		resolver.StatusOK,
-		resolver.StatusNXDomain,
-		resolver.StatusNoData,
-	}
-}
-
-// answeredCount counts the nameservers that produced an answer of
-// any kind, as opposed to failing or timing out.
-func answeredCount(
-	results map[string]*resolver.NameserverResponse,
-) int {
-	answers := liveAnswerStatuses()
-
-	n := 0
-
-	for _, resp := range results {
-		if slices.Contains(answers, resp.Status) {
-			n++
-		}
-	}
-
-	return n
-}
-
-// unsanctionedStatuses returns "nameserver=status" for every result
-// whose status the caller did not explicitly sanction, sorted for a
-// stable failure message. Callers pass the full closed set they will
-// accept — the expected answer plus whichever non-answers (timeout,
-// error) quorum is allowed to tolerate — so that any status outside
-// it fails the test by name.
-func unsanctionedStatuses(
-	results map[string]*resolver.NameserverResponse,
-	allowed ...string,
-) []string {
-	offenders := make([]string, 0, len(results))
-
-	for ns, resp := range results {
-		if slices.Contains(allowed, resp.Status) {
-			continue
-		}
-
-		offenders = append(
-			offenders, fmt.Sprintf("%s=%s", ns, resp.Status),
-		)
-	}
-
-	sort.Strings(offenders)
-
-	return offenders
-}
-
-// describeStatuses renders per-nameserver statuses for use in
-// assertion failure messages.
-func describeStatuses(
-	results map[string]*resolver.NameserverResponse,
-) string {
-	parts := make([]string, 0, len(results))
-	for ns, resp := range results {
-		parts = append(
-			parts, fmt.Sprintf("%s=%s", ns, resp.Status),
-		)
-	}
-
-	sort.Strings(parts)
-
-	return strings.Join(parts, " ")
-}
-
-// ----------------------------------------------------------------
-// Live operation wrappers
-// ----------------------------------------------------------------
-
-// liveFindAuthoritative resolves a domain's authoritative
-// nameservers, retrying until the delegation chain can be walked.
-func liveFindAuthoritative(
-	t *testing.T,
-	r *resolver.Resolver,
-	domain string,
-) []string {
-	t.Helper()
-
-	var out []string
-
-	retryLive(
-		t,
-		"FindAuthoritativeNameservers("+domain+")",
-		func(ctx context.Context) error {
-			ns, err := r.FindAuthoritativeNameservers(ctx, domain)
-			if err != nil {
-				return err
-			}
-
-			if len(ns) == 0 {
-				return fmt.Errorf(
-					"%w: %s has no nameservers",
-					errLiveNoAnswer, domain,
-				)
-			}
-
-			out = ns
-
-			return nil
-		},
-	)
-
-	return out
-}
-
-// liveLookupNS is liveFindAuthoritative through the LookupNS entry
-// point, so that both entry points stay independently exercised.
-func liveLookupNS(
-	t *testing.T,
-	r *resolver.Resolver,
-	domain string,
-) []string {
-	t.Helper()
-
-	var out []string
-
-	retryLive(
-		t,
-		"LookupNS("+domain+")",
-		func(ctx context.Context) error {
-			ns, err := r.LookupNS(ctx, domain)
-			if err != nil {
-				return err
-			}
-
-			if len(ns) == 0 {
-				return fmt.Errorf(
-					"%w: %s has no nameservers",
-					errLiveNoAnswer, domain,
-				)
-			}
-
-			out = ns
-
-			return nil
-		},
-	)
-
-	return out
-}
-
-// liveQueryNameserver queries one nameserver, retrying while that
-// nameserver fails to answer. NXDOMAIN and NODATA are answers and
-// are returned to the caller to assert on.
-func liveQueryNameserver(
-	t *testing.T,
-	r *resolver.Resolver,
-	nameserver string,
-	hostname string,
-) *resolver.NameserverResponse {
-	t.Helper()
-
-	what := fmt.Sprintf(
-		"QueryNameserver(%s, %s)", nameserver, hostname,
-	)
-
-	var out *resolver.NameserverResponse
-
-	retryLive(
-		t,
-		what,
-		func(ctx context.Context) error {
-			resp, err := r.QueryNameserver(
-				ctx, nameserver, hostname,
-			)
-			if err != nil {
-				return err
-			}
-
-			if resp.Status == resolver.StatusTimeout ||
-				resp.Status == resolver.StatusError {
-				return fmt.Errorf(
-					"%w: %s returned %s: %s",
-					errLiveNoAnswer, nameserver,
-					resp.Status, resp.Error,
-				)
-			}
-
-			out = resp
-
-			return nil
-		},
-	)
-
-	return out
-}
-
-// liveQueryAllNameservers queries every authoritative nameserver
-// for a hostname, retrying until a quorum of them has answered.
-// Individual nameservers that stay silent are left in the result
-// for the caller to account for.
-func liveQueryAllNameservers(
-	t *testing.T,
-	r *resolver.Resolver,
-	hostname string,
-) map[string]*resolver.NameserverResponse {
-	t.Helper()
-
-	var out map[string]*resolver.NameserverResponse
-
-	retryLive(
-		t,
-		"QueryAllNameservers("+hostname+")",
-		func(ctx context.Context) error {
-			results, err := r.QueryAllNameservers(ctx, hostname)
-			if err != nil {
-				return err
-			}
-
-			if len(results) == 0 {
-				return fmt.Errorf(
-					"%w: no nameservers queried for %s",
-					errLiveNoAnswer, hostname,
-				)
-			}
-
-			answered := answeredCount(results)
-			if answered < liveQuorum(len(results)) {
-				return fmt.Errorf(
-					"%w: %d of %d answered: %s",
-					errLiveNoQuorum, answered,
-					len(results), describeStatuses(results),
-				)
-			}
-
-			out = results
-
-			return nil
-		},
-	)
-
-	return out
-}
-
-// liveResolveIPs resolves a hostname that is expected to have
-// addresses, retrying until at least one is returned.
-func liveResolveIPs(
-	t *testing.T,
-	r *resolver.Resolver,
-	hostname string,
-) []string {
-	t.Helper()
-
-	var out []string
-
-	retryLive(
-		t,
-		"ResolveIPAddresses("+hostname+")",
-		func(ctx context.Context) error {
-			ips, err := r.ResolveIPAddresses(ctx, hostname)
-			if err != nil {
-				return err
-			}
-
-			if len(ips) == 0 {
-				return fmt.Errorf(
-					"%w: no addresses for %s",
-					errLiveNoAnswer, hostname,
-				)
-			}
-
-			out = ips
-
-			return nil
-		},
-	)
-
-	return out
-}
-
-// liveResolveIPsAllowingEmpty resolves a hostname that may legitimately
-// have no addresses, so the empty result is returned rather than
-// retried. Used for names that must not exist; the corresponding
-// QueryAllNameservers test is what proves the nameservers actively
-// said NXDOMAIN rather than merely staying silent.
-func liveResolveIPsAllowingEmpty(
-	t *testing.T,
-	r *resolver.Resolver,
-	hostname string,
-) []string {
-	t.Helper()
-
-	var out []string
-
-	retryLive(
-		t,
-		"ResolveIPAddresses("+hostname+")",
-		func(ctx context.Context) error {
-			ips, err := r.ResolveIPAddresses(ctx, hostname)
-			if err != nil {
-				return err
-			}
-
-			out = ips
-
-			return nil
-		},
-	)
-
-	return out
-}
--- a/internal/resolver/resolver_test.go
+++ b/internal/resolver/resolver_test.go
@@ -32,17 +32,32 @@ func newTestResolver(t *testing.T) *resolver.Resolver {
 	return resolver.NewFromLogger(log)
 }

-// findOneNSForDomain picks one authoritative nameserver to aim a
-// test at. Live-DNS retry, concurrency and quorum handling live in
-// livedns_test.go.
+func testContext(t *testing.T) context.Context {
+	t.Helper()
+
+	ctx, cancel := context.WithTimeout(
+		context.Background(), 60*time.Second,
+	)
+	t.Cleanup(cancel)
+
+	return ctx
+}
+
 func findOneNSForDomain(
 	t *testing.T,
 	r *resolver.Resolver,
+	ctx context.Context, //nolint:revive // test helper
 	domain string,
 ) string {
 	t.Helper()

-	return liveFindAuthoritative(t, r, domain)[0]
+	nameservers, err := r.FindAuthoritativeNameservers(
+		ctx, domain,
+	)
+	require.NoError(t, err)
+	require.NotEmpty(t, nameservers)
+
+	return nameservers[0]
 }

 // ----------------------------------------------------------------
@@ -55,7 +70,13 @@ func TestFindAuthoritativeNameservers_ValidDomain(
 	t.Parallel()

 	r := newTestResolver(t)
-	nameservers := liveFindAuthoritative(t, r, "google.com")
+	ctx := testContext(t)
+
+	nameservers, err := r.FindAuthoritativeNameservers(
+		ctx, "google.com",
+	)
+	require.NoError(t, err)
+	require.NotEmpty(t, nameservers)

 	hasGoogleNS := false

@@ -78,9 +99,13 @@ func TestFindAuthoritativeNameservers_Subdomain(
 	t.Parallel()

 	r := newTestResolver(t)
-	nameservers := liveFindAuthoritative(t, r, "www.google.com")
+	ctx := testContext(t)

-	assert.NotEmpty(t, nameservers)
+	nameservers, err := r.FindAuthoritativeNameservers(
+		ctx, "www.google.com",
+	)
+	require.NoError(t, err)
+	require.NotEmpty(t, nameservers)
 }

 func TestFindAuthoritativeNameservers_ReturnsSorted(
@@ -89,7 +114,12 @@ func TestFindAuthoritativeNameservers_ReturnsSorted(
 	t.Parallel()

 	r := newTestResolver(t)
-	nameservers := liveFindAuthoritative(t, r, "google.com")
+	ctx := testContext(t)
+
+	nameservers, err := r.FindAuthoritativeNameservers(
+		ctx, "google.com",
+	)
+	require.NoError(t, err)

 	assert.True(
 		t,
@@ -104,8 +134,17 @@ func TestFindAuthoritativeNameservers_Deterministic(
 	t.Parallel()

 	r := newTestResolver(t)
-	first := liveFindAuthoritative(t, r, "google.com")
-	second := liveFindAuthoritative(t, r, "google.com")
+	ctx := testContext(t)
+
+	first, err := r.FindAuthoritativeNameservers(
+		ctx, "google.com",
+	)
+	require.NoError(t, err)
+
+	second, err := r.FindAuthoritativeNameservers(
+		ctx, "google.com",
+	)
+	require.NoError(t, err)

 	assert.Equal(t, first, second)
 }
@@ -116,8 +155,17 @@ func TestFindAuthoritativeNameservers_TrailingDot(
 	t.Parallel()

 	r := newTestResolver(t)
-	ns1 := liveFindAuthoritative(t, r, "google.com")
-	ns2 := liveFindAuthoritative(t, r, "google.com.")
+	ctx := testContext(t)
+
+	ns1, err := r.FindAuthoritativeNameservers(
+		ctx, "google.com",
+	)
+	require.NoError(t, err)
+
+	ns2, err := r.FindAuthoritativeNameservers(
+		ctx, "google.com.",
+	)
+	require.NoError(t, err)

 	assert.Equal(t, ns1, ns2)
 }
@@ -128,7 +176,13 @@ func TestFindAuthoritativeNameservers_CloudflareDomain(
 	t.Parallel()

 	r := newTestResolver(t)
-	nameservers := liveFindAuthoritative(t, r, "cloudflare.com")
+	ctx := testContext(t)
+
+	nameservers, err := r.FindAuthoritativeNameservers(
+		ctx, "cloudflare.com",
+	)
+	require.NoError(t, err)
+	require.NotEmpty(t, nameservers)

 	for _, ns := range nameservers {
 		assert.True(t, strings.HasSuffix(ns, "."),
@@ -145,9 +199,13 @@ func TestQueryNameserver_BasicA(t *testing.T) {
 	t.Parallel()

 	r := newTestResolver(t)
-	ns := findOneNSForDomain(t, r, "google.com")
-	resp := liveQueryNameserver(t, r, ns, "www.google.com")
+	ctx := testContext(t)
+	ns := findOneNSForDomain(t, r, ctx, "google.com")

+	resp, err := r.QueryNameserver(
+		ctx, ns, "www.google.com",
+	)
+	require.NoError(t, err)
 	require.NotNil(t, resp)

 	assert.Equal(t, resolver.StatusOK, resp.Status)
@@ -164,8 +222,13 @@ func TestQueryNameserver_AAAA(t *testing.T) {
 	t.Parallel()

 	r := newTestResolver(t)
-	ns := findOneNSForDomain(t, r, "cloudflare.com")
-	resp := liveQueryNameserver(t, r, ns, "cloudflare.com")
+	ctx := testContext(t)
+	ns := findOneNSForDomain(t, r, ctx, "cloudflare.com")
+
+	resp, err := r.QueryNameserver(
+		ctx, ns, "cloudflare.com",
+	)
+	require.NoError(t, err)

 	aaaaRecords := resp.Records["AAAA"]
 	require.NotEmpty(t, aaaaRecords,
@@ -184,8 +247,13 @@ func TestQueryNameserver_MX(t *testing.T) {
 	t.Parallel()

 	r := newTestResolver(t)
-	ns := findOneNSForDomain(t, r, "google.com")
-	resp := liveQueryNameserver(t, r, ns, "google.com")
+	ctx := testContext(t)
+	ns := findOneNSForDomain(t, r, ctx, "google.com")
+
+	resp, err := r.QueryNameserver(
+		ctx, ns, "google.com",
+	)
+	require.NoError(t, err)

 	mxRecords := resp.Records["MX"]
 	require.NotEmpty(t, mxRecords,
@@ -197,8 +265,13 @@ func TestQueryNameserver_TXT(t *testing.T) {
 	t.Parallel()

 	r := newTestResolver(t)
-	ns := findOneNSForDomain(t, r, "google.com")
-	resp := liveQueryNameserver(t, r, ns, "google.com")
+	ctx := testContext(t)
+	ns := findOneNSForDomain(t, r, ctx, "google.com")
+
+	resp, err := r.QueryNameserver(
+		ctx, ns, "google.com",
+	)
+	require.NoError(t, err)

 	txtRecords := resp.Records["TXT"]
 	require.NotEmpty(t, txtRecords,
@@ -224,10 +297,14 @@ func TestQueryNameserver_NXDomain(t *testing.T) {
 	t.Parallel()

 	r := newTestResolver(t)
-	ns := findOneNSForDomain(t, r, "google.com")
-	resp := liveQueryNameserver(
-		t, r, ns, "this-surely-does-not-exist-xyz.google.com",
+	ctx := testContext(t)
+	ns := findOneNSForDomain(t, r, ctx, "google.com")
+
+	resp, err := r.QueryNameserver(
+		ctx, ns,
+		"this-surely-does-not-exist-xyz.google.com",
 	)
+	require.NoError(t, err)

 	assert.Equal(t, resolver.StatusNXDomain, resp.Status)
 }
@@ -236,8 +313,13 @@ func TestQueryNameserver_RecordsSorted(t *testing.T) {
 	t.Parallel()

 	r := newTestResolver(t)
-	ns := findOneNSForDomain(t, r, "google.com")
-	resp := liveQueryNameserver(t, r, ns, "google.com")
+	ctx := testContext(t)
+	ns := findOneNSForDomain(t, r, ctx, "google.com")
+
+	resp, err := r.QueryNameserver(
+		ctx, ns, "google.com",
+	)
+	require.NoError(t, err)

 	for recordType, values := range resp.Records {
 		assert.True(
@@ -254,8 +336,13 @@ func TestQueryNameserver_ResponseIncludesNameserver(
 	t.Parallel()

 	r := newTestResolver(t)
-	ns := findOneNSForDomain(t, r, "cloudflare.com")
-	resp := liveQueryNameserver(t, r, ns, "cloudflare.com")
+	ctx := testContext(t)
+	ns := findOneNSForDomain(t, r, ctx, "cloudflare.com")
+
+	resp, err := r.QueryNameserver(
+		ctx, ns, "cloudflare.com",
+	)
+	require.NoError(t, err)

 	assert.Equal(t, ns, resp.Nameserver)
 }
@@ -266,10 +353,14 @@ func TestQueryNameserver_EmptyRecordsOnNXDomain(
 	t.Parallel()

 	r := newTestResolver(t)
-	ns := findOneNSForDomain(t, r, "google.com")
-	resp := liveQueryNameserver(
-		t, r, ns, "this-surely-does-not-exist-xyz.google.com",
+	ctx := testContext(t)
+	ns := findOneNSForDomain(t, r, ctx, "google.com")
+
+	resp, err := r.QueryNameserver(
+		ctx, ns,
+		"this-surely-does-not-exist-xyz.google.com",
 	)
+	require.NoError(t, err)

 	totalRecords := 0
 	for _, values := range resp.Records {
@@ -283,9 +374,18 @@ func TestQueryNameserver_TrailingDotHandling(t *testing.T) {
 	t.Parallel()

 	r := newTestResolver(t)
-	ns := findOneNSForDomain(t, r, "google.com")
-	resp1 := liveQueryNameserver(t, r, ns, "google.com")
-	resp2 := liveQueryNameserver(t, r, ns, "google.com.")
+	ctx := testContext(t)
+	ns := findOneNSForDomain(t, r, ctx, "google.com")
+
+	resp1, err := r.QueryNameserver(
+		ctx, ns, "google.com",
+	)
+	require.NoError(t, err)
+
+	resp2, err := r.QueryNameserver(
+		ctx, ns, "google.com.",
+	)
+	require.NoError(t, err)

 	assert.Equal(t, resp1.Status, resp2.Status)
 }
@@ -298,9 +398,15 @@ func TestQueryAllNameservers_ReturnsAllNS(t *testing.T) {
 	t.Parallel()

 	r := newTestResolver(t)
-	results := liveQueryAllNameservers(t, r, "google.com")
+	ctx := testContext(t)

-	assert.GreaterOrEqual(t, len(results), minNameservers)
+	results, err := r.QueryAllNameservers(
+		ctx, "google.com",
+	)
+	require.NoError(t, err)
+	require.NotEmpty(t, results)
+
+	assert.GreaterOrEqual(t, len(results), 2)

 	for ns, resp := range results {
 		assert.Equal(t, ns, resp.Nameserver)
@@ -311,36 +417,19 @@ func TestQueryAllNameservers_AllReturnOK(t *testing.T) {
 	t.Parallel()

 	r := newTestResolver(t)
-	results := liveQueryAllNameservers(t, r, "google.com")
+	ctx := testContext(t)

-	// A quorum, not unanimity: one authoritative server being
-	// slow or rate-limiting us is a property of the live
-	// internet, not a resolver defect.
-	assert.GreaterOrEqual(
-		t,
-		countStatus(results, resolver.StatusOK),
-		liveQuorum(len(results)),
-		"a quorum of nameservers should answer OK: %s",
-		describeStatuses(results),
+	results, err := r.QueryAllNameservers(
+		ctx, "google.com",
 	)
+	require.NoError(t, err)

-	// Quorum tolerates SILENCE only. Every individual result must
-	// be either the expected answer or a non-answer: ok, timeout
-	// or error, and nothing else. Stated as a closed allowlist so
-	// that a wrong answer no one thought to ban — nxdomain and
-	// nodata today, any status added later — fails here rather
-	// than sliding through under the quorum.
-	assert.Empty(
-		t,
-		unsanctionedStatuses(
-			results,
-			resolver.StatusOK,
-			resolver.StatusTimeout,
-			resolver.StatusError,
-		),
-		"every nameserver must answer OK or not answer at all: %s",
-		describeStatuses(results),
-	)
+	for ns, resp := range results {
+		assert.Equal(
+			t, resolver.StatusOK, resp.Status,
+			"NS %s should return OK", ns,
+		)
+	}
 }

 func TestQueryAllNameservers_NXDomainFromAllNS(
@@ -349,34 +438,20 @@ func TestQueryAllNameservers_NXDomainFromAllNS(
 	t.Parallel()

 	r := newTestResolver(t)
-	results := liveQueryAllNameservers(
-		t, r, "this-surely-does-not-exist-xyz.google.com",
-	)
+	ctx := testContext(t)

-	assert.GreaterOrEqual(
-		t,
-		countStatus(results, resolver.StatusNXDomain),
-		liveQuorum(len(results)),
-		"a quorum of nameservers should report NXDOMAIN: %s",
-		describeStatuses(results),
+	results, err := r.QueryAllNameservers(
+		ctx,
+		"this-surely-does-not-exist-xyz.google.com",
 	)
+	require.NoError(t, err)

-	// Silence is tolerated; any actual answer other than NXDOMAIN
-	// is not. Closed allowlist for the same reason as above: a
-	// server answering `ok` or `nodata` for a name that must not
-	// exist is a wrong answer, not a slow one.
-	assert.Empty(
-		t,
-		unsanctionedStatuses(
-			results,
-			resolver.StatusNXDomain,
-			resolver.StatusTimeout,
-			resolver.StatusError,
-		),
-		"every nameserver must report NXDOMAIN or not answer "+
-			"at all: %s",
-		describeStatuses(results),
-	)
+	for ns, resp := range results {
+		assert.Equal(
+			t, resolver.StatusNXDomain, resp.Status,
+			"NS %s should return nxdomain", ns,
+		)
+	}
 }

 // ----------------------------------------------------------------
@@ -387,7 +462,11 @@ func TestLookupNS_ValidDomain(t *testing.T) {
 	t.Parallel()

 	r := newTestResolver(t)
-	nameservers := liveLookupNS(t, r, "google.com")
+	ctx := testContext(t)
+
+	nameservers, err := r.LookupNS(ctx, "google.com")
+	require.NoError(t, err)
+	require.NotEmpty(t, nameservers)

 	for _, ns := range nameservers {
 		assert.True(t, strings.HasSuffix(ns, "."),
@@ -400,7 +479,10 @@ func TestLookupNS_Sorted(t *testing.T) {
 	t.Parallel()

 	r := newTestResolver(t)
-	nameservers := liveLookupNS(t, r, "google.com")
+	ctx := testContext(t)
+
+	nameservers, err := r.LookupNS(ctx, "google.com")
+	require.NoError(t, err)

 	assert.True(t, sort.StringsAreSorted(nameservers))
 }
@@ -409,8 +491,15 @@ func TestLookupNS_MatchesFindAuthoritative(t *testing.T) {
 	t.Parallel()

 	r := newTestResolver(t)
-	fromLookup := liveLookupNS(t, r, "google.com")
-	fromFind := liveFindAuthoritative(t, r, "google.com")
+	ctx := testContext(t)
+
+	fromLookup, err := r.LookupNS(ctx, "google.com")
+	require.NoError(t, err)
+
+	fromFind, err := r.FindAuthoritativeNameservers(
+		ctx, "google.com",
+	)
+	require.NoError(t, err)

 	assert.Equal(t, fromFind, fromLookup)
 }
@@ -423,7 +512,11 @@ func TestResolveIPAddresses_ReturnsIPs(t *testing.T) {
 	t.Parallel()

 	r := newTestResolver(t)
-	ips := liveResolveIPs(t, r, "google.com")
+	ctx := testContext(t)
+
+	ips, err := r.ResolveIPAddresses(ctx, "google.com")
+	require.NoError(t, err)
+	require.NotEmpty(t, ips)

 	for _, ip := range ips {
 		parsed := net.ParseIP(ip)
@@ -437,7 +530,10 @@ func TestResolveIPAddresses_Deduplicated(t *testing.T) {
 	t.Parallel()

 	r := newTestResolver(t)
-	ips := liveResolveIPs(t, r, "google.com")
+	ctx := testContext(t)
+
+	ips, err := r.ResolveIPAddresses(ctx, "google.com")
+	require.NoError(t, err)

 	seen := make(map[string]bool)

@@ -451,7 +547,10 @@ func TestResolveIPAddresses_Sorted(t *testing.T) {
 	t.Parallel()

 	r := newTestResolver(t)
-	ips := liveResolveIPs(t, r, "google.com")
+	ctx := testContext(t)
+
+	ips, err := r.ResolveIPAddresses(ctx, "google.com")
+	require.NoError(t, err)

 	assert.True(t, sort.StringsAreSorted(ips))
 }
@@ -462,10 +561,13 @@ func TestResolveIPAddresses_NXDomainReturnsEmpty(
 	t.Parallel()

 	r := newTestResolver(t)
-	ips := liveResolveIPsAllowingEmpty(
-		t, r, "this-surely-does-not-exist-xyz.google.com",
-	)
+	ctx := testContext(t)

+	ips, err := r.ResolveIPAddresses(
+		ctx,
+		"this-surely-does-not-exist-xyz.google.com",
+	)
+	require.NoError(t, err)
 	assert.Empty(t, ips)
 }

@@ -473,9 +575,11 @@ func TestResolveIPAddresses_CloudflareDomain(t *testing.T) {
 	t.Parallel()

 	r := newTestResolver(t)
-	ips := liveResolveIPs(t, r, "cloudflare.com")
+	ctx := testContext(t)

-	assert.NotEmpty(t, ips)
+	ips, err := r.ResolveIPAddresses(ctx, "cloudflare.com")
+	require.NoError(t, err)
+	require.NotEmpty(t, ips)
 }

 // ----------------------------------------------------------------
--- a/script/bootstrap
+++ b/script/bootstrap
@@ -3,17 +3,15 @@
 # this repo. Idempotent: every install is guarded by a check so already
 # installed tools are skipped. Base tooling comes from nix, apt, brew,
 # or apk (detected in that order); assumes nothing is present.
-# goimports is installed via `go install` at a pinned commit (never
-# "latest") because script/fmt runs it on the host; script/fmt-check
-# does not (it runs gofmt only).
-# The linter is NOT installed here: golangci-lint runs via docker only
-# (script/lint), pinned by image digest, so its only prerequisite is a
-# working docker.
+# golangci-lint and goimports are installed via `go install` at the same
+# pinned commits the Dockerfile uses (never "latest").
 set -eu

 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"

-# Pinned version, 2026-08-07 (same pin as the Dockerfile)
+# Pinned versions, 2026-08-07 (same pins as the Dockerfile)
+# golangci-lint v2.12.2
+GOLANGCI_LINT_REF="github.com/golangci/golangci-lint/v2/cmd/golangci-lint@c0d3ddc9cf3faa61a4e378e879ece580256d76e5"
 # goimports v0.42.0
 GOIMPORTS_REF="golang.org/x/tools/cmd/goimports@009367f5c17a8d4c45a961a3a509277190a9a6f0"

@@ -71,17 +69,11 @@ main() {
    if missing make; then pkg_install gnumake make make make; fi
    if missing go; then pkg_install go golang go go; fi

-    # Format tools, pinned via go install (installs into
+    # Lint/format tools, pinned via go install (installs into
    # "$(go env GOPATH)/bin"; ensure that is on your PATH).
+    if missing golangci-lint; then go install "$GOLANGCI_LINT_REF"; fi
    if missing goimports; then go install "$GOIMPORTS_REF"; fi

-    # Linting runs via docker only (script/lint). Warn, don't fail:
-    # everything except `make lint` works without it.
-    if missing docker; then
-        echo "bootstrap: WARNING: docker not found; install it to" \
-            "run make lint and make docker." >&2
-    fi
-
    go mod download

    echo "bootstrap complete"
--- a/script/cibuild
+++ b/script/cibuild
@@ -1,7 +1,6 @@
 #!/bin/sh
-# script/cibuild: run the CI build. The Dockerfile's lint stage runs
-# make fmt-check and golangci-lint; its builder stage runs make test
-# and make build. A successful build implies all of those passed.
+# script/cibuild: run the CI build. The Dockerfile runs make check, so
+# a successful build implies all checks pass.
 set -eu

 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
--- a/script/lint
+++ b/script/lint
@@ -1,28 +1,12 @@
 #!/bin/sh
-# script/lint: run the linter. golangci-lint is never installed or run
-# on the host: it runs via docker only, one way, everywhere. This
-# builds Dockerfile.lint, which COPYs the repo into the digest-pinned
-# golangci-lint image and lints as a build step, so a successful build
-# means a clean lint.
-#
-# --no-cache-filter=lint forces the lint stage (source copy + linter
-# run) to execute on every invocation. Without it an unchanged tree
-# returns success in well under a second having linted nothing. The
-# deps stage (base image + go mod download) stays cached, and no global
-# cache invalidation is performed. --progress=plain keeps the linter's
-# own output visible.
+# script/lint: run the linter.
 set -eu

 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"

 main() {
    cd "$ROOT"
-    docker build \
-        --progress=plain \
-        --no-cache-filter=lint \
-        --target lint \
-        -f Dockerfile.lint \
-        .
+    golangci-lint run --config .golangci.yml ./...
 }

 main "$@"
--- a/script/test
+++ b/script/test
@@ -1,35 +1,12 @@
 #!/bin/sh
 # script/test: run the test suite.
-#
-# -count=1 disables Go's test cache, and is load-bearing here. This
-# suite queries live DNS on every run by policy (TESTING.md); a cached
-# result is a replay of an earlier run's output with no query made at
-# all. On an unchanged tree the whole suite would return success in
-# under a second having resolved nothing, which makes the repeated-run
-# green that is used as evidence for flakiness fixes worthless. Do not
-# remove it.
-#
-# Conditional verbose rerun per REPO_POLICIES.md: run quiet first so
-# CI and docker build logs stay readable, and rerun with -v only on
-# failure. The rerun also carries -count=1 (a cached replay of the
-# failure would show nothing new), and the exit status is forced to 1
-# no matter how the rerun ends: the first failure already proved the
-# suite broken, so a flaky test that passes the second time must not
-# turn the build green.
-#
-# -timeout 90s is a deliberate backstop above the 60s hard cap on
-# suite duration. Do not lower it.
 set -eu

 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"

 main() {
    cd "$ROOT"
-    go test -count=1 -race -timeout 90s -cover ./... || {
-        echo "--- Rerunning with -v for details ---" >&2
-        go test -count=1 -race -timeout 90s -v ./... || true
-        exit 1
-    }
+    go test -v -race -timeout 30s -cover ./...
 }

 main "$@"