Modernize Go code per use-modern-go guidelines

[ThomasK33]

Guided modernization pass over all workspace modules, driven by the use-modern-go skill installed in #60. Two layers: the gopls modernize analyzer with fixes (go run golang.org/x/tools/gopls/internal/analysis/modernize/cmd/modernize@latest -fix -test ./... per module), then a hand-reviewed manual sweep for skill-guideline idioms the analyzer misses. Every fix was reviewed against the guideline set for go 1.26 (run-tool.sh list). All rewrites are mechanical and behavior-preserving; no public API changes, no test-semantics changes. 22 files, +63/−109.

State modules (state/*) and example modules came back clean from the analyzer — findings were confined to the root module and adapters.

Diff by idiom class

Analyzer-applied (hand-reviewed):

Idiom	Sites	Notes
errors.AsType[T] (go 1.26)	8	linear.go/slack.go webhook *http.MaxBytesError checks + 6 test assertions; bound variable was unused everywhere, so _, ok := form
for range n	7	burst.go batch loop + 6 test delivery loops; loop index still used inside bodies
slices.Contains/ContainsFunc	6	test helpers (lookedUp, hasEvent, hasOutcome, eventually-conditions)
slices.Backward	2	linear/history.go newest-first page reversal
atomic.Int32	2	history_hardening_test.go counters (historyHits, handled)
reflect.TypeFor[T]	2	history_test.go core-surface invariant checks
new(false)	1	inlined boolPtr(false); deleted the then-unused boolPtr helper

Manual sweep (guideline idioms the analyzer missed):

Idiom	Sites	Notes
sync.WaitGroup.Go	4	test fan-out goroutines with exact Add(1)+go+defer Done() shape; loop-var capture safe per go ≥1.22 semantics
min/max builtins	1	BackoffDelay clamp → min(max(delay, retryAfter), maxDelay); required renaming the builtin-shadowing param max→maxDelay (internal package, param rename invisible to callers)
strings.CutPrefix	2	decodeThreadID in both adapters (needed both trimmed rest and match bool)
strings.FieldsFuncSeq	1	parseGrantedScopes iterates fields directly; drops the intermediate slice
json omitzero	3	direct bool, limit int, inclusive bool wire fields — encoding is byte-identical to omitempty for bool/int zeros

Deliberately NOT modernized

• t.Context() in tests — hardening tests encode context-lifetime invariants (detached/deferred dispatch must be independent of request contexts); swapping context.Background() for t.Context() changes what those tests assert. Left all of them.
• sync.OnceFunc/OnceValue — all sync.Once uses (state/nats close, close-channel-once test patterns) are direct .Do calls in control flow, not wrapper-closure memoization; converting adds nothing.
• time.Tick — runtime.go dispatch/queue tickers have explicit Stop tied to shutdown lifecycle; relying on GC recovery would weaken deliberate resource handling.
• omitempty on string/slice/map/pointer/any fields (~30) — the json_omitzero guideline itself says keep omitempty for empty strings/slices/maps; pointer/any fields gain nothing from omitzero.
• wg.Add(1) in adapters/linear tests (2 sites) — Done() is called inside event-handler callbacks registered with the bot, not the Add+go shape wg.Go replaces.
• cmp.Or — no true fallback chains; candidates were guard-and-panic (mustEnv) or two-expression branches.
• Already modern, nothing to do: zero interface{}, sort.Slice, time.Now().Sub(...), or bare err == sentinel comparisons in the tree.

Validation

• mise run vet — all 7 modules green.
• GOFLAGS=-race mise run test — all modules green (12 package ok lines incl. Testcontainers postgres/redis and embedded-NATS suites; zero FAIL/DATA RACE).
• Timing-sensitive suites stressed: go test -race -run 'Burst|Admission' -count=5 . green.
• Re-ran modernize (no -fix) post-sweep: zero findings; gofmt -l clean.
• (Host note: needed the known ambient-GOROOT//opt/mise PATH scrub so mise tasks resolve the pinned go 1.26.3.)

---

Generated with mux • Model: anthropic:claude-fable-5 • Thinking: xhigh

[ThomasK33]

@codex review

[ThomasK33]

@codex security review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-29T12:55:39.197804Z	a2cfac1	Manual request
🔒 Security Review	✅ Completed 2026-08-29T12:56:50.873807Z	a2cfac1	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Another round soon, please!

Reviewed commit: a2cfac142f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Security review completed. No security issues were found in this pull request.

Reviewed commit: a2cfac142f

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.