various linting fixes

cmd/credential-helper/main.go

···
 
 				// Wait for user to complete OAuth flow, then retry
 				fmt.Fprintf(os.Stderr, "Waiting for authentication")
-				for i := 0; i < 60; i++ { // Wait up to 2 minutes
+				for range 60 { // Wait up to 2 minutes
 					time.Sleep(2 * time.Second)
 					fmt.Fprintf(os.Stderr, ".")
 
···
 	curParts := strings.Split(curV, ".")
 
 	// Compare each part
-	for i := 0; i < len(newParts) && i < len(curParts); i++ {
+	for i := range min(len(newParts), len(curParts)) {
 		newNum := 0
 		curNum := 0
 		fmt.Sscanf(newParts[i], "%d", &newNum)

pkg/appview/db/device_store.go

···
 }
 
 // UpdateLastUsed updates the last used timestamp
-func (s *DeviceStore) UpdateLastUsed(secretHash string) error {
+func (s *DeviceStore) UpdateLastUsed(secretHash string) {
 	_, err := s.db.Exec(`
 		UPDATE devices
 		SET last_used = ?
 		WHERE secret_hash = ?
 	`, time.Now(), secretHash)
 
-	return err
+	if err != nil {
+		slog.Warn("Failed to update device last used timestamp", "component", "device_store", "error", err)
+	}
 }
 
 // CleanupExpired removes expired pending authorizations

pkg/appview/db/device_store_test.go

···
 func TestGenerateUserCode(t *testing.T) {
 	// Generate multiple codes to test
 	codes := make(map[string]bool)
-	for i := 0; i < 100; i++ {
+	for range 100 {
 		code := generateUserCode()
 
 		// Test format: XXXX-XXXX
···
 				return
 			}
 			if !tt.wantErr {
-				if device == nil {
-					t.Error("Expected device, got nil")
-				}
 				if device.DID != "did:plc:alice123" {
 					t.Errorf("DID = %v, want did:plc:alice123", device.DID)
 				}
···
 	}
 
 	// Create 3 devices
-	for i := 0; i < 3; i++ {
+	for i := range 3 {
 		pending, err := store.CreatePendingAuth("Device "+string(rune('A'+i)), "192.168.1.1", "Agent")
 		if err != nil {
 			t.Fatalf("CreatePendingAuth() error = %v", err)
···
 	}
 
 	// Verify they're sorted by created_at DESC (newest first)
-	for i := 0; i < len(devices)-1; i++ {
+	for i := range len(devices) - 1 {
 		if devices[i].CreatedAt.Before(devices[i+1].CreatedAt) {
 			t.Error("Devices should be sorted by created_at DESC")
 		}
···
 	time.Sleep(10 * time.Millisecond)
 
 	// Update last used
-	err = store.UpdateLastUsed(device.SecretHash)
-	if err != nil {
-		t.Errorf("UpdateLastUsed() error = %v", err)
-	}
+	store.UpdateLastUsed(device.SecretHash)
 
 	// Verify it was updated
 	device2, err := store.ValidateDeviceSecret(secret)

pkg/appview/db/oauth_store.go

···
 }
 
 // CleanupOldSessions removes sessions older than the specified duration
-func (s *OAuthStore) CleanupOldSessions(ctx context.Context, olderThan time.Duration) error {
+func (s *OAuthStore) CleanupOldSessions(ctx context.Context, olderThan time.Duration) {
 	cutoff := time.Now().Add(-olderThan)
 
 	result, err := s.db.ExecContext(ctx, `
···
 	`, cutoff)
 
 	if err != nil {
-		return fmt.Errorf("failed to cleanup old sessions: %w", err)
+		slog.Warn("Failed to cleanup old OAuth sessions", "component", "oauth_store", "error", err)
+		return
 	}
 
 	deleted, _ := result.RowsAffected()
 	if deleted > 0 {
 		slog.Info("Cleaned up old OAuth sessions", "count", deleted, "older_than", olderThan)
 	}
-
-	return nil
 }
 
 // CleanupExpiredAuthRequests removes auth requests older than 10 minutes
-func (s *OAuthStore) CleanupExpiredAuthRequests(ctx context.Context) error {
+func (s *OAuthStore) CleanupExpiredAuthRequests(ctx context.Context) {
 	cutoff := time.Now().Add(-10 * time.Minute)
 
 	result, err := s.db.ExecContext(ctx, `
···
 	`, cutoff)
 
 	if err != nil {
-		return fmt.Errorf("failed to cleanup auth requests: %w", err)
+		slog.Warn("Failed to cleanup expired auth requests", "component", "oauth_store", "error", err)
+		return
 	}
 
 	deleted, _ := result.RowsAffected()
 	if deleted > 0 {
 		slog.Info("Cleaned up expired auth requests", "count", deleted)
 	}
-
-	return nil
 }
 
 // InvalidateSessionsWithMismatchedScopes removes all sessions whose scopes don't match the desired scopes

pkg/appview/db/oauth_store_test.go

···
 	}
 
 	// Run cleanup (remove sessions older than 30 days)
-	if err := store.CleanupOldSessions(ctx, 30*24*time.Hour); err != nil {
-		t.Fatalf("Failed to cleanup old sessions: %v", err)
-	}
+	store.CleanupOldSessions(ctx, 30*24*time.Hour)
 
 	// Verify old session was deleted
 	_, err = store.GetSession(ctx, did1, "old_session")

pkg/appview/db/session_store_test.go

···
 
 	// Create multiple sessions for alice
 	sessionIDs := make([]string, 3)
-	for i := 0; i < 3; i++ {
+	for i := range 3 {
 		id, err := store.Create(did, "alice.bsky.social", "https://pds.example.com", 1*time.Hour)
 		if err != nil {
 			t.Fatalf("Create() error = %v", err)
···
 
 	// Generate multiple session IDs
 	ids := make(map[string]bool)
-	for i := 0; i < 100; i++ {
+	for range 100 {
 		id, err := store.Create("did:plc:alice123", "alice.bsky.social", "https://pds.example.com", 1*time.Hour)
 		if err != nil {
 			t.Fatalf("Create() error = %v", err)

pkg/appview/holdhealth/worker_test.go

···
-package holdhealth
-
-import "testing"
-
-func TestWorker_Struct(t *testing.T) {
-	// Simple struct test
-	worker := &Worker{}
-	if worker == nil {
-		t.Error("Expected non-nil worker")
-	}
-}
-
-// TODO: Add background health check tests

pkg/appview/jetstream/processor_test.go

···
 	}
 
 	// Test 5: Process multiple deactivation events (idempotent)
-	for i := 0; i < 3; i++ {
+	for i := range 3 {
 		err = processor.ProcessAccount(context.Background(), testDID, false, "deactivated")
 		if err != nil {
 			t.Logf("Expected cache invalidation error on iteration %d: %v", i, err)

pkg/appview/jetstream/worker.go

···
 
 		// Reset read deadline - we know connection is alive
 		// Allow 90 seconds for next pong (3x ping interval)
-		conn.SetReadDeadline(time.Now().Add(90 * time.Second))
-		return nil
+		return conn.SetReadDeadline(time.Now().Add(90 * time.Second))
 	})
 
 	// Set initial read deadline

pkg/appview/middleware/auth_test.go

···
 	// Pre-create all users and sessions before concurrent access
 	// This ensures database is fully initialized before goroutines start
 	sessionIDs := make([]string, 10)
-	for i := 0; i < 10; i++ {
+	for i := range 10 {
 		did := fmt.Sprintf("did:plc:user%d", i)
 		handle := fmt.Sprintf("user%d.bsky.social", i)
 
···
 	var wg sync.WaitGroup
 	var mu sync.Mutex // Protect results map
 
-	for i := 0; i < 10; i++ {
+	for i := range 10 {
 		wg.Add(1)
 		go func(index int, sessionID string) {
 			defer wg.Done()

pkg/appview/middleware/registry.go

···
 
 		// Store HTTP method in context for routing decisions
 		// This is used by routing_repository.go to distinguish pull (GET/HEAD) from push (PUT/POST)
-		ctx = context.WithValue(ctx, "http.request.method", r.Method)
+		ctx = context.WithValue(ctx, storage.HTTPRequestMethod, r.Method)
 
 		// Extract Authorization header
 		authHeader := r.Header.Get("Authorization")

pkg/appview/ogcard/card.go

···
 		defer face.Close()
 
 		textWidth := font.MeasureString(face, text).Round()
-		if align == AlignCenter {
+		switch align {
+		case AlignCenter:
 			x -= float64(textWidth) / 2
-		} else if align == AlignRight {
+		case AlignRight:
 			x -= float64(textWidth)
 		}
 	}
···
 // DrawRoundedRect draws a filled rounded rectangle
 func (c *Card) DrawRoundedRect(x, y, w, h, radius int, col color.Color) {
 	// Draw main rectangle (without corners)
-	for dy := radius; dy < h-radius; dy++ {
-		for dx := 0; dx < w; dx++ {
-			c.img.Set(x+dx, y+dy, col)
+	for dy := range h - 2*radius {
+		for dx := range w {
+			c.img.Set(x+dx, y+radius+dy, col)
 		}
 	}
 	// Draw top and bottom strips (without corners)
-	for dy := 0; dy < radius; dy++ {
-		for dx := radius; dx < w-radius; dx++ {
-			c.img.Set(x+dx, y+dy, col)
-			c.img.Set(x+dx, y+h-1-dy, col)
+	for dy := range radius {
+		for dx := range w - 2*radius {
+			c.img.Set(x+radius+dx, y+dy, col)
+			c.img.Set(x+radius+dx, y+h-1-dy, col)
 		}
 	}
 	// Draw rounded corners
-	for dy := 0; dy < radius; dy++ {
-		for dx := 0; dx < radius; dx++ {
+	for dy := range radius {
+		for dx := range radius {
 			// Check if point is within circle
 			cx := radius - dx - 1
 			cy := radius - dy - 1
···
 	centerX := radius
 	centerY := radius
 
-	for y := 0; y < diameter; y++ {
-		for x := 0; x < diameter; x++ {
+	for y := range diameter {
+		for x := range diameter {
 			dx := x - centerX
 			dy := y - centerY
 			if dx*dx+dy*dy <= radius*radius {

pkg/appview/readme/fetcher.go

···
+// Package readme provides fetching and rendering of README files from Git hosting platforms.
 package readme
 
 import (

pkg/appview/readme/fetcher_test.go

···
 }
 
 func containsSubstringHelper(s, substr string) bool {
-	for i := 0; i <= len(s)-len(substr); i++ {
+	for i := range len(s) - len(substr) + 1 {
 		if s[i:i+len(substr)] == substr {
 			return true
 		}

pkg/appview/storage/manifest_store.go

···
 	// Notify hold about manifest pull (for stats tracking)
 	// Only count GET requests (actual downloads), not HEAD requests (existence checks)
 	// Check HTTP method from context (distribution library stores it as "http.request.method")
-	if method, ok := ctx.Value("http.request.method").(string); ok && method == "GET" {
+	if method, ok := ctx.Value(HTTPRequestMethod).(string); ok && method == "GET" {
 		// Do this asynchronously to avoid blocking the response
 		if s.ctx.ServiceToken != "" && s.ctx.Handle != "" {
 			go func() {

pkg/appview/storage/profile_test.go

···
 
 	// Make 5 concurrent GetProfile calls
 	var wg sync.WaitGroup
-	for i := 0; i < 5; i++ {
+	for range 5 {
 		wg.Add(1)
 		go func() {
 			defer wg.Done()

pkg/appview/storage/proxy_blob_store.go

···
 }
 
 // abortMultipartUpload aborts a multipart upload via XRPC abortUpload endpoint
-func (p *ProxyBlobStore) abortMultipartUpload(ctx context.Context, digest, uploadID string) error {
+func (p *ProxyBlobStore) abortMultipartUpload(ctx context.Context, uploadID string) error {
 	reqBody := map[string]any{
 		"uploadId": uploadID,
 	}
···
 		slog.Debug("Flushing final buffer", "component", "proxy_blob_store/Commit", "bytes", w.buffer.Len())
 		if err := w.flushPart(); err != nil {
 			// Try to abort multipart on error
-			tempDigest := fmt.Sprintf("uploads/temp-%s", w.id)
-			w.store.abortMultipartUpload(ctx, tempDigest, w.uploadID)
+			if err := w.store.abortMultipartUpload(ctx, w.uploadID); err != nil {
+				slog.Warn("Failed to abort multipart upload", "component", "proxy_blob_store/Cancel", "error", err)
+				// Continue anyway - we want to mark upload as cancelled
+			}
 			return distribution.Descriptor{}, fmt.Errorf("failed to flush final part: %w", err)
 		}
 	}
···
 	globalUploadsMu.Unlock()
 
 	// Abort multipart upload
-	tempDigest := fmt.Sprintf("uploads/temp-%s", w.id)
-	if err := w.store.abortMultipartUpload(ctx, tempDigest, w.uploadID); err != nil {
+	if err := w.store.abortMultipartUpload(ctx, w.uploadID); err != nil {
 		slog.Warn("Failed to abort multipart upload", "component", "proxy_blob_store/Cancel", "error", err)
 		// Continue anyway - we want to mark upload as cancelled
 	}

pkg/appview/storage/proxy_blob_store_test.go

···
 		{
 			name: "abortMultipartUpload",
 			testFunc: func(store *ProxyBlobStore) error {
-				return store.abortMultipartUpload(context.Background(), "sha256:test", "upload-123")
+				return store.abortMultipartUpload(context.Background(), "upload-123")
 			},
 			expectedPath: atproto.HoldAbortUpload,
 		},

pkg/appview/storage/routing_repository.go

···
 	"github.com/distribution/distribution/v3"
 )
 
+type contextKey string
+
+const HTTPRequestMethod contextKey = "http.request.method"
+
 // RoutingRepository routes manifests to ATProto and blobs to external hold service
 // The registry (AppView) is stateless and NEVER stores blobs locally
 // NOTE: A fresh instance is created per-request (see middleware/registry.go)
···
 	// Push operations use the discovery-based hold DID from user's profile/default
 	// This allows users to change their default hold and have new pushes go there
 	isPull := false
-	if method, ok := ctx.Value("http.request.method").(string); ok {
+	if method, ok := ctx.Value(HTTPRequestMethod).(string); ok {
 		isPull = method == "GET" || method == "HEAD"
 	}
 

pkg/appview/storage/routing_repository_test.go

···
 		}
 		repo := NewRoutingRepository(nil, ctx)
 
-		pullCtx := context.WithValue(context.Background(), "http.request.method", method)
+		pullCtx := context.WithValue(context.Background(), HTTPRequestMethod, method)
 		blobStore := repo.Blobs(pullCtx)
 
 		assert.NotNil(t, blobStore)
···
 			repo := NewRoutingRepository(nil, ctx)
 
 			// Create context with push method
-			pushCtx := context.WithValue(context.Background(), "http.request.method", tc.method)
+			pushCtx := context.WithValue(context.Background(), HTTPRequestMethod, tc.method)
 			blobStore := repo.Blobs(pushCtx)
 
 			assert.NotNil(t, blobStore)
···
 	wg.Wait()
 
 	// Verify all stores are non-nil (due to race conditions, they may not all be the same instance)
-	for i := 0; i < numGoroutines; i++ {
+	for i := range numGoroutines {
 		assert.NotNil(t, manifestStores[i], "manifest store should not be nil")
 	}
 
···
 	wg.Wait()
 
 	// Verify all stores are non-nil (due to race conditions, they may not all be the same instance)
-	for i := 0; i < numGoroutines; i++ {
+	for i := range numGoroutines {
 		assert.NotNil(t, blobStores[i], "blob store should not be nil")
 	}
 
···
 	repo := NewRoutingRepository(nil, ctx)
 
 	// For pull (GET), database should take priority
-	pullCtx := context.WithValue(context.Background(), "http.request.method", "GET")
+	pullCtx := context.WithValue(context.Background(), HTTPRequestMethod, "GET")
 	blobStore := repo.Blobs(pullCtx)
 
 	assert.NotNil(t, blobStore)

pkg/atproto/directory_test.go

···
 		instances := make(chan any, numGoroutines)
 
 		// Launch many goroutines concurrently accessing GetDirectory
-		for i := 0; i < numGoroutines; i++ {
+		for range numGoroutines {
 			go func() {
 				defer wg.Done()
 				dir := GetDirectory()
···
 	t.Run("multiple calls in sequence", func(t *testing.T) {
 		// Get directory multiple times in sequence
 		dirs := make([]any, 10)
-		for i := 0; i < 10; i++ {
+		for i := range 10 {
 			dirs[i] = GetDirectory()
 		}
 

pkg/auth/cache.go

···
-// Package token provides service token caching and management for AppView.
+// Package auth provides service token caching and management for AppView.
 // Service tokens are JWTs issued by a user's PDS to authorize AppView to
 // act on their behalf when communicating with hold services. Tokens are
 // cached with automatic expiry parsing and 10-second safety margins.

pkg/auth/hold_remote_test.go

···
 	"atcr.io/pkg/atproto"
 )
 
-func TestNewRemoteHoldAuthorizer(t *testing.T) {
-	// Test with nil database (should still work)
-	authorizer := NewRemoteHoldAuthorizer(nil, false)
-	if authorizer == nil {
-		t.Fatal("Expected non-nil authorizer")
-	}
-
-	// Verify it implements the HoldAuthorizer interface
-	var _ HoldAuthorizer = authorizer
-}
-
 func TestNewRemoteHoldAuthorizer_TestMode(t *testing.T) {
 	// Test with testMode enabled
 	authorizer := NewRemoteHoldAuthorizer(nil, true)

pkg/auth/oauth/client_test.go

···
 package oauth
 
 import (
+	"testing"
+
 	"github.com/bluesky-social/indigo/atproto/auth/oauth"
-	"testing"
 )
 
 func TestNewClientApp(t *testing.T) {

pkg/auth/oauth/server_test.go

···
 
 import (
 	"context"
-	"github.com/bluesky-social/indigo/atproto/auth/oauth"
 	"net/http"
 	"net/http/httptest"
 	"strings"
 	"testing"
 	"time"
+
+	"github.com/bluesky-social/indigo/atproto/auth/oauth"
 )
 
 func TestNewServer(t *testing.T) {

pkg/auth/token/claims.go

···
+// Package token provides JWT claims and token handling for registry authentication.
 package token
 
 import (

pkg/hold/pds/events_test.go

···
 	testCID, _ := cid.Decode("bafyreib2rxk3rkhh5ylyxj3x3gathxt3s32qvwj2lf3qg4kmzr6b7teqke")
 
 	// Broadcast 5 events (exceeds maxHistory of 3)
-	for i := 0; i < 5; i++ {
+	for range 5 {
 		event := &RepoEvent{
 			NewRoot:   testCID,
 			Rev:       "test-rev",

pkg/hold/pds/layer_test.go

···
 	}
 
 	// Create layer records for owner
-	for i := 0; i < 3; i++ {
+	for i := range 3 {
 		record := atproto.NewLayerRecord(
 			"sha256:owner"+string(rune('a'+i)),
 			1024*1024*100, // 100MB each
···
 	addCrewMemberWithBerth(t, pds, crewDID, "writer", []string{"blob:write"}, "")
 
 	// Create layer records for crew member
-	for i := 0; i < 2; i++ {
+	for i := range 2 {
 		record := atproto.NewLayerRecord(
 			"sha256:crew"+string(rune('a'+i)),
 			1024*1024*50, // 50MB each
···
 
 	// Create multiple layer records with same digest (should be deduplicated)
 	digest := "sha256:duplicatelayer"
-	for i := 0; i < 5; i++ {
+	for i := range 5 {
 		record := atproto.NewLayerRecord(
 			digest,
 			1024*1024*100, // 100MB

pkg/hold/pds/records_test.go

···
 	defer ri.Close()
 
 	// Add 5 records
-	for i := 0; i < 5; i++ {
+	for i := range 5 {
 		rkey := string(rune('a' + i))
 		if err := ri.IndexRecord("io.atcr.hold.crew", rkey, "cid-"+rkey); err != nil {
 			t.Fatalf("IndexRecord() error = %v", err)
···
 	defer ri.Close()
 
 	// Add records to two collections
-	for i := 0; i < 3; i++ {
+	for i := range 3 {
 		ri.IndexRecord("io.atcr.hold.crew", string(rune('a'+i)), "cid1")
 	}
-	for i := 0; i < 5; i++ {
+	for i := range 5 {
 		ri.IndexRecord("io.atcr.hold.captain", string(rune('a'+i)), "cid2")
 	}
 

pkg/hold/pds/server.go

···
 	// Uses same database as carstore for simplicity
 	var recordsIndex *RecordsIndex
 	if dbPath != ":memory:" {
-		recordsDbPath := dbPath + "/db.sqlite3"
-		recordsIndex, err = NewRecordsIndex(recordsDbPath)
+		recordsIndex, err = NewRecordsIndex(dbPath + "/db.sqlite3")
 		if err != nil {
 			return nil, fmt.Errorf("failed to create records index: %w", err)
 		}

pkg/hold/pds/status_test.go

···
 }
 
 func findSubstring(s, substr string) bool {
-	for i := 0; i <= len(s)-len(substr); i++ {
+	for i := range len(s) - len(substr) + 1 {
 		if s[i:i+len(substr)] == substr {
 			return true
 		}

pkg/hold/pds/xrpc_test.go

···
 
 	// Note: Bootstrap already added 1 crew member
 	// Add 4 more for a total of 5
-	for i := 0; i < 4; i++ {
+	for i := range 4 {
 		_, err := handler.pds.AddCrewMember(ctx, "did:plc:member"+string(rune(i+'0')), "reader", []string{"blob:read"})
 		if err != nil {
 			t.Fatalf("Failed to add crew member: %v", err)
···
 	holdDID := "did:web:hold.example.com"
 
 	// Add crew members
-	for i := 0; i < 3; i++ {
+	for i := range 3 {
 		_, err := handler.pds.AddCrewMember(ctx, "did:plc:member"+string(rune(i+'0')), "reader", []string{"blob:read"})
 		if err != nil {
 			t.Fatalf("Failed to add crew member: %v", err)
···
 	holdDID := "did:web:hold.example.com"
 
 	// Add 4 more crew members for total of 5
-	for i := 0; i < 4; i++ {
+	for i := range 4 {
 		_, err := handler.pds.AddCrewMember(ctx, fmt.Sprintf("did:plc:member%d", i), "reader", []string{"blob:read"})
 		if err != nil {
 			t.Fatalf("Failed to add crew member: %v", err)
···
 	holdDID := "did:web:hold.example.com"
 
 	// Add crew members
-	for i := 0; i < 3; i++ {
+	for i := range 3 {
 		_, err := handler.pds.AddCrewMember(ctx, fmt.Sprintf("did:plc:member%d", i), "reader", []string{"blob:read"})
 		if err != nil {
 			t.Fatalf("Failed to add crew member: %v", err)

pkg/hold/quota/config.go

···
+// Package quota provides storage quota management for hold services.
 package quota
 
 import (

pkg/logging/logger_test.go

···
 	defer slog.SetDefault(originalLogger)
 
 	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
+	for range b.N {
 		InitLogger("info")
 	}
 }
···
 	defer slog.SetDefault(originalLogger)
 
 	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
+	for range b.N {
 		cleanup := SetupTestLogger()
 		cleanup()
 	}