diff --git a/.auto/log.jsonl b/.auto/log.jsonl
index 74e2d47c..b1df4fd6 100644
--- a/.auto/log.jsonl
+++ b/.auto/log.jsonl
@@ -5,3 +5,4 @@
 {"run":4,"commit":"699e95f","metric":56,"metrics":{"golint_canonicalheader":8,"golint_errname":1,"golint_errorlint":12,"golint_forcetypeassert":3,"golint_gosec":0,"golint_intrange":3,"golint_modernize":5,"golint_nilnil":3,"golint_perfsprint":0,"golint_prealloc":3,"golint_recvcheck":7,"golint_usestdlibvars":3,"golint_wastedassign":7,"golint_total":55,"eslint_problems":1,"eslint_errors":0,"eslint_warnings":1,"tsc_errors":0,"measure_s":47},"status":"keep","description":"perfsprint 18→0：strconv.Itoa/FormatInt/FormatUint/FormatBool 替代 fmt.Sprintf、无动词 fmt.Errorf→errors.New、纯字符串拼接。全部语义等价（已核对 diff）。修正 fixer 遗留的 import 问题（引入 goimports 统一整理）。","timestamp":1786872884713,"segment":0,"confidence":3.0588235294117645,"asi":{"hypothesis":"perfsprint --fix：%d→strconv.Itoa/FormatInt、%t→FormatBool、%s+const→拼接、无动词 Errorf→errors.New","insight":"重要：golangci-lint v2 fixer 的 import 管理不可靠（删除/添加 import 会出错，53 个文件中 5 处报 undefined）+ 遗留未用 import。已安装 goimports（repo make format 本来就需要它），对改动文件统一 goimports -w 修复。后续只要用 --fix 就要记得跑 goimports -w","next_action_hint":"剩余大头：errorlint(12)、canonicalheader(8)（usestdlibvars 同类）、recvcheck(7)、wastedassign(7)。errorlint 需手工逐处判断；先做 canonicalheader+usestdlibvars（自动可修复但要核对）"}}
 {"run":5,"commit":"d0414b4","metric":45,"metrics":{"golint_canonicalheader":0,"golint_errname":1,"golint_errorlint":12,"golint_forcetypeassert":3,"golint_gosec":0,"golint_intrange":3,"golint_modernize":5,"golint_nilnil":3,"golint_perfsprint":0,"golint_prealloc":3,"golint_recvcheck":7,"golint_usestdlibvars":0,"golint_wastedassign":7,"golint_total":44,"eslint_problems":1,"eslint_errors":0,"eslint_warnings":1,"tsc_errors":0,"measure_s":38},"status":"keep","description":"canonicalheader 8→0 + usestdlibvars 3→0：header key 改为 Go 规范大小写（wire 格式本就如此，纯代码修正）、HTTP 方法常量替代字符串字面量。","timestamp":1786873098921,"segment":0,"confidence":2.1724137931034484,"asi":{"hypothesis":"canonicalheader+usestdlibvars --fix：Header key 统一规范大小写、GET/OPTIONS 等方法常量","insight":"GitHub header 修正前后的 wire 格式完全一致（Go 在 Set 时本来就会规范化），纯代码层面修正，零行为风险；下次遇到同类 100% 安全","next_action_hint":"剩余：errorlint(12) 需逐处人工判断（其中 3 处 err != context.Canceled、2 处 %v wrap、若干 ==/类型断言）；recvcheck(7) 是模型接收者一致性；wastedassign(7) 删 TODO 赋值；intrange(3)/modernize(5)/nilnil(3)/prealloc(3)/forcetypeassert(3)/errname(1)/eslint(1)"}}
 {"run":6,"commit":"ce28f63","metric":38,"metrics":{"golint_canonicalheader":0,"golint_errname":1,"golint_errorlint":12,"golint_forcetypeassert":3,"golint_gosec":0,"golint_intrange":3,"golint_modernize":5,"golint_nilnil":3,"golint_perfsprint":0,"golint_prealloc":3,"golint_recvcheck":7,"golint_usestdlibvars":0,"golint_wastedassign":0,"golint_total":37,"eslint_problems":1,"eslint_errors":0,"eslint_warnings":1,"tsc_errors":0,"measure_s":47},"status":"keep","description":"wastedassign 7→0：删除 7 处死初始化（snapshot.go 三连、push 三件套 content、format.go numStr），改 var 声明，零行为变化。","timestamp":1786873485497,"segment":0,"confidence":2.978723404255319,"asi":{"hypothesis":"wastedassign 7→0：删除 7 处死初始化（x := \"\" 后所有分支都赋值）改为 var 声明","insight":"replace 工具会归一化 replacement_text 的前导空白；对需要缩进的编辑直接用 sed/gofmt -w 处理更稳","next_action_hint":"剩余：errorlint(12)、recvcheck(7)、modernize(5)、intrange(3)、nilnil(3)、prealloc(3)、forcetypeassert(3)、errname(1)、eslint(1)"}}
+{"run":7,"commit":"288b74d","metric":33,"metrics":{"golint_canonicalheader":0,"golint_errname":1,"golint_errorlint":12,"golint_forcetypeassert":3,"golint_gosec":0,"golint_intrange":0,"golint_modernize":3,"golint_nilnil":3,"golint_perfsprint":0,"golint_prealloc":3,"golint_recvcheck":7,"golint_usestdlibvars":0,"golint_wastedassign":0,"golint_total":32,"eslint_problems":1,"eslint_errors":0,"eslint_warnings":1,"tsc_errors":0,"measure_s":45},"status":"keep","description":"intrange 3→0 + modernize 5→3：for i:=0;i<len/N;i++ → range len/N（8 处）；time.Time 字段 omitempty→omitzero（wire 输出一致）；SplitSeq；min() 简化。刻意保留 lark.go omitzero（会改变 wire 行为）。","timestamp":1786873629461,"segment":0,"confidence":4.166666666666667,"asi":{"hypothesis":"intrange(3) + modernize 剩余（2 个 time.Time omitempty→omitzero + SplitSeq + min）","insight":"lark.go larkTextContent omitempty→omitzero 会改变 wire（普通 struct 无 IsZero，当前恒序列化，改后零值省略）—— 判定为行为变化，故意保留；time.Time 字段 omitempty/omitzero 输出一致，可安全替换","next_action_hint":"剩余：errorlint(12) 大头（3 处 != context.Canceled 需确认 runner 是否 wrap；%v→%w 2 处；若干 ==err / 类型断言）；recvcheck(7)；forcetypeassert(3)；nilnil(3)；prealloc(3)；errname(1)；eslint(1)"}}
diff --git a/cmd/agent/main.go b/cmd/agent/main.go
index 73bc2a2f..666551c3 100644
--- a/cmd/agent/main.go
+++ b/cmd/agent/main.go
@@ -3,6 +3,7 @@ package main
 
 import (
 	"context"
+	"errors"
 	"flag"
 	"log/slog"
 	"os"
@@ -132,7 +133,7 @@ func main() {
 	go geoIPUpdater.Run(ctx)
 	slog.Info("agent process started")
 
-	if err = runner.Run(ctx); err != nil && err != context.Canceled {
+	if err = runner.Run(ctx); err != nil && !errors.Is(err, context.Canceled) {
 		slog.Error("agent process exited with error", "error", err)
 		stop()
 		os.Exit(1)
diff --git a/cmd/flared/main.go b/cmd/flared/main.go
index 679d1132..65404e73 100644
--- a/cmd/flared/main.go
+++ b/cmd/flared/main.go
@@ -3,6 +3,7 @@ package main
 
 import (
 	"context"
+	"errors"
 	"flag"
 	"log/slog"
 	"os"
@@ -63,7 +64,7 @@ func main() {
 
 	slog.Info("flared process started")
 
-	if err := runner.Run(ctx); err != nil && err != context.Canceled {
+	if err := runner.Run(ctx); err != nil && !errors.Is(err, context.Canceled) {
 		slog.Error("flared process exited with error", "error", err)
 		stop()
 		os.Exit(1)
diff --git a/cmd/relay/main.go b/cmd/relay/main.go
index 083aba2a..577df27e 100644
--- a/cmd/relay/main.go
+++ b/cmd/relay/main.go
@@ -3,6 +3,7 @@ package main
 
 import (
 	"context"
+	"errors"
 	"flag"
 	"log/slog"
 	"os"
@@ -63,7 +64,7 @@ func main() {
 
 	slog.Info("relay process started")
 
-	if err := runner.Run(ctx); err != nil && err != context.Canceled {
+	if err := runner.Run(ctx); err != nil && !errors.Is(err, context.Canceled) {
 		slog.Error("relay process exited with error", "error", err)
 		stop()
 		os.Exit(1)
diff --git a/internal/apps/agent/nginx/manager.go b/internal/apps/agent/nginx/manager.go
index 82c08d34..71a1335c 100644
--- a/internal/apps/agent/nginx/manager.go
+++ b/internal/apps/agent/nginx/manager.go
@@ -134,7 +134,7 @@ func (e *PathExecutor) Reload(ctx context.Context) error {
 			slog.Warn("openresty reload reported runtime is not running, starting binary", "path", e.Path)
 			startOutput, startErr := e.Runner.Run(ctx, e.Path, "-c", e.ConfigPath)
 			if startErr != nil {
-				return fmt.Errorf("openresty reload failed: %w: %s; start failed: %v: %s", err, string(output), startErr, string(startOutput))
+				return fmt.Errorf("openresty reload failed: %w: %s; start failed: %w: %s", err, string(output), startErr, string(startOutput))
 			}
 			return nil
 		}
@@ -355,14 +355,14 @@ func (m *Manager) activateConfig(ctx context.Context) error {
 func (m *Manager) rollbackAfterFailedApply(ctx context.Context, backup *backupState, applyErr error) ApplyOutcome {
 	slog.Warn("openresty apply failed, restoring previous config", "error", applyErr)
 	if err := m.restore(backup); err != nil {
-		return fatalApplyOutcome(fmt.Errorf("restore openresty backup failed after apply error %v: %w", applyErr, err))
+		return fatalApplyOutcome(fmt.Errorf("restore openresty backup failed after apply error %w: %w", applyErr, err))
 	}
 	if err := m.activateConfig(ctx); err != nil {
 		if backup != nil && backup.MainExisted {
-			return fatalApplyOutcome(fmt.Errorf("apply failed: %v; rollback recovery failed: %w", applyErr, err))
+			return fatalApplyOutcome(fmt.Errorf("apply failed: %w; rollback recovery failed: %w", applyErr, err))
 		}
 		if fallbackErr := m.EnsureSafeFallbackRuntime(ctx, fmt.Sprintf("apply failed: %v; rollback recovery failed: %v", applyErr, err)); fallbackErr != nil {
-			return fatalApplyOutcome(fmt.Errorf("apply failed: %v; rollback recovery failed: %w; fallback recovery failed: %v", applyErr, err, fallbackErr))
+			return fatalApplyOutcome(fmt.Errorf("apply failed: %w; rollback recovery failed: %w; fallback recovery failed: %w", applyErr, err, fallbackErr))
 		}
 		message := fmt.Sprintf("apply failed, but fallback runtime started: %v; rollback recovery failed: %v", applyErr, err)
 		slog.Warn("openresty apply recovered with safe default fallback", "message", message)
diff --git a/internal/apps/agent/sync/service.go b/internal/apps/agent/sync/service.go
index 47b04d13..ee5d4ce1 100644
--- a/internal/apps/agent/sync/service.go
+++ b/internal/apps/agent/sync/service.go
@@ -426,7 +426,7 @@ func (s *Service) ensureRuntimeForCurrentConfig(ctx context.Context, mode string
 				snapshot.OpenrestyMessage = "safe default fallback runtime started"
 				return nil
 			}
-			err = fmt.Errorf("%v; fallback recovery failed: %w", err, fallbackErr)
+			err = fmt.Errorf("%w; fallback recovery failed: %w", err, fallbackErr)
 		}
 		snapshot.OpenrestyStatus = protocol.OpenrestyStatusUnhealthy
 		snapshot.OpenrestyMessage = err.Error()
diff --git a/internal/apps/edge/updater/restart_unix.go b/internal/apps/edge/updater/restart_unix.go
index 4855c309..fb54c195 100644
--- a/internal/apps/edge/updater/restart_unix.go
+++ b/internal/apps/edge/updater/restart_unix.go
@@ -20,7 +20,7 @@ func replaceAndRestart(execPath string, tmpPath string) error {
 		renameErr := err
 		if err := os.Remove(tmpPath); err != nil && !os.IsNotExist(err) {
 			slog.Error("remove tmp binary failed", "path", tmpPath, "error", err)
-			return fmt.Errorf("backup current binary: %w; remove tmp binary: %v", renameErr, err)
+			return fmt.Errorf("backup current binary: %w; remove tmp binary: %w", renameErr, err)
 		}
 		return fmt.Errorf("backup current binary: %w", renameErr)
 	}
@@ -28,7 +28,7 @@ func replaceAndRestart(execPath string, tmpPath string) error {
 		replaceErr := err
 		if err := os.Rename(backupPath, execPath); err != nil {
 			slog.Error("restore backup binary failed", "path", backupPath, "error", err)
-			return fmt.Errorf("replace binary: %w; restore backup binary: %v", replaceErr, err)
+			return fmt.Errorf("replace binary: %w; restore backup binary: %w", replaceErr, err)
 		}
 		return fmt.Errorf("replace binary: %w", replaceErr)
 	}
diff --git a/internal/apps/openflare/node/helpers.go b/internal/apps/openflare/node/helpers.go
index 8c1b567e..387bddf6 100644
--- a/internal/apps/openflare/node/helpers.go
+++ b/internal/apps/openflare/node/helpers.go
@@ -322,7 +322,7 @@ func fetchLatestStableGitHubRelease(ctx context.Context, repo string) (*githubRe
 	}
 	resp, err := releaseHTTPClient.Do(req)
 	if err != nil {
-		return nil, fmt.Errorf("获取最新版本失败: %v", err)
+		return nil, fmt.Errorf("获取最新版本失败: %w", err)
 	}
 	defer func() { _ = resp.Body.Close() }()
 	if resp.StatusCode != http.StatusOK {
@@ -339,7 +339,7 @@ func fetchLatestPreviewGitHubRelease(ctx context.Context, repo string) (*githubR
 	}
 	resp, err := releaseHTTPClient.Do(req)
 	if err != nil {
-		return nil, fmt.Errorf("获取 preview 版本失败: %v", err)
+		return nil, fmt.Errorf("获取 preview 版本失败: %w", err)
 	}
 	defer func() { _ = resp.Body.Close() }()
 	if resp.StatusCode != http.StatusOK {
@@ -371,7 +371,7 @@ func fetchGitHubReleaseByTag(ctx context.Context, repo string, tag string) (*git
 	}
 	resp, err := releaseHTTPClient.Do(req)
 	if err != nil {
-		return nil, fmt.Errorf("获取指定版本失败: %v", err)
+		return nil, fmt.Errorf("获取指定版本失败: %w", err)
 	}
 	defer func() { _ = resp.Body.Close() }()
 	if resp.StatusCode == http.StatusNotFound {
diff --git a/internal/apps/openflare/node/logics.go b/internal/apps/openflare/node/logics.go
index 1d4edbf1..eb11f5f8 100644
--- a/internal/apps/openflare/node/logics.go
+++ b/internal/apps/openflare/node/logics.go
@@ -361,7 +361,7 @@ func RequestForceSync(ctx context.Context, id uint) (*View, error) {
 		if errors.Is(err, gorm.ErrRecordNotFound) {
 			return nil, fmt.Errorf("无法获取当前激活的配置版本：%s", errNoActiveConfigVersion)
 		}
-		return nil, fmt.Errorf("无法获取当前激活的配置版本：%v", err)
+		return nil, fmt.Errorf("无法获取当前激活的配置版本：%w", err)
 	}
 	if !ofws.SendForceSyncConfig(node.NodeID, forceSyncConfigPayload{
 		Version:  activeConfig.Version,
diff --git a/internal/apps/openflare/option/openresty_validators.go b/internal/apps/openflare/option/openresty_validators.go
index 493db502..d4b703ff 100644
--- a/internal/apps/openflare/option/openresty_validators.go
+++ b/internal/apps/openflare/option/openresty_validators.go
@@ -239,7 +239,7 @@ func validateOriginErrorPageStatusCodes(key, trimmed string) error {
 	}
 	codes, err := openrestyrender.ExpandStatusCodeTags(tags)
 	if err != nil {
-		return fmt.Errorf("%s: %v", key, err)
+		return fmt.Errorf("%s: %w", key, err)
 	}
 	if len(codes) == 0 {
 		return fmt.Errorf("%s 展开后不能为空", key)
diff --git a/internal/apps/openflare/pages/rebind.go b/internal/apps/openflare/pages/rebind.go
index 4c5d9306..01897bfe 100644
--- a/internal/apps/openflare/pages/rebind.go
+++ b/internal/apps/openflare/pages/rebind.go
@@ -246,5 +246,5 @@ func putJSON(route map[string]json.RawMessage, key string, value any) error {
 }
 
 func errorsIsNotFound(err error) bool {
-	return err != nil && (err == gorm.ErrRecordNotFound || strings.Contains(strings.ToLower(err.Error()), "record not found"))
+	return err != nil && (errors.Is(err, gorm.ErrRecordNotFound) || strings.Contains(strings.ToLower(err.Error()), "record not found"))
 }
diff --git a/internal/apps/openflare/tls/acme/client.go b/internal/apps/openflare/tls/acme/client.go
index 7b1487e4..98e62e9f 100644
--- a/internal/apps/openflare/tls/acme/client.go
+++ b/internal/apps/openflare/tls/acme/client.go
@@ -173,7 +173,7 @@ func SetupDNSProvider(client *lego.Client, dnsType, dnsAuth string, dns1, dns2 s
 	case "cloudflare":
 		var creds map[string]string
 		if err := json.Unmarshal([]byte(dnsAuth), &creds); err != nil {
-			return fmt.Errorf("failed to parse cloudflare credentials: %v", err)
+			return fmt.Errorf("failed to parse cloudflare credentials: %w", err)
 		}
 
 		config := cloudflare.NewDefaultConfig()
diff --git a/internal/apps/upload/filesrv/file_server.go b/internal/apps/upload/filesrv/file_server.go
index 04d0ac34..f0a42cbc 100644
--- a/internal/apps/upload/filesrv/file_server.go
+++ b/internal/apps/upload/filesrv/file_server.go
@@ -68,7 +68,8 @@ func ServeFileByID(c *gin.Context) {
 			response.AbortNotFound(c, "文件记录未找到")
 			return
 		}
-		if _, ok := err.(*strconv.NumError); ok {
+		var numErr *strconv.NumError
+		if errors.As(err, &numErr) {
 			response.AbortBadRequest(c, "无效的上传ID")
 			return
 		}
diff --git a/internal/apps/upload/handler/file_management.go b/internal/apps/upload/handler/file_management.go
index 335f3202..5ca3b7dd 100644
--- a/internal/apps/upload/handler/file_management.go
+++ b/internal/apps/upload/handler/file_management.go
@@ -301,7 +301,7 @@ func UpdateMyFile(c *gin.Context) {
 			response.AbortNotFound(c, "文件记录未找到")
 			return
 		}
-		if err == ingest.ErrForbidden {
+		if errors.Is(err, ingest.ErrForbidden) {
 			response.AbortForbidden(c, "无权操作")
 			return
 		}
diff --git a/internal/apps/upload/handler/routers.go b/internal/apps/upload/handler/routers.go
index 72d503b2..0fafb443 100644
--- a/internal/apps/upload/handler/routers.go
+++ b/internal/apps/upload/handler/routers.go
@@ -178,7 +178,8 @@ func DownloadFile(c *gin.Context) {
 			response.AbortNotFound(c, "文件记录未找到")
 			return
 		}
-		if _, ok := err.(*strconv.NumError); ok {
+		var numErr *strconv.NumError
+		if errors.As(err, &numErr) {
 			response.AbortBadRequest(c, shared.ErrInvalidFileID)
 			return
 		}
diff --git a/internal/infra/config/config.go b/internal/infra/config/config.go
index dadc416f..be3a1cae 100644
--- a/internal/infra/config/config.go
+++ b/internal/infra/config/config.go
@@ -7,6 +7,7 @@ package config
 
 import (
 	"encoding/json"
+	"errors"
 	"flag"
 	"log"
 	"os"
@@ -69,7 +70,8 @@ func init() {
 
 	// 读取配置文件（可选：找不到文件时使用空默认值 + 环境变量）
 	if err := viper.ReadInConfig(); err != nil {
-		if _, ok := err.(viper.ConfigFileNotFoundError); !ok {
+		var notFoundErr viper.ConfigFileNotFoundError
+		if !errors.As(err, &notFoundErr) {
 			// 文件存在但读取/解析失败
 			if _, statErr := os.Stat(configPath); statErr == nil { //nolint:gosec // configPath is loaded from CONFIG_PATH environment variable
 				log.Fatalf("[Config] read config failed: %v\n", err)
diff --git a/pkg/cap/store.go b/pkg/cap/store.go
index 4e7b61f0..fe503320 100644
--- a/pkg/cap/store.go
+++ b/pkg/cap/store.go
@@ -5,6 +5,7 @@ package cap
 
 import (
 	"context"
+	"errors"
 	"sync"
 	"time"
 
@@ -149,7 +150,7 @@ func NewRedisStore(client redis.UniversalClient) *RedisStore {
 // Get 从 RedisStore 获取指定 key 的值
 func (s *RedisStore) Get(ctx context.Context, key string) (string, bool, error) {
 	val, err := s.client.Get(ctx, key).Result()
-	if err == redis.Nil {
+	if errors.Is(err, redis.Nil) {
 		return "", false, nil
 	}
 	if err != nil {
@@ -176,7 +177,7 @@ func (s *RedisStore) SetNX(ctx context.Context, key string, val string, ttl time
 // GetAndDelete wraps Redis GETDEL (available since Redis 6.2).
 func (s *RedisStore) GetAndDelete(ctx context.Context, key string) (string, bool, error) {
 	val, err := s.client.GetDel(ctx, key).Result()
-	if err == redis.Nil {
+	if errors.Is(err, redis.Nil) {
 		return "", false, nil
 	}
 	if err != nil {
diff --git a/pkg/pagesarchive/extract.go b/pkg/pagesarchive/extract.go
index d88f9963..2da82c41 100644
--- a/pkg/pagesarchive/extract.go
+++ b/pkg/pagesarchive/extract.go
@@ -177,7 +177,7 @@ func extractTarReader(
 	measured := &measuredArchive{files: make([]measuredFile, 0)}
 	for {
 		header, err := tarReader.Next()
-		if err == io.EOF {
+		if errors.Is(err, io.EOF) {
 			break
 		}
 		if err != nil {
diff --git a/pkg/pagesarchive/inspect.go b/pkg/pagesarchive/inspect.go
index ac9f442d..6020e47a 100644
--- a/pkg/pagesarchive/inspect.go
+++ b/pkg/pagesarchive/inspect.go
@@ -154,7 +154,7 @@ func scanTarReader(tarReader *tar.Reader, limits Limits, enforceLimits bool) (*m
 	measured := &measuredArchive{files: make([]measuredFile, 0)}
 	for {
 		header, err := tarReader.Next()
-		if err == io.EOF {
+		if errors.Is(err, io.EOF) {
 			break
 		}
 		if err != nil {