autoresearch iter 22: delete lint suppressions that suppress nothing

24 of the 96 nolint directives were dead: they covered findings that no
longer exist. A stale suppression is not inert — it silently claims any
future finding for that linter in that scope, so a real problem raised
there would vanish without anyone noticing. Explanatory prose was kept as
ordinary comments.

Two directives proved load-bearing under the project gate even though
nolintlint reported them unused, and removing them exposed verified
contextcheck false positives: App.Run does forward a sigCtx derived from
the caller's context to Start, and the migration lock renewal must keep
its own deadline because the task context may already be canceled. Both
were restored, narrowed to the live linter, and given the reason the
originals lacked.

backend/cmd/app.go

@@ -39,8 +39,6 @@ import (
 )
 
 // newWaveletApp creates a core.App wired with Wavelet platform infrastructure, domain plugins, and profile drivers.
-//
-//nolint:contextcheck
 func newWaveletApp(profile core.Profile) *core.App {
 	app := core.NewApp(
 		core.WithProfile(profile),

backend/cmd/banner.go

@@ -2,8 +2,6 @@
 // SPDX-License-Identifier: Apache-2.0
 
 // Package cmd provides CLI command entry points.
-//
-//nolint:unused
 package cmd
 
 import (
@@ -14,7 +12,7 @@ import (
 	"strings"
 )
 
-//nolint:unused // startup banner formatting utilities
+// startup banner formatting utilities
 type startupState struct {
 	mode           string
 	listensForHTTP bool

backend/core/app.go

@@ -303,8 +303,6 @@ func (a *App) RunMigrations() error {
 // 2. Dispatches database migrations via MigrationEngine.
 // 3. Filters and starts drivers matching the active Profile.
 // 4. Emits "app:ready" on the EventBus.
-//
-//nolint:contextcheck
 func (a *App) Start(ctx ...context.Context) error {
 	a.mu.Lock()
 	if a.running {
@@ -386,8 +384,6 @@ func (a *App) Start(ctx ...context.Context) error {
 // 2. Stops all started drivers in LIFO (reverse) order.
 // 3. Disposes the Context (running registered OnDispose callbacks in LIFO order).
 // 4. Emits "app:stopped" on the EventBus.
-//
-//nolint:contextcheck
 func (a *App) Stop(ctx ...context.Context) error {
 	a.mu.Lock()
 	if !a.running {
@@ -448,7 +444,7 @@ func (a *App) Stop(ctx ...context.Context) error {
 // Run starts the application and blocks until an OS signal (SIGINT, SIGTERM) or context cancellation is received,
 // then executes graceful shutdown.
 //
-//nolint:contextcheck
+//nolint:contextcheck // Run forwards a sigCtx derived from the caller's context to Start; the rule cannot follow the variadic parameter
 func (a *App) Run(ctx ...context.Context) error {
 	var parent context.Context
 	switch {
@@ -505,8 +501,6 @@ func (a *App) ExecuteCLI(args ...string) error {
 }
 
 // ExecuteCLIWithContext parses CLI arguments, configures the profile, and runs the application with the given context.
-//
-//nolint:contextcheck
 func (a *App) ExecuteCLIWithContext(ctx context.Context, args ...string) error {
 	cliArgs := args
 	if len(cliArgs) == 0 {

backend/plugins/domain/admin/repository/db.go

@@ -327,7 +327,7 @@ func GetPostgresInfo(ctx context.Context) model.DatabaseInfoResponse {
 
 // OpenSQLiteExportFile opens the active SQLite database file together with its stat info.
 func OpenSQLiteExportFile() (*os.File, os.FileInfo, error) {
-	//nolint:gosec // export db file path is trusted
+	// export db file path is trusted
 	f, err := os.Open(sqliteDatabasePath())
 	if err != nil {
 		return nil, nil, fmt.Errorf("%s: %w", errs.ErrOpenDatabaseFileFailed, err)

backend/plugins/domain/cap/pow/prng.go

@@ -10,7 +10,7 @@ import (
 
 // fnv1a returns the 32-bit FNV-1a hash of a string
 //
-//nolint:mnd // FNV-1a 算法位移常量
+// FNV-1a 算法位移常量
 func fnv1a(str string) uint32 {
 	var hash uint32 = 2166136261
 	for i := 0; i < len(str); i++ {
@@ -22,7 +22,7 @@ func fnv1a(str string) uint32 {
 
 // fnv1aResume resumes FNV-1a hashing from a given state
 //
-//nolint:mnd // FNV-1a 算法位移常量
+// FNV-1a 算法位移常量
 func fnv1aResume(state uint32, str string) uint32 {
 	h := state
 	for i := 0; i < len(str); i++ {
@@ -33,15 +33,13 @@ func fnv1aResume(state uint32, str string) uint32 {
 }
 
 // hashShift computes FNV-1a mix additions
-//
-//nolint:mnd
 func hashShift(h uint32) uint32 {
 	return (h << 1) + (h << 4) + (h << 7) + (h << 8) + (h << 24)
 }
 
 // prngFromHash generates a hex string of specified length using an initial hash state
 //
-//nolint:mnd // xorshift 算法位移常量
+// xorshift 算法位移常量
 func prngFromHash(initialHash uint32, length int) string {
 	state := initialHash
 	var result strings.Builder

backend/plugins/domain/message_gateway/push/custom.go

@@ -68,7 +68,7 @@ func (p *CustomPusher) Send(ctx context.Context, cfg Config, _ string, body map[
 	bodyBytes, _ := io.ReadAll(io.LimitReader(resp.Body, maxCustomResponseBytes))
 	upstreamResp := strings.TrimSpace(string(bodyBytes))
 
-	if resp.StatusCode < 200 || resp.StatusCode >= 300 { //nolint:mnd
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
 		return upstreamResp, fmt.Errorf("custom: http status %s", resp.Status)
 	}
 

backend/plugins/domain/message_gateway/push/telegram.go

@@ -34,8 +34,6 @@ type telegramErrorResponse struct {
 }
 
 // Send 执行 Telegram 消息发送
-//
-//nolint:cyclop
 func (p *TelegramPusher) Send(ctx context.Context, cfg Config, target string, body map[string]any, template string, _ map[string]any) (string, error) {
 	if cfg.Secret == "" {
 		return "", errors.New("telegram: Bot Token (Secret) is required")

backend/plugins/domain/message_gateway/service/push.go

@@ -899,8 +899,6 @@ type EventTrigger struct{}
 var DefaultTrigger = &EventTrigger{}
 
 // Trigger receives event metadata and processes the event notification dispatch asynchronously.
-//
-//nolint:contextcheck
 func (t *EventTrigger) Trigger(ctx context.Context, meta model.EventMetadata, body map[string]any) {
 	asyncCtx := context.WithoutCancel(ctx)
 	util.Go(func() {

backend/plugins/domain/upload/handler/routers.go

@@ -55,8 +55,6 @@ type batchDownloadRequest struct {
 // @Failure 401 {object} response.Any "未登录"
 // @Failure 500 {object} response.Any "内部错误"
 // @Router /api/v1/upload [post]
-//
-//nolint:revive
 func UploadFile(c *gin.Context) {
 	c.Header("X-Content-Type-Options", "nosniff")
 	c.Header("Content-Security-Policy", "sandbox")

backend/plugins/domain/upload/task/storage_migration.go

@@ -108,7 +108,6 @@ func (h *MigrationHandler) Execute(ctx context.Context, payload []byte) (*contra
 			_ = cache.Delete(cleanupCtx, lockKey)
 		}()
 
-		//nolint:contextcheck,gosec
 		util.Go(func() {
 			ticker := time.NewTicker(renewalInterval)
 			defer ticker.Stop()
@@ -116,6 +115,7 @@ func (h *MigrationHandler) Execute(ctx context.Context, payload []byte) (*contra
 				select {
 				case <-ticker.C:
 					renewCtx, cancel := context.WithTimeout(context.Background(), cleanupTimeout)
+					//nolint:contextcheck // renewal must carry its own deadline; the task context may already be canceled
 					_ = cache.Set(renewCtx, lockKey, "locked", time.Hour)
 					cancel()
 				case <-stopRenewal:

backend/plugins/domain/user/errs.go

@@ -20,7 +20,7 @@ const (
 	errPasswordEncryptFailed = "密码加密失败"
 	//nolint:gosec // error message, not hardcoded credentials
 	errPasswordUpdateFailed = "密码更新失败"
-	//nolint:gosec // error message, not hardcoded credentials
+	// error message, not hardcoded credentials
 	errPasswordEmpty = "password cannot be empty"
 )
 
@@ -35,7 +35,7 @@ const (
 	errAdminCannotDelete    = "管理员账号无法被删除"
 	errCannotDeleteSelf     = "不能删除当前登录用户"
 	errServiceUsernameEmpty = "user: username cannot be empty"
-	//nolint:gosec // error message, not hardcoded credentials
+	// error message, not hardcoded credentials
 	errServiceOldPasswordIncorrect = "user: incorrect old password"
 	//nolint:gosec // error message, not hardcoded credentials
 	errServicePasswordTooShort = "密码长度至少为 8 位"

backend/plugins/drivers/driver_asynq_worker/handler.go

@@ -7,7 +7,7 @@ import "context"
 
 // TaskResult 任务执行结果
 //
-//nolint:revive // TaskResult 保留完整名称以避免与通用 Result 混淆
+// TaskResult 保留完整名称以避免与通用 Result 混淆
 type TaskResult struct {
 	Message string // 结果摘要，如 "共清理 120 个文件，耗时 3.2s"
 	Detail  string // 可选的详细结果 JSON
@@ -26,7 +26,7 @@ type PayloadValidator interface {
 // 开发者只需实现 Execute 方法编写业务逻辑，在方法内通过 driver_asynq_worker.AppendLog(ctx, ...) 追加执行日志。
 // 任务的创建、状态更新、错误记录、重试计数全部由框架透明处理。
 //
-//nolint:revive // TaskHandler 保留完整名称以避免与通用 Handler 混淆
+// TaskHandler 保留完整名称以避免与通用 Handler 混淆
 type TaskHandler interface {
 	// Execute 执行任务业务逻辑
 	//   - ctx: 已注入 Trace Span 和 taskID 的上下文

backend/plugins/drivers/driver_asynq_worker/meta.go

@@ -10,7 +10,7 @@ import (
 
 // TaskParam 任务参数定义
 //
-//nolint:revive // TaskParam 保留完整名称以避免与通用 Param 混淆
+// TaskParam 保留完整名称以避免与通用 Param 混淆
 type TaskParam struct {
 	Name        string `json:"name"`        // 参数键名
 	Label       string `json:"label"`       // 显示名称
@@ -22,7 +22,7 @@ type TaskParam struct {
 
 // TaskMeta 任务元数据
 //
-//nolint:revive // TaskMeta 保留完整名称以避免与通用 Meta 混淆
+// TaskMeta 保留完整名称以避免与通用 Meta 混淆
 type TaskMeta struct {
 	Type         string      `json:"type"`
 	AsynqTask    string      `json:"asynq_task"`

backend/plugins/drivers/driver_asynq_worker/types.go

@@ -12,8 +12,6 @@ import (
 )
 
 // TaskExecutionStatus 任务执行状态
-//
-//nolint:revive
 type TaskExecutionStatus string
 
 // Task execution status constants.
@@ -25,8 +23,6 @@ const (
 )
 
 // TaskExecution 任务执行记录
-//
-//nolint:revive
 type TaskExecution struct {
 	ID           uint64              `json:"id,string" gorm:"primaryKey"`
 	TaskID       string              `json:"task_id" gorm:"size:128;uniqueIndex;not null"`
@@ -92,8 +88,6 @@ func GetLatestTaskExecutionByTaskType(ctx context.Context, taskType string) (*Ta
 }
 
 // TaskExecutionCleanupStats describes task execution log cleanup results.
-//
-//nolint:revive
 type TaskExecutionCleanupStats struct {
 	HighFrequencyDeleted int64
 	LowFrequencyDeleted  int64