R6: dependency hygiene

[can3p]

Closes the R6 wave: no unmaintained or duplicate dependencies left from its list, and a lint rule that keeps them out. Closes #232.

Changes

• D1 alecthomas/assert → testify. The last 9 test files move to require, which stops at the first failure like alecthomas did. Assertions are unchanged.
• D2 pkg/errors → stdlib. 12 files move to errors / fmt.Errorf("...: %w"), with every message unchanged.
  • SetLoginAttempt now checks session.Save() before wrapping it: Wrap(nil) was nil, fmt.Errorf never is.
  • Capitalized messages carry //nolint:staticcheck // ST1005.
• D3 sessions via gogo's sessions/pgstore (Add sessions/pgstore: a gin session store in PostgreSQL gogo#8, gogo v0.3.0). This replaces antonlindstrom/pgstore.
  • Same rows and cookies, so nobody is logged out.
  • Migration: the table is copied with gogo's pgstore-migrations command (IF NOT EXISTS; production only records it), and a test fails when a gogo upgrade ships another migration.
  • Cleanup: web serve now deletes expired sessions every --session-cleanup-interval (default 1h); pgstore's cleanup never ran.
  • Session age: the hard-coded 30 days is now --session-max-age (default 720h).
  • Binary: lib/pq is gone from it.
• D4.
  • go mod tidy; pkg/errors stays indirect because gogo still requires it.
  • depguard refuses alecthomas/assert, pkg/errors and antonlindstrom/pgstore, next to R7's logging rule.
  • plan.txt is removed; its open ideas are RSS output for the Explore page #221–Visibility for RSS subscriptions #227.
• Tooling. The session-start hook clears the stale containerd pid file a container restart leaves, which stopped dockerd from starting.
• Docs and skills.
  • docs/architecture.md, docs/gogo-extraction.md and docs/testing.md are updated.
  • "Planning a wave" covers dropping a dependency that other modules require.
  • wave-run covers task_prompt.py's guessed PKG= paths and lint findings in shared packages.
  • History is in docs/archive/history/r6.md.

Left out: jmoiron/sqlx (#229, after gogo drops it) and goldmark-highlighting/chroma v2 (#228).

Testing

• make check-q passes (51 packages); make cover + make cover-check pass, total 87.3% (floor 84.7%).
• Mutation checks:
  • the header shift (D1);
  • the Wrap(nil) login trap (D2), caught by pkg/forms;
  • the router ignoring --session-max-age (D3);
  • the lint rule rejecting a pkg/errors import (D4).
• make test-ui: everything passes except the three tests docs/testing.md lists as failing only in the sandbox (TestWriting_RenderedPostFeatures, TestWriting_PostVisibility, TestActions_ShareLifecycle); CI's browser job decides those.

Merge note

On deploy, release_command runs the gogo-pgstore migration, which is a no-op on the existing http_sessions table apart from recording itself.

🤖 Generated with Claude Code

https://claude.ai/code/session_01WLdnenF9tokN9o3SLsrZjG

---

Generated by Claude Code