Review Checklist

Lookup sheet for Lesson 36. Run the tools first; spend attention on what they cannot see.

Before a human looks

gofmt -l .
go vet ./...
go test -race ./...
staticcheck ./...      # or golangci-lint
govulncheck ./...

If a comment could have been made by a tool, a tool should have made it.

[ ] Every error handled or returned, never both.
[ ] %w where a caller may match; %v where the cause is an implementation detail.
[ ] No _ discarding an error without a reason.
[ ] No function returns a concrete error type.
[ ] Third-party errors translated at the boundary.
[ ] No return nil, nil where the caller will dereference.

[ ] Every go statement: what stops it, who waits, where does its error go?
[ ] Every long-lived loop has case <-ctx.Done().
[ ] Every WithCancel/WithTimeout has defer cancel().
[ ] defer for release comes immediately after acquire, and is not inside a loop.
[ ] Close on a writer has its error checked.
[ ] Shutdown gets a fresh context, not the cancelled one.

[ ] What is reachable from more than one goroutine, and what guards it?
[ ] No lock held across I/O.
[ ] No map shared without synchronisation.
[ ] No method locks and then calls another method that locks.
[ ] Nothing containing a mutex is copied: value receivers, struct assignment, range copies.

The list a reviewer has to carry, because nothing else will catch it:

Look for	Why it is wrong	Lesson
value receiver on a type with a mutex or a mutating method	operates on a copy; silent no-op	6
sub-slice returned with spare capacity	caller's `append` overwrites your data	3
concrete error type in a return position	non-nil interface on the success path	12
`defer` inside a loop	resources accumulate until the function returns	10
goroutine with no cancellation case	leak; blocks shutdown	21
interface declared beside its one implementation	abstracts nothing, doubles maintenance	11
missing `rows.Err()` after the loop	a mid-iteration failure looks like a short result	26
missing `defer rows.Close()`	drains the connection pool	26
`err == ErrNotFound`	breaks the day anyone wraps it	9
method added to an exported interface	breaks every implementer you do not control	34
`http.ListenAndServe` in production	no timeouts at all	22
unbounded `go` per item from a request	denial of service the caller triggers	15

Name the consequence and the mechanism, then offer the alternative.

Instead of	Say
"bad naming"	"`store.NewStore` stutters at the call site; `store.New` reads better"
"use a pointer"	"value receiver copies the mutex; `go vet` flags this as `copylocks`"
"too many methods"	"the only consumer uses two, so a two-method interface there would do"
"might leak"	"if the caller returns early these sends block forever, so buffer it or add `ctx.Done()`"
"wrap the error"	"`%v` here breaks `errors.Is` for `ErrNotFound` two layers up"
"not idiomatic"	link the specific rule in Go Code Review Comments

Four weak answers out of five means the answer is a loop.