engine: green the CI baseline (HAL-116) — race fix, dep + toolchain bump, lint

- toc_builder: fix the data race in verifyTitlesConcurrent — each goroutine
  now accumulates a local Usage and folds it under the mutex, instead of
  sharing &localUse across errgroup goroutines (concurrent usage.add writes).
- deps: golang.org/x/net v0.53.0 -> v0.55.0 (GO-2026-5030); add toolchain
  go1.25.11 + pin CI go-version (stdlib GO-2026-5039 / GO-2026-5037).
- lint: //lint:ignore U1000 the four staged helpers with reasons; drop the
  genuinely-unused idempotencyCache.mu field.

These CI failures were pre-existing (surfaced on PR #35, not caused by the
rename). go build + staticcheck green locally; -race verified in CI.

Closes HAL-116.

Author: hallelx2

.github/workflows/ci.yml

@@ -17,7 +17,7 @@ jobs:
       fail-fast: false
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
-        go: ["1.25"]
+        go: ["1.25.11"]
     steps:
       - uses: actions/checkout@v6
 
@@ -70,7 +70,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v6
         with:
-          go-version: "1.25"
+          go-version: "1.25.11"
           cache: true
 
       # MinIO can't run as a `services:` container because GitHub Actions
@@ -115,7 +115,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v6
         with:
-          go-version: "1.25"
+          go-version: "1.25.11"
           cache: true
 
       - name: staticcheck
@@ -137,7 +137,7 @@ jobs:
       - uses: actions/checkout@v6
       - uses: actions/setup-go@v6
         with:
-          go-version: "1.25"
+          go-version: "1.25.11"
           cache: true
       - name: Install govulncheck
         run: go install golang.org/x/vuln/cmd/govulncheck@latest

go.mod

@@ -1,6 +1,7 @@
 module github.com/hallelx2/vectorless-engine
 
 go 1.25.0
+toolchain go1.25.11
 
 require (
 	cloud.google.com/go/storage v1.62.1
@@ -26,7 +27,7 @@ require (
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.20.0
 	go.opentelemetry.io/otel/sdk v1.43.0
 	go.opentelemetry.io/otel/trace v1.43.0
-	golang.org/x/net v0.53.0
+	golang.org/x/net v0.55.0
 	golang.org/x/sync v0.20.0
 	google.golang.org/grpc v1.80.0
 	google.golang.org/protobuf v1.36.11
@@ -118,11 +119,11 @@ require (
 	go.opentelemetry.io/otel/sdk/metric v1.43.0 // indirect
 	go.opentelemetry.io/proto/otlp v1.7.1 // indirect
 	go.uber.org/goleak v1.3.0 // indirect
-	golang.org/x/crypto v0.50.0 // indirect
+	golang.org/x/crypto v0.51.0 // indirect
 	golang.org/x/image v0.39.0 // indirect
 	golang.org/x/oauth2 v0.36.0 // indirect
-	golang.org/x/sys v0.43.0 // indirect
-	golang.org/x/text v0.36.0 // indirect
+	golang.org/x/sys v0.45.0 // indirect
+	golang.org/x/text v0.37.0 // indirect
 	golang.org/x/time v0.15.0 // indirect
 	google.golang.org/api v0.274.0 // indirect
 	google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7 // indirect

go.sum

@@ -257,20 +257,20 @@ go.opentelemetry.io/proto/otlp v1.7.1 h1:gTOMpGDb0WTBOP8JaO72iL3auEZhVmAQg4ipjOV
 go.opentelemetry.io/proto/otlp v1.7.1/go.mod h1:b2rVh6rfI/s2pHWNlB7ILJcRALpcNDzKhACevjI+ZnE=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
-golang.org/x/crypto v0.50.0 h1:zO47/JPrL6vsNkINmLoo/PH1gcxpls50DNogFvB5ZGI=
-golang.org/x/crypto v0.50.0/go.mod h1:3muZ7vA7PBCE6xgPX7nkzzjiUq87kRItoJQM1Yo8S+Q=
+golang.org/x/crypto v0.51.0 h1:IBPXwPfKxY7cWQZ38ZCIRPI50YLeevDLlLnyC5wRGTI=
+golang.org/x/crypto v0.51.0/go.mod h1:8AdwkbraGNABw2kOX6YFPs3WM22XqI4EXEd8g+x7Oc8=
 golang.org/x/image v0.39.0 h1:skVYidAEVKgn8lZ602XO75asgXBgLj9G/FE3RbuPFww=
 golang.org/x/image v0.39.0/go.mod h1:sIbmppfU+xFLPIG0FoVUTvyBMmgng1/XAMhQ2ft0hpA=
-golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA=
-golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs=
+golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=
+golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=
 golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
 golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
 golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
 golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=
-golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=
-golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=
+golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
+golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
+golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
 golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
 golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
 gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=

internal/api/treewalk.go

@@ -478,6 +478,8 @@ func eventToTraceMap(ev retrieval.TreeWalkEvent) map[string]any {
 // the in-response trace_token against the canonical input set —
 // kept here rather than exported from the retrieval package so
 // the API layer owns its own input wiring.
+//
+//lint:ignore U1000 trace-token verification helper (staged for response-integrity checks)
 func treeWalkTraceTokenFromCitations(docID tree.DocumentID, model string, ranges [][2]int) string {
 	strs := make([]string, 0, len(ranges))
 	for _, r := range ranges {

internal/middleware/cors.go

@@ -88,6 +88,8 @@ func CORS(cfg CORSConfig) func(http.Handler) http.Handler {
 // originMatches is a helper that checks if an origin matches any of the
 // patterns in the allowed list. It supports exact matches only; for
 // wildcard sub-domain patterns extend this function.
+//
+//lint:ignore U1000 CORS matcher (staged for wildcard-origin support)
 func originMatches(origin string, patterns []string) bool {
 	for _, p := range patterns {
 		if strings.EqualFold(origin, p) {

internal/middleware/idempotency.go

@@ -31,8 +31,7 @@ type cachedResponse struct {
 
 // idempotencyCache is a thread-safe TTL map backed by sync.Map.
 type idempotencyCache struct {
-	mu      sync.Mutex // guards reap; reads/writes use sync.Map
-	entries sync.Map   // key -> *cachedResponse
+	entries sync.Map // key -> *cachedResponse
 }
 
 // get returns the cached response if it exists and has not expired.

pkg/ingest/ingest.go

@@ -299,6 +299,8 @@ func completeWithTimeout(ctx context.Context, client llmgate.Client, req llmgate
 // stop retrying immediately on a timeout: re-issuing a call that just hung
 // would only multiply the wall-time cost (N retries × the timeout) without
 // changing the outcome, so a timeout is terminal, not retryable.
+//
+//lint:ignore U1000 timeout classifier (staged for retry decisions, HAL-73)
 func isTimeout(err error) bool {
 	return errors.Is(err, context.DeadlineExceeded) || errors.Is(err, context.Canceled)
 }

pkg/ingest/toc_builder.go

@@ -370,7 +370,18 @@ func (b *TOCBuilder) verifyTitlesConcurrent(ctx context.Context, nodes []tree.TO
 			case <-gctx.Done():
 				return nil
 			}
-			startsHere, err := b.runVerifyTitleAtPageStart(gctx, n.Title, pageText, &localUse)
+			// Accumulate this call's usage into a goroutine-local Usage,
+			// then fold it into the shared total under the lock — passing
+			// &localUse directly would race (concurrent usage.add writes).
+			var u Usage
+			startsHere, err := b.runVerifyTitleAtPageStart(gctx, n.Title, pageText, &u)
+			mu.Lock()
+			localUse.InputTokens += u.InputTokens
+			localUse.OutputTokens += u.OutputTokens
+			localUse.TotalTokens += u.TotalTokens
+			localUse.CostUSD += u.CostUSD
+			localUse.LLMCalls += u.LLMCalls
+			mu.Unlock()
 			if err != nil {
 				// Transport / stub LLM — treat as "not verified" but
 				// don't clear the page; the LLM never weighed in.

pkg/parser/pdf.go

@@ -1429,6 +1429,8 @@ func hasRepeatedAdjacentChars(s string) bool {
 // isEncryptedPDFError reports whether the given error from
 // ledongthuc/pdf indicates the document is encrypted. The library
 // has no proper error type for this, so we match on the message.
+//
+//lint:ignore U1000 encrypted-PDF detector (staged for OCR/encrypted support, HAL-112)
 func isEncryptedPDFError(err error) bool {
 	if err == nil {
 		return false