diff --git a/internal/agent/loop_compact.go b/internal/agent/loop_compact.go
index 87c652c4..c6c31753 100644
--- a/internal/agent/loop_compact.go
+++ b/internal/agent/loop_compact.go
@@ -137,10 +137,7 @@ func (l *Loop) compactMessagesInPlace(ctx context.Context, messages []providers.
 // clamped to [1024, 8192]. Floor keeps short summaries coherent; cap prevents
 // runaway output billing on pathological inputs.
 func dynamicSummaryMax(inputTokens int) int {
-	out := max(inputTokens/25, 1024)
-	if out > 8192 {
-		out = 8192
-	}
+	out := min(max(inputTokens/25, 1024), 8192)
 	return out
 }
 
diff --git a/internal/agent/png_metadata_test.go b/internal/agent/png_metadata_test.go
index 0d45977b..c8d10fcb 100644
--- a/internal/agent/png_metadata_test.go
+++ b/internal/agent/png_metadata_test.go
@@ -121,9 +121,9 @@ func parsePNGTextChunks(data []byte) map[string]string {
 		chunkData := data[pos+8 : pos+8+chunkLen]
 		if chunkType == "tEXt" {
 			// tEXt format: keyword\0text
-			if nul := bytes.IndexByte(chunkData, 0x00); nul >= 0 {
-				keyword := string(chunkData[:nul])
-				text := string(chunkData[nul+1:])
+			if before, after, ok := bytes.Cut(chunkData, []byte{0x00}); ok {
+				keyword := string(before)
+				text := string(after)
 				result[keyword] = text
 			}
 		}
diff --git a/internal/providers/chatgpt_oauth_router_image_test.go b/internal/providers/chatgpt_oauth_router_image_test.go
index d1b28d3a..bdb3b056 100644
--- a/internal/providers/chatgpt_oauth_router_image_test.go
+++ b/internal/providers/chatgpt_oauth_router_image_test.go
@@ -206,7 +206,7 @@ func TestChatGPTOAuthRouter_IntrospectionDoesNotAdvanceCounter(t *testing.T) {
 	router := NewChatGPTOAuthRouter(tenantID, registry, "acct-a", "round_robin", []string{"acct-b", "acct-c"})
 
 	// Call introspection 20 times — counter must stay at 0.
-	for i := 0; i < 20; i++ {
+	for range 20 {
 		_ = router.Name()
 		_ = router.DefaultModel()
 		_ = router.HasAvailableProviders()
@@ -441,7 +441,7 @@ func TestChatGPTOAuthRouter_ChatAndImageConcurrent_CountersIndependent(t *testin
 	const perModality = 90 // divisible by 3 so even distribution is achievable
 	var wg sync.WaitGroup
 	wg.Add(perModality * 2)
-	for i := 0; i < perModality; i++ {
+	for range perModality {
 		go func() {
 			defer wg.Done()
 			if _, err := router.Chat(context.Background(), ChatRequest{
@@ -473,7 +473,7 @@ func TestChatGPTOAuthRouter_ChatAndImageConcurrent_CountersIndependent(t *testin
 	// member is starved and none is over-served beyond a small tolerance.
 	expected := int64(perModality / 3)
 	const slack = int64(5) // generous — any real bug produces much larger skew
-	for i := 0; i < 3; i++ {
+	for i := range 3 {
 		if chatHits[i] < expected-slack || chatHits[i] > expected+slack {
 			t.Errorf("chat server %d hits = %d, want ~%d (±%d); all=%v",
 				i, chatHits[i], expected, slack, chatHits)
diff --git a/internal/providers/codex_native_image.go b/internal/providers/codex_native_image.go
index ec5fb507..f978729e 100644
--- a/internal/providers/codex_native_image.go
+++ b/internal/providers/codex_native_image.go
@@ -139,7 +139,7 @@ func parseNativeImageSSE(data []byte) (*NativeImageResult, error) {
 	var outputFormat string
 	var usage *Usage
 
-	for _, line := range bytes.Split(data, []byte("\n")) {
+	for line := range bytes.SplitSeq(data, []byte("\n")) {
 		if !bytes.HasPrefix(line, []byte("data: ")) {
 			continue
 		}
diff --git a/internal/store/pg/sessions_list.go b/internal/store/pg/sessions_list.go
index 4a8b2302..3285d2ca 100644
--- a/internal/store/pg/sessions_list.go
+++ b/internal/store/pg/sessions_list.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"maps"
 	"strconv"
 	"strings"
 	"time"
@@ -205,9 +206,7 @@ func (s *PGSessionStore) Save(ctx context.Context, key string) error {
 	// Deep-copy Metadata under RLock so subsequent mutation does not race with
 	// concurrent readers holding data.Metadata via GetSessionMetadata.
 	metaCopy := make(map[string]string, len(data.Metadata)+2)
-	for k, v := range data.Metadata {
-		metaCopy[k] = v
-	}
+	maps.Copy(metaCopy, data.Metadata)
 	snapshot.Metadata = metaCopy
 	s.mu.RUnlock()
 
diff --git a/internal/tools/media_provider_chain_pool_test.go b/internal/tools/media_provider_chain_pool_test.go
index 8ef01c18..48a0f511 100644
--- a/internal/tools/media_provider_chain_pool_test.go
+++ b/internal/tools/media_provider_chain_pool_test.go
@@ -203,7 +203,7 @@ func TestParamsInjection(t *testing.T) {
 	}}
 
 	// capturedNative captures whatever _native_provider lands in callParams.
-	var capturedNative interface{}
+	var capturedNative any
 	fn := func(fnCtx context.Context, cp credentialProvider, providerName, model string, params map[string]any) ([]byte, *providers.Usage, error) {
 		capturedNative = params["_native_provider"]
 		return []byte("ok"), nil, nil
diff --git a/internal/tools/shell.go b/internal/tools/shell.go
index 5611108b..13cafa7f 100644
--- a/internal/tools/shell.go
+++ b/internal/tools/shell.go
@@ -6,6 +6,7 @@ import (
 	"errors"
 	"fmt"
 	"log/slog"
+	"maps"
 	"os"
 	"os/exec"
 	"regexp"
@@ -59,9 +60,7 @@ func (t *ExecTool) SetGlobalShellDenyGroups(groups map[string]bool) {
 		return
 	}
 	cp := make(map[string]bool, len(groups))
-	for k, v := range groups {
-		cp[k] = v
-	}
+	maps.Copy(cp, groups)
 	t.globalDenyGroups = cp
 }
 
@@ -77,12 +76,9 @@ func (t *ExecTool) effectiveDenyGroups(ctx context.Context) map[string]bool {
 		return t.globalDenyGroups
 	}
 	merged := make(map[string]bool, len(t.globalDenyGroups)+len(agent))
-	for k, v := range t.globalDenyGroups {
-		merged[k] = v
-	}
-	for k, v := range agent {
-		merged[k] = v // agent wins per-key
-	}
+	maps.Copy(merged, t.globalDenyGroups)
+	// agent wins per-key
+	maps.Copy(merged, agent)
 	return merged
 }