diff --git a/.dockerignore b/.dockerignore
index 671d547..da6e8d8 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -17,7 +17,17 @@
 # stage that compiles runs `git describe --tags --always` on .git, which
 # does not need .git/config; that file can hold a credential, such as a
 # password in a remote URL or the token the CI checkout step stores there.
-.git/config
+# Each submodule keeps a config with the same exposure in its git directory
+# under .git/modules/, nested again for a submodule's own submodules, or in
+# its own .git directory when it keeps one.
+# KNOWN GAP: a submodule whose name has a `config` segment (`config`,
+# `deploy/config`, `config/lib`) loses its whole git directory, because
+# `**/.git/modules/**/config` also matches that segment's directory
+# under .git/modules/. Go's version stamping then fails the build;
+# nothing leaks. Name such a submodule without that segment:
+# `git submodule add --name`.
+**/.git/config
+**/.git/modules/**/config
 
 # Agent scratch: one full checkout of the repo per in-flight agent.
 # Anchored because it occurs once where agents run at the repo root.
@@ -41,7 +51,9 @@
 **/[iI][dD]_[rR][sS][aA]
 **/[iI][dD]_[dD][sS][aA]
 **/[iI][dD]_[eE][cC][dD][sS][aA]
+**/[iI][dD]_[eE][cC][dD][sS][aA]_[sS][kK]
 **/[iI][dD]_[eE][dD]25519
+**/[iI][dD]_[eE][dD]25519_[sS][kK]
 
 # Dependencies: restored inside the image, never copied in.
 **/node_modules
@@ -62,5 +74,8 @@
 # This repo's own host-built binary (make build).
 /bin/mfer
 
-# The protoc script/bootstrap unpacks for script/generate.
+# The tools script/bootstrap installs for script/gofumpt and
+# script/generate.
+/bin/gofumpt
 /bin/protoc
+/bin/protoc-gen-go
diff --git a/.editorconfig b/.editorconfig
index 2fe0ce0..92ec261 100644
--- a/.editorconfig
+++ b/.editorconfig
@@ -10,3 +10,6 @@ insert_final_newline = true
 
 [Makefile]
 indent_style = tab
+
+[*.go]
+indent_style = tab
diff --git a/.gitea/workflows/check.yml b/.gitea/workflows/check.yml
index f600f2c..ee73864 100644
--- a/.gitea/workflows/check.yml
+++ b/.gitea/workflows/check.yml
@@ -4,6 +4,6 @@ jobs:
     check:
         runs-on: ubuntu-latest
         steps:
-            # actions/checkout v4.2.2, 2026-03-16
+            # actions/checkout v4.2.2, 2026-02-22
             - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
             - run: script/cibuild
diff --git a/.gitignore b/.gitignore
index 9683e83..167f046 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,29 +1,63 @@
-/bin/mfer
-/bin/protoc/
-/tmp
-/node_modules/
-
-# Generated manifest files
-/index.mf
-
-# Secrets
-.env
-.env.*
-*.key
-*.pem
-
-# OS files
+# OS
 .DS_Store
 Thumbs.db
 
-# Editor files
+# Editors
 *.swp
 *.swo
 *~
+*.bak
 .idea/
 .vscode/
+*.sublime-*
 
-# Go build artifacts
+# Agent scratch (worktrees of this repo, created and destroyed by
+# in-flight tooling). Unanchored: .gitignore patterns already match at
+# every depth, so no prefix is wanted here. This is not a .dockerignore
+# entry and must not be given a `**/` prefix on the way into one.
+.claude/
+
+# Node
+node_modules/
+
+# Secrets. Unanchored like every entry above, so each matches at every
+# depth. Matching is case-sensitive on Linux, so names use character
+# ranges rather than a lowercase form that misses `Server.Key`.
+
+# Environment files. `*.env` covers bare `.env` and the `prod.env`
+# convention. Only the templates `example.env` and `sample.env` are
+# re-included below. A repository that commits any other template adds
+# its own negation after these lines, for example `!.env.example`.
+*.[eE][nN][vV]
+.[eE][nN][vV].*
+.[eE][nN][vV][rR][cC]
+!example.env
+!sample.env
+
+# Private keys and the bundles carrying them.
+*.[pP][eE][mM]
+*.[kK][eE][yY]
+*.[pP]12
+*.[pP][fF][xX]
+[iI][dD]_[rR][sS][aA]
+[iI][dD]_[dD][sS][aA]
+[iI][dD]_[eE][cC][dD][sS][aA]
+[iI][dD]_[eE][cC][dD][sS][aA]_[sS][kK]
+[iI][dD]_[eE][dD]25519
+[iI][dD]_[eE][dD]25519_[sS][kK]
+
+# Go build and test artifacts.
 *.log
 *.out
 *.test
+
+# This repo's own binary (make build), and the tools script/bootstrap
+# installs into bin/.
+/bin/mfer
+/bin/gofumpt
+/bin/protoc/
+/bin/protoc-gen-go
+
+# A manifest generated at the repo root, and local scratch.
+/index.mf
+/tmp
diff --git a/.golangci.yml b/.golangci.yml
index 26b1610..1b73eb9 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -10,14 +10,21 @@ run:
 
 linters:
   default: all
+  enable:
+    # Successor to the deprecated gomodguard. Named explicitly, rather than
+    # left to `default: all`, because it carries the module policy below.
+    - gomodguard_v2
   disable:
     # Genuinely incompatible with project patterns
     - exhaustruct      # Requires all struct fields
-    - depguard         # Dependency allow/block lists
+    - exhaustruct_v5   # Requires all struct fields (successor to exhaustruct)
     - godot            # Requires comments to end with periods
-    - wsl              # Deprecated, replaced by wsl_v5
     - wrapcheck        # Too verbose for internal packages
     - varnamelen       # Short names like db, id are idiomatic Go
+    # Deprecated: the warning is attached to the old name, so it is
+    # silenced by disabling that name, not by enabling the successor.
+    - wsl              # Deprecated, replaced by wsl_v5
+    - gomodguard       # Deprecated, replaced by gomodguard_v2
   settings:
     lll:
       line-length: 88
@@ -28,6 +35,64 @@ linters:
       max-complexity: 15
     dupl:
       threshold: 100
+    depguard:
+      # Test-support code must not be compiled into the shipped binary. A
+      # test-support package exists to hand a test privileges the program
+      # itself must never have, so a file that is not a test must not import
+      # one. Test files, and the files inside a package whose directory name
+      # ends in `test`, are where that code belongs, and are exempt.
+      #
+      # The deny list below is the one part of this file a repository is
+      # expected to extend, and the only part it may. depguard matches an
+      # import path against a list of prefixes, so it cannot be told "any path
+      # whose last segment ends in test"; a repository's own test-support
+      # packages have to be named here one at a time, by full import path,
+      # under a module path that differs from repository to repository. Add
+      # them; change nothing else.
+      rules:
+        test-support:
+          list-mode: lax
+          files:
+            - "$all"
+            - "!$test"
+            - "!**/*test/**"
+          deny:
+            - pkg: net/http/httptest
+              desc: >-
+                Test-support code belongs in test files and in packages whose
+                directory name ends in test, not in the shipped binary.
+    # Only decisions already recorded in the Go package defaults are
+    # listed here. Every entry matches the module path exactly.
+    gomodguard_v2:
+      blocked:
+        - module: github.com/rs/zerolog
+          recommendations:
+            - log/slog
+          reason: "Structured logging is stdlib log/slog."
+        # One entry per pre-fork module path, because the later releases
+        # are separate paths. A prefix match would be shorter but would
+        # also reach github.com/go-redis/redismock, the test double for
+        # the successor these entries recommend.
+        - module: github.com/go-redis/redis
+          recommendations:
+            - github.com/redis/go-redis/v9
+          reason: "Pre-fork module; use the maintained go-redis v9."
+        - module: github.com/go-redis/redis/v7
+          recommendations:
+            - github.com/redis/go-redis/v9
+          reason: "Pre-fork module; use the maintained go-redis v9."
+        - module: github.com/go-redis/redis/v8
+          recommendations:
+            - github.com/redis/go-redis/v9
+          reason: "Pre-fork module; use the maintained go-redis v9."
+        - module: github.com/sergi/go-diff
+          recommendations:
+            - github.com/aymanbagabas/go-udiff
+          reason: "No unified diff output; use go-udiff."
+        - module: github.com/hexops/gotextdiff
+          recommendations:
+            - github.com/aymanbagabas/go-udiff
+          reason: "Unmaintained fork; use go-udiff."
 
 issues:
   max-issues-per-linter: 0
diff --git a/.prettierignore b/.prettierignore
index a6ba261..23d67fc 100644
--- a/.prettierignore
+++ b/.prettierignore
@@ -1,14 +1,2 @@
-# REPO_POLICIES.md is a verbatim copy of an authoritative upstream
-# document (sneak/prompts). Local tooling must never rewrite it: any
-# reformatting is silent drift from the source of truth.
-REPO_POLICIES.md
-
-# User-owned configuration, copied verbatim from upstream. Not matched by
-# the current prettier file set, but listed so widening that set can never
-# start rewriting it.
-.golangci.yml
-
-# Dependencies and build output
 node_modules/
-vendor/
-bin/
+yarn.lock
diff --git a/Dockerfile b/Dockerfile
index 67d3104..413fd55 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,74 +1,62 @@
-# Lint stage — fast feedback on formatting and lint issues
-# golangci/golangci-lint:v2.12.2 (Debian-based), 2026-08-07
-FROM golangci/golangci-lint:v2.12.2@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240 AS lint
-
+# Lint phase. The linter is invoked directly rather than through `make
+# lint` or `script/lint`, which are themselves a docker build and would
+# recurse into a daemon that does not exist in a build step.
+# golangci/golangci-lint:v2.14.0, 2026-09-24
+FROM golangci/golangci-lint@sha256:ad862ba6b3798cbe0fd9fd7408d498fd74fbd2623a92406b2fd3898faf0bf98f AS lint
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download
-
 COPY . .
-
-# Go half of fmt-check only: this image has no node, so no prettier. The
-# markdown half runs in the mdfmt stage below. The image has no gofumpt
-# either; script/gofumpt builds the version bin/tools/go.mod pins.
-RUN script/gofumpt --check
-# The linter directly, not `make lint`: script/lint builds this stage, and
-# there is no docker inside this build.
 RUN golangci-lint run --config .golangci.yml ./...
 
-# Markdown/JSON format stage — prettier needs node, which the Go images
-# do not have. node:22.17.0-bookworm-slim (2026-08-09); ships node
-# 22.17.0 and yarn 1.22.22, the versions .nvmrc and script/bootstrap pin.
-FROM node@sha256:b04ce4ae4e95b522112c2e5c52f781471a5cbc3b594527bcddedee9bc48c03a0 AS mdfmt
-
-WORKDIR /src
-COPY package.json yarn.lock ./
-RUN yarn install --frozen-lockfile
-
-COPY . .
-
-# No make in this image; call the script entrypoint directly.
-RUN script/prettier --check
-
-# Build stage — tests and compilation
+# Test phase. -race needs cgo and so a C compiler, which the Debian Go
+# image ships and the alpine one does not.
 # golang:1.23.12, 2026-03-14
-FROM golang@sha256:60deed95d3888cc5e4d9ff8a10c54e5edc008c6ae3fba6187be6fb592e19e8c0 AS builder
-
-# Force BuildKit to run the lint and mdfmt stages by creating stage dependencies
-COPY --from=lint /src/go.sum /dev/null
-COPY --from=mdfmt /src/go.sum /dev/null
-
+FROM golang@sha256:60deed95d3888cc5e4d9ff8a10c54e5edc008c6ae3fba6187be6fb592e19e8c0 AS test
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download
+COPY . .
+RUN go test -timeout 90s -race -cover ./... || \
+    { echo "--- Rerunning with -v for details ---"; \
+      go test -timeout 90s -race -v ./...; exit 1; }
 
+# Build stage. Nothing is wanted from either phase above; the copies
+# are what make BuildKit build them first, so this stage cannot run
+# unless lint and test passed. The Debian Go image ships git, which the
+# version step below needs.
+# golang:1.23.12, 2026-03-14
+FROM golang@sha256:60deed95d3888cc5e4d9ff8a10c54e5edc008c6ae3fba6187be6fb592e19e8c0 AS builder
+COPY --from=lint /src/go.sum /dev/null
+COPY --from=test /src/go.sum /dev/null
+# A tar-stream context keeps the sender's file owners, which git refuses.
+RUN git config --system --add safe.directory /src
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
 COPY . .
 
-RUN make test
-
-# A build context sent as a tar archive, as upaas sends it, keeps its files'
-# owners, and git refuses to read a checkout owned by another user.
-RUN git config --system --add safe.directory /src
-
-# The revision `mfer version` prints, stamped into main.Gitrev: the VERSION
-# build argument when one is given (script/docker passes one), otherwise
-# `git describe --tags --always` of the .git the build context carries: the
-# tag on a tagged commit, tag-N-gHASH on a commit after one, the short commit
-# when no tag is reachable. git ships in this base image. A context that
-# carries .git and still yields no version fails the build.
+# The revision `mfer version` prints, stamped into main.Gitrev: the
+# VERSION build arg when one is given, otherwise `git describe --tags
+# --always` on the .git in the build context. With .git present, a
+# version that is still empty, dev or unknown fails the build: git is
+# missing or could not read the checkout.
 ARG VERSION
-RUN version="${VERSION:-$(git describe --tags --always)}"; \
-    if [ -e .git ] && { [ -z "$version" ] || [ "$version" = dev ] || \
-        [ "$version" = unknown ]; }; then \
-        echo "no version could be derived although the build context carries .git" >&2; \
-        exit 1; \
+RUN VERSION="${VERSION:-$(git describe --tags --always)}"; \
+    if [ -e .git ]; then \
+        case "$VERSION" in ""|dev|unknown) \
+            echo "version is '$VERSION' although .git is present" >&2; \
+            exit 1 ;; \
+        esac; \
     fi; \
-    cd cmd/mfer && \
-    CGO_ENABLED=0 go build -ldflags "-X main.Gitrev=$version" -o /mfer .
+    CGO_ENABLED=0 go build -trimpath \
+        -ldflags="-s -w -X main.Gitrev=${VERSION}" \
+        -o /mfer ./cmd/mfer/
 
 # Fail unless /mfer is statically linked: scratch has no C library to run it.
 RUN ldd /mfer 2>&1 | grep -q 'not a dynamic executable'
 
+# Runtime stage, and the last one.
 FROM scratch
 # scratch has no CA certificates; fetch needs them to verify HTTPS servers.
 COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
diff --git a/README.md b/README.md
index 8f36782..16e48aa 100644
--- a/README.md
+++ b/README.md
@@ -55,9 +55,9 @@ for a single command's options.
 
 # Build Status
 
-CI runs `script/cibuild`, which builds the Docker image with `--no-cache`, so
-the formatting, lint and test steps in the `Dockerfile` run on every build. The
-`main` branch must always be green.
+CI runs `script/cibuild`, which runs `script/bootstrap` and `script/check`, then
+builds the Docker image with `--no-cache`, so the lint and test phases in the
+`Dockerfile` run on every build. The `main` branch must always be green.
 
 # Entrypoints
 
@@ -68,18 +68,22 @@ development workflow, and the Makefile targets are thin shims that call them. We
 provide:
 
 - `script/bootstrap` — install all dependencies, idempotently: Go and the
-  modules of both `go.mod` and `bin/tools/go.mod`; node (the version `.nvmrc`
-  names, through nvm when there is no node on `PATH`) and yarn, plus the
-  prettier version pinned in `package.json`/`yarn.lock`; and `protoc` 33.4,
-  unpacked into `bin/protoc` from its release archive once the archive matches
-  the sha256 the script holds for this platform. golangci-lint is not installed,
-  it runs only in Docker
+  modules of `go.mod`; node (the version `.nvmrc` names, through nvm when there
+  is no node on `PATH`) and yarn, plus the prettier version pinned in
+  `package.json`/`yarn.lock`; `gofumpt` v0.12.0 and `protoc-gen-go` v1.36.11,
+  installed into `bin/` with `go install`, each pinned to a commit; and `protoc`
+  33.4, unpacked into `bin/protoc` from its release archive once the archive
+  matches the sha256 the script holds for this platform. Each of those three is
+  installed again whenever the one in `bin/` reports another version.
+  golangci-lint is not installed, it runs only in Docker
 - `script/setup` — make a fresh clone ready for development: runs
   `script/bootstrap`, then `script/install-precommit`
 - `script/projectname` — output the project name (`mfer`); used by other scripts
   such as `script/docker`
-- `script/test` — run the test suite (`go test`); one test fails when
-  `mfer/mf.proto` no longer matches the hash `script/generate` recorded
+- `script/test` — run the test suite in Docker: builds only the `test` stage of
+  the `Dockerfile`, whose build runs `go test -race`, uncached so it runs every
+  time; one test fails when `mfer/mf.proto` no longer matches the hash
+  `script/generate` recorded
 - `script/build` (`make build`) — build the `mfer` binary into `bin/mfer`,
   stamped with the revision `mfer version` prints: the output of
   `git describe --tags --always --dirty`, as `script/docker` passes it
@@ -87,23 +91,20 @@ provide:
   `mfer/mf.proto` and record the hash of that `mfer/mf.proto` in
   `mfer/mf.proto.sha256`; the only thing that regenerates the committed
   `mfer/mf.pb.go`. It runs the `protoc` that `script/bootstrap` unpacks into
-  `bin/protoc`, refusing any version but 33.4, and the `protoc-gen-go` that
-  `bin/tools/go.mod` pins, which `go tool` builds from source checked against
-  the hashes in `bin/tools/go.sum`
+  `bin/protoc` and the `protoc-gen-go` it installs into `bin/`, refusing any
+  version of either but the pinned one
 - `script/fuzz` — fuzz the manifest parser for one minute; run by hand
   (`make fuzz`), never by CI, while `script/test` runs its committed seed corpus
   as ordinary tests
 - `script/lint` — run `golangci-lint` in Docker: builds only the `lint` stage of
-  the `Dockerfile` (the Go format check, then the linter), uncached so it runs
-  every time, then removes the image
+  the `Dockerfile`, whose build runs the linter, uncached so it runs every time
 - `script/fmt` — format all code and docs (writes): `script/gofumpt --write` and
   `script/prettier --write`
 - `script/gofumpt` — run `gofumpt` over every Go file in the repository in the
-  given mode, `--write` or `--check`, at the version `bin/tools/go.mod` pins
-  (built on demand by `go tool` from source checked against the hashes in
-  `bin/tools/go.sum`, so nothing installs it); `script/fmt`, `script/fmt-check`
-  and the Docker lint stage all go through it, so they cannot disagree about Go
-  formatting
+  given mode, `--write` or `--check`, with the `bin/gofumpt` that
+  `script/bootstrap` installs, refusing any version but the pinned one;
+  `script/fmt` and `script/fmt-check` both go through it, so they cannot
+  disagree about Go formatting
 - `script/prettier` — run prettier over the repository's canonical file set
   (Markdown and JSON, minus `.prettierignore`) in the given mode, `--write` or
   `--check`, with the prettier version `yarn.lock` pins, run by the node on
@@ -114,8 +115,9 @@ provide:
   `script/gofumpt --check` plus `script/prettier --check`
 - `script/check` — run `script/test`, `script/lint`, and `script/fmt-check`
 - `script/docker` — build the Docker image tagged with the project name
-- `script/cibuild` — CI entrypoint: builds the image with the same command as
-  `script/docker`, uncached, so the checks in the Dockerfile run every time
+- `script/cibuild` — CI entrypoint: runs `script/bootstrap` and `script/check`,
+  then builds the image with the same command as `script/docker`, uncached, so
+  the lint and test phases in the `Dockerfile` run every time
 - `script/precommit` — pre-commit checks: `go mod tidy` verification, then
   `script/check`
 - `script/install-precommit` — install the git pre-commit hook that runs
diff --git a/REPO_POLICIES.md b/REPO_POLICIES.md
index bc2f161..20382d1 100644
--- a/REPO_POLICIES.md
+++ b/REPO_POLICIES.md
@@ -1,6 +1,6 @@
 ---
 title: Repository Policies
-last_modified: 2026-07-06
+last_modified: 2026-10-04
 ---
 
 This document covers repository structure, tooling, and workflow standards. Code
@@ -60,17 +60,28 @@ style conventions are in separate documents:
   prerequisite since nvm requires bash. yarn is then pinned via
   `corepack prepare yarn@<version> --activate`. Never install "latest" or "lts";
   always exact versions. `script/cibuild` runs the CI build: it changes to the
-  repo root and runs `docker build .`; the Gitea workflow calls it. Four further
-  scripts are our own extensions to the standard: `script/check` runs
-  `script/test`, `script/lint`, and `script/fmt-check`; `script/precommit` is
-  what the git pre-commit hook runs, and it calls `script/check`;
-  `script/install-precommit` installs the git pre-commit hook (the `make hooks`
-  target shims to it); and `script/projectname` (literally that filename) simply
-  outputs the project's name. Scripts that need the name call
-  `script/projectname` — e.g. `script/docker` assembles its image tag from it —
-  so those scripts stay byte-identical across all repos. Repo-type-specific
-  pre-commit extras (e.g. `go mod tidy` verification in Go repos) belong in
-  `script/precommit`, not in the hook itself. Model scripts are at
+  repo root, runs `script/bootstrap`, runs `script/check`, and builds the image
+  with the version; the Gitea workflow calls it. **`script/cibuild` runs
+  `script/bootstrap` first**, because the workflow checks out the repo and runs
+  nothing else, while `script/fmt-check` runs the formatter on the host: on a
+  pristine checkout with nothing installed the run dies there, after the
+  containerised gates have passed. **The bootstrap alone is not enough**:
+  `script/bootstrap` installs node and yarn under nvm and leaves neither on the
+  `PATH` of the shell that called it, so a bare `yarn` still exits 127. The host
+  entrypoints that need yarn — `script/fmt` and `script/fmt-check` — therefore
+  source nvm for the pinned node version before invoking it, exactly as
+  `script/bootstrap`'s own install step does. A runner carrying nothing but
+  docker and git then gets through `script/check`. Four further scripts are our
+  own extensions to the standard: `script/check` runs `script/test`,
+  `script/lint` and `script/fmt-check`; `script/precommit` is what the git
+  pre-commit hook runs, and it calls `script/check`; `script/install-precommit`
+  installs the git pre-commit hook (the `make hooks` target shims to it); and
+  `script/projectname` (literally that filename) simply outputs the project's
+  name. Scripts that need the name call `script/projectname` — e.g.
+  `script/docker` assembles its image tag from it — so those scripts stay
+  byte-identical across all repos. Repo-type-specific pre-commit extras (e.g.
+  `go mod tidy` verification in Go repos) belong in `script/precommit`, not in
+  the hook itself. Model scripts are at
   `https://git.eeqj.de/sneak/prompts/raw/branch/main/script/<name>`. The README
   must document the provided scripts in an **Entrypoints** section (see the
   README requirements below).
@@ -89,87 +100,198 @@ style conventions are in separate documents:
   contributor should be able to understand the entire development workflow by
   reading the Makefile.
 
-- Every repo should have a `Dockerfile`. All Dockerfiles must run `make check`
-  as a build step so the build fails if the branch is not green. For non-server
-  repos, the Dockerfile should bring up a development environment and run
-  `make check`. For server repos, `make check` should run as an early build
-  stage before the final image is assembled. Dockerfiles install development
-  prerequisites by running `script/bootstrap` rather than duplicating installs
-  inline; COPY `script/` and the dependency manifests (`package.json` +
-  `yarn.lock`, `go.mod` + `go.sum`, etc.) before running it so the bootstrap
-  layer stays cached until dependencies change.
+- Every repo should have a `Dockerfile`, and it carries the repo's gates: a
+  `lint` phase and a `test` phase, with the final stage depending on both so the
+  image cannot be built unless they pass. For non-server repos the final stage
+  brings up a development environment; for server repos it is the runtime image.
+  The gate phases and the build stage start from their pinned base images and
+  install what those images lack either inline, as the canonical Go `Dockerfile`
+  below does for `git`, or by running `script/bootstrap`, as the `prompts`
+  repo's own `Dockerfile` does for its yarn packages. The development
+  environment stage installs development prerequisites by running
+  `script/bootstrap` rather than duplicating its installs inline. A stage that
+  runs `script/bootstrap` COPYs `script/` and the dependency manifests
+  (`package.json` + `yarn.lock`, `go.mod` + `go.sum`, etc.) before running it.
 
-- **Dockerfiles must use a separate lint stage for fail-fast feedback.** Go
-  repos use a multistage build where linting runs in an independent stage based
-  on the `golangci/golangci-lint` image (pinned by hash). This stage runs
-  `make fmt-check` and `make lint` before the full build begins. The build stage
-  then declares an explicit dependency on the lint stage via
-  `COPY --from=lint /src/go.sum /dev/null`, which forces BuildKit to complete
-  linting before proceeding to compilation and tests. This ensures lint failures
-  surface in seconds rather than minutes, without blocking on dependency
-  download or compilation in the build stage.
+- **Linting and testing run in Docker, as phases of the `Dockerfile`.** There is
+  no separate lint file. `script/lint` and `script/test` each build one phase
+  and nothing else:
 
-    The standard pattern for a Go repo Dockerfile is:
+    ```sh
+    docker build --no-cache --target lint -t "$(script/projectname)-lint" .
+    docker build --no-cache --target test -t "$(script/projectname)-test" .
+    ```
+
+    **A stage that is not the last one in the file is built only when the final
+    stage's chain depends on it, or when `--target` names it.** That is why the
+    two gates are always invoked by name here, and why the final stage carries a
+    `COPY --from=` of a harmless file from each of them: without that edge a
+    plain `docker build .` builds the last stage alone and exits 0 having linted
+    and tested nothing.
+
+    **Every `docker build` in `script/` is tagged**, here and in
+    `script/cibuild` and `script/docker`. An untagged build leaves a dangling
+    image behind on every invocation, on every developer host and every CI
+    runner; a tagged one replaces the previous image.
+
+    Inside a phase the tool is invoked directly — `golangci-lint`, `go test`,
+    `eslint`, `prettier` — never through `make lint` or `script/test`, which are
+    themselves a `docker build` and would recurse into a daemon that does not
+    exist in a build step. Formatting is the exception and stays on the host:
+    `script/fmt` writes the working tree, and `script/fmt-check` is its
+    read-only twin.
+
+    **No lint verdict may come from a host invocation of the linter.** On a
+    shared host golangci-lint reads a result cache keyed on file content rather
+    than location, so a second checkout of the same content is served the first
+    one's findings, and a host-global lock in `$TMPDIR` makes concurrent runs
+    exit non-zero with `parallel golangci-lint is running` — a status a caller
+    cannot tell from real findings. Both have produced wrong verdicts in this
+    org, in both directions. A container has its own cache, its own `TMPDIR` and
+    a digest-pinned binary, so neither is reachable.
+
+- **Any build that runs checks is built with `--no-cache`.** Docker invalidates
+  a `COPY` layer only when the copied content changes, so on an unchanged tree
+  the check `RUN` is served from cache, nothing executes, and the build still
+  exits 0. Every `docker build` in `script/` therefore passes `--no-cache`:
+  `script/lint`, `script/test`, `script/cibuild` and `script/docker` are the
+  four, and there is no fifth — `script/check` runs the two gate phases and
+  `script/fmt-check`, and builds no image of its own. A bare `docker build .` is
+  not evidence that anything ran: a sub-second build reporting success is a
+  cache hit, not a result. Never invalidate by pruning — `docker builder prune`
+  and friends destroy a build cache shared with every other build on the host.
+  When a check is added or changed, prove it works by planting a defect it must
+  catch and watching the run fail on it, then revert the defect. A green run
+  alone shows neither that the check ran nor that it covers what it should.
+
+- **The gate phases are separate stages, and the build stage depends on both.**
+  The lint phase is based on the `golangci/golangci-lint` image (pinned by
+  hash), so lint failures surface in seconds rather than after a full compile,
+  and the test phase is based on the Debian Go image. The canonical Go repo
+  `Dockerfile`:
 
     ```dockerfile
-    # Lint stage — fast feedback on formatting and lint issues
+    # Lint phase
     # golangci/golangci-lint:v2.x.x, YYYY-MM-DD
     FROM golangci/golangci-lint@sha256:... AS lint
     WORKDIR /src
     COPY go.mod go.sum ./
     RUN go mod download
     COPY . .
-    RUN make fmt-check
-    RUN make lint
+    RUN golangci-lint run --config .golangci.yml ./...
 
-    # Build stage
-    # golang:1.x-alpine, YYYY-MM-DD
-    FROM golang@sha256:... AS builder
+    # Test phase. -race needs cgo and so a C compiler, which the Debian Go
+    # image ships and the alpine one does not.
+    # golang:1.x, YYYY-MM-DD
+    FROM golang@sha256:... AS test
     WORKDIR /src
-
-    # Force BuildKit to run the lint stage before proceeding
-    COPY --from=lint /src/go.sum /dev/null
-
     COPY go.mod go.sum ./
     RUN go mod download
     COPY . .
-    RUN make test
+    RUN go test -timeout 90s -race -cover ./... || \
+        { echo "--- Rerunning with -v for details ---"; \
+          go test -timeout 90s -race -v ./...; exit 1; }
 
-    ARG VERSION=dev
-    RUN CGO_ENABLED=0 go build -trimpath \
-        -ldflags="-s -w -X main.Version=${VERSION}" \
-        -o /app ./cmd/app/
+    # Build stage. Nothing is wanted from either phase above; the copies
+    # are what make BuildKit build them first, so this stage cannot run
+    # unless lint and test passed.
+    # golang:1.x-alpine, YYYY-MM-DD
+    FROM golang@sha256:... AS builder
+    COPY --from=lint /src/go.sum /dev/null
+    COPY --from=test /src/go.sum /dev/null
+    RUN apk add --no-cache git
+    # A tar-stream context keeps the sender's file owners, which git refuses.
+    RUN git config --system --add safe.directory /src
+    WORKDIR /src
+    COPY go.mod go.sum ./
+    RUN go mod download
+    COPY . .
 
-    # Runtime stage
+    # The VERSION build arg when one is given, otherwise
+    # `git describe --tags --always` on the .git in the build context. With
+    # .git present, a version that is still empty, dev or unknown fails the
+    # build: git is missing or could not read the checkout.
+    ARG VERSION
+    RUN VERSION="${VERSION:-$(git describe --tags --always)}"; \
+        if [ -e .git ]; then \
+            case "$VERSION" in ""|dev|unknown) \
+                echo "version is '$VERSION' although .git is present" >&2; \
+                exit 1 ;; \
+            esac; \
+        fi; \
+        CGO_ENABLED=0 go build -trimpath \
+            -ldflags="-s -w -X main.Version=${VERSION}" \
+            -o /app ./cmd/app/
+
+    # Runtime stage, and the last one
     FROM alpine@sha256:...
     COPY --from=builder /app /usr/local/bin/app
     ENTRYPOINT ["app"]
     ```
 
     Key points:
-    - The lint stage uses the `golangci/golangci-lint` image directly (it
-      includes both Go and the linter), so there is no need to install the
-      linter separately.
-    - `COPY --from=lint /src/go.sum /dev/null` is a no-op file copy that creates
-      a stage dependency. BuildKit runs stages in parallel by default; without
-      this line, the build stage would not wait for lint to finish and a lint
-      failure might not fail the overall build.
+    - The lint phase uses the `golangci/golangci-lint` image directly (it has
+      both Go and the linter), so nothing needs installing.
+    - `COPY --from=<phase> /src/go.sum /dev/null` is a no-op copy whose only
+      purpose is the ordering edge. BuildKit runs stages in parallel by default,
+      and a stage nothing depends on is not built at all, so without these two
+      lines a red gate would not fail the build.
+    - Keep the runtime stage last, and if you add a stage after it, give it the
+      same two copies. A plain `docker build .` builds the last stage's chain
+      and nothing else.
     - If the project uses `//go:embed` directives that reference build artifacts
-      (e.g. a web frontend compiled in a separate stage), the lint stage must
+      (e.g. a web frontend compiled in a separate stage), the lint phase must
       create placeholder files so the embed directives resolve. Example:
       `RUN mkdir -p web/dist && touch web/dist/index.html web/dist/style.css`.
-      The lint stage should not depend on the actual build output — it exists to
-      fail fast.
-    - If the project requires CGO or system libraries for linting (e.g.
-      `vips-dev`), install them in the lint stage with `apk add`.
-    - The build stage runs `make test` after compilation setup. Tests run in the
-      build stage, not the lint stage, because they may require compiled
-      artifacts or heavier dependencies.
+    - If the project requires CGO or system libraries for linting, install them
+      in the lint phase. The `golangci/golangci-lint` image is Debian-based and
+      has no `apk`, so install with `apt-get` under the Debian package name
+      (`libvips-dev`, where alpine says `vips-dev`), and delete the package
+      lists in the same `RUN`, so the layer does not keep them:
+
+        ```dockerfile
+        RUN apt-get update \
+            && apt-get install -y --no-install-recommends libvips-dev \
+            && rm -rf /var/lib/apt/lists/*
+        ```
+
+    - `.dockerignore` lets `.git` into the build context. It keeps out every git
+      `config` at any depth (`**/.git/config`, `**/.git/modules/**/config`): the
+      repository's own, each submodule's under `.git/modules/`, and that of a
+      submodule keeping its own `.git` directory. `git describe` does not need
+      them, and each can hold a credential: a password in a remote URL, or the
+      token the CI checkout step stores there. A submodule whose name has a
+      `config` segment (`config`, `deploy/config`, `config/lib`) loses its whole
+      git directory to `**/.git/modules/**/config`, and Go's version stamping
+      then fails the build: give it a name without that segment
+      (`git submodule add --name`). The stage that compiles has `git` (the
+      Debian Go image has it; an alpine one needs `apk add --no-cache git`) and
+      takes the version from the `VERSION` build argument when one is given,
+      otherwise from `git describe --tags --always`. That gives the tag on a
+      tagged commit; on a later commit, the tag, the number of commits since it
+      and the short commit (`v1.2.3-4-gabc1234`); and the short commit when no
+      tag is reachable. The stage that compiles also marks its working directory
+      safe for git (`git config --system --add safe.directory /src`): a context
+      sent as a tar stream keeps the sender's file owners, and git refuses a
+      checkout owned by another user, so the version would come out empty.
+      `ARG VERSION` has no default, and the build fails if the context carries
+      `.git` and the version still comes out empty, `dev` or `unknown`. A plain
+      `docker build .` with no build arguments must succeed; a Dockerfile that
+      refuses an empty build argument drops that refusal and keeps the argument.
 
 - Every repo should have a Gitea Actions workflow (`.gitea/workflows/`) that
-  runs `script/cibuild` (which runs `docker build .`) on push. Since the
-  Dockerfile already runs `make check`, a successful build implies all checks
-  pass.
+  runs `script/cibuild` on push, and checks out the repo as its only other step.
+  That script bootstraps, runs the gate phases, and then builds the image, so a
+  successful run means every check passed; a bare `docker build .` does not
+  carry the same guarantee, because its gate phases may come from the cache. The
+  image build is uncached and so runs the gate phases a second time. That is the
+  price of the rule above, and it is worth paying: the image that ships is built
+  from a run of its own gates rather than from a cache entry. A separate
+  workflow limited to `main` by a `branches` list under `on: push` cannot be
+  checked by review: to try a change to it, add the feature branch to that list
+  and push, then remove the branch from the list again before merging. Keep any
+  job in it that publishes behind `if: github.ref_name == 'main'`, so the run
+  from the feature branch publishes nothing.
 
 - Use platform-standard formatters: `black` for Python, `prettier` for
   JS/CSS/Markdown/HTML, `go fmt` for Go. Always use default configuration with
@@ -189,14 +311,21 @@ style conventions are in separate documents:
   module under test to verify it compiles/parses. There is no excuse for
   `make test` to be a no-op.
 
-- `make test` must complete in under 20 seconds. Add a 30-second timeout in the
-  Makefile.
+- `make test` must complete in under 60 seconds. That is the hard cap, and a
+  suite that exceeds it fails. Under 20 seconds is the target. A suite between
+  20 and 60 seconds is still green, but the overage must be filed as an
+  improvement bug against that repo. Add a 90-second timeout to the test
+  invocation (`go test -timeout 90s`). The backstop deliberately sits above the
+  hard cap so that it catches a genuinely hung test rather than a merely slow
+  one.
 
-- **`make test` should use the conditional verbose rerun pattern.** Run tests
-  without `-v` (verbose) first. If tests fail, automatically rerun with `-v` to
-  show full output. This keeps CI logs and `docker build` output clean on
-  success (just package/suite summaries) while providing full diagnostic detail
-  on failure (every test case, every assertion). The general shell pattern:
+- **The test command should use the conditional verbose rerun pattern.** Run
+  tests without `-v` (verbose) first. If tests fail, automatically rerun with
+  `-v` to show full output. This keeps CI logs and `docker build` output clean
+  on success (just package/suite summaries) while providing full diagnostic
+  detail on failure (every test case, every assertion). The command lives in the
+  `test` phase of the `Dockerfile`, since `script/test` builds that phase; the
+  Makefile form below is the same pattern for any repo-local invocation:
 
     ```makefile
     test:
@@ -209,11 +338,26 @@ style conventions are in separate documents:
 
     ```makefile
     test:
-    	@go test -timeout 30s -race -cover ./... || \
+    	@go test -count=1 -timeout 90s -race -cover ./... || \
     		{ echo "--- Rerunning with -v for details ---"; \
-    		  go test -timeout 30s -race -v ./...; exit 1; }
+    		  go test -count=1 -timeout 90s -race -v ./...; exit 1; }
     ```
 
+    `-count=1` is required on both invocations: it defeats Go's test _result_
+    cache, so neither run can report a stored pass in place of running the
+    tests. It leaves the build cache alone, so it costs the runtime of the suite
+    and no recompilation.
+
+    That cache is Go's own, separate from Docker's layer cache. Go stores a
+    passing result in its cache directory (`GOCACHE`), and when the same tests
+    run again on unchanged code it prints that result, marked `(cached)`,
+    without running them. That matters on a developer's machine, where this
+    target runs and the directory lasts from one run to the next. The `test`
+    phase of the `Dockerfile` needs no `-count=1`: its base image holds no
+    result for this repo's tests and nothing before its `go test` step runs a
+    test, so there is nothing to replay. `--no-cache` (above) is what makes that
+    step run on an unchanged tree.
+
     Python example:
 
     ```makefile
@@ -239,10 +383,84 @@ style conventions are in separate documents:
   must be in `.gitignore`. No exceptions.
 
 - `.gitignore` should be comprehensive from the start: OS files (`.DS_Store`),
-  editor files (`.swp`, `*~`), language build artifacts, and `node_modules/`.
-  Fetch the standard `.gitignore` from
-  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitignore` when setting up
-  a new repo.
+  editor files (`.swp`, `*~`), in-repo agent scratch directories (`.claude/`),
+  language build artifacts, and `node_modules/`. Fetch the standard `.gitignore`
+  from `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitignore` when
+  setting up a new repo. These patterns are written to `.gitignore`'s own
+  semantics, in which an unanchored pattern already matches at every depth; they
+  are not a `.dockerignore` and must not be transplanted into one unmodified.
+
+- **`.dockerignore` does not use `.gitignore` semantics, and copying patterns
+  across unmodified leaves secrets in the build context.** Docker matches with
+  `moby/patternmatcher`: `filepath.Match` semantics plus a `**` extension, so
+  `*` does not cross `/` and a pattern without a leading `**/` is anchored at
+  the build-context root. A `.dockerignore` listing `.env`, `*.pem` and `*.key`
+  therefore excludes only the copies at the repository root, while `config/.env`
+  and `certs/server.key` still reach the context and can land in an image layer
+  — which is more dangerous than a short file with no secret patterns at all,
+  because it reads as solved and stops anyone looking. Give every
+  depth-independent pattern the `**/` prefix and leave only genuinely
+  root-anchored entries unprefixed: `.claude`, and the repo's own host-built
+  binary, written `/myapp` and never `**/myapp`, which would also match
+  `cmd/myapp/` and delete the package directory from the context. Matching is
+  case-sensitive, and an ALL-CAPS twin per pattern still misses `Server.Key`, so
+  secret names use character ranges — `**/*.[kK][eE][yY]`, `**/*.[pP][eE][mM]`,
+  and likewise for `.envrc` and the extensionless SSH keys. Where such a pattern
+  also catches something the build needs, re-include it with a negation
+  (`!docs/example.env`); deleting the pattern reopens the exposure for every
+  other file it covers. Fetch the standard `.dockerignore` from
+  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.dockerignore` and extend
+  it with the repo's own artifacts.
+
+- **In-repo agent scratch belongs in both files, written to each file's own
+  semantics.** `.claude/` holds one worktree per in-flight agent — an entire
+  additional checkout of the repo — so under `COPY . .` the build context
+  inflates by a multiple of the repo and another session's unreviewed work can
+  be copied into an image layer. In `.gitignore` the entry is `.claude/`,
+  unanchored. In `.dockerignore` it is `.claude`, anchored and with **no** `**/`
+  prefix, because the prefixed form would also delete any nested directory of
+  that name from the build. Anchoring carries a known gap that the canonical
+  `.dockerignore` states in its own comment, since consuming repos receive the
+  file and not the tracker: the directory is created in the agent's working
+  directory, so a repo running agents in subdirectories still ships
+  `services/api/.claude/` and must add its own anchored entry there.
+
+- **A plain `docker build .` of a clone stamps the version that
+  `git describe --tags --always` gives**, derived from the `.git` in the build
+  context as the canonical `Dockerfile` above shows. Without its failure check,
+  a missing `git` or an unreadable checkout would leave `-X main.Version=` empty
+  and the build would still exit 0. `script/docker` and `script/cibuild` pass
+  the version they compute on the host; it takes precedence. They do this
+  byte-identically across repos:
+
+    ```sh
+    # Own line: a failing command substitution inside an argument does not
+    # trip `set -e`, so the inline form degrades to an empty constant.
+    version="$(git describe --tags --always --dirty 2>/dev/null || true)"
+    [ -n "$version" ] || version="unknown"
+    docker build --no-cache \
+        --build-arg VERSION="$version" \
+        -t "$(script/projectname)" .
+    ```
+
+    `--always` makes an untagged repo yield an abbreviated commit hash rather
+    than failing, and the `[ -n "$version" ]` line is the single place the
+    fallback is applied — a live check that fires on a build from an export with
+    no `.git` and on a repository with no commits yet. Do not fold it into the
+    substitution as `|| echo unknown`, which makes the guard unreachable. The
+    Dockerfile's side is `ARG VERSION` in the stage that compiles, declared
+    there because `ARG` is stage-scoped; passing `VERSION` to a repo whose
+    Dockerfile declares no such `ARG` is ignored and costs nothing, which is why
+    the scripts stay byte-identical. One consequence for CI: the standard
+    checkout action clones shallow and fetches no tags, so a repo that embeds a
+    tag-derived version must set `fetch-depth: 0` on its checkout step.
+
+- **Verify `.dockerignore` by enumerating the image, not by reading the
+  patterns.** Plant files at the root _and_ at least two directories deep, build
+  a probe image that does `COPY . .`, and list what actually landed
+  (`docker run --rm --entrypoint find IMAGE /app`). The `transferring context`
+  size is not a substitute: a nested secret is a few bytes, and BuildKit
+  transfers only the delta from the previous build.
 
 - **No build artifacts in version control.** Code-derived data (compiled
   bundles, minified output, generated assets) must never be committed to the
@@ -258,9 +476,56 @@ style conventions are in separate documents:
 - Make all changes on a feature branch. You can do whatever you want on a
   feature branch.
 
-- `.golangci.yml` is standardized and must _NEVER_ be modified by an agent, only
-  manually by the user. Fetch from
-  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml`.
+- `.golangci.yml` is standardized. The vendored copy in a consuming repo must
+  _NEVER_ be modified by an agent: fetch it from
+  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml` and keep it
+  byte-identical, so that no repo can quietly loosen its own linting. Linter
+  configuration changes are made to the canonical copy in the `prompts` repo and
+  reach consuming repos by re-vendoring; an agent may open a PR against
+  canonical, which only the user merges. One list is exempt from byte-identity,
+  because it cannot be written once for every repo: the `deny` list of the
+  `test-support` depguard rule, where a repo names its own test-support packages
+  by full import path. A repo adds entries there and changes nothing else, and a
+  re-vendor carries its entries forward. The canonical golangci-lint version is
+  v2.14.0 (released 2026-09-24), pinned as the digest of the lint phase's base
+  image
+  (`golangci/golangci-lint@sha256:ad862ba6b3798cbe0fd9fd7408d498fd74fbd2623a92406b2fd3898faf0bf98f`,
+  which reports `2.14.0 built with go1.27.0 from 114493f9`). A module's `go`
+  directive must not name a newer Go minor version than the one golangci-lint
+  was built with, or golangci-lint refuses to lint it: this release lints
+  `go 1.27.1` but not `go 1.28`. That digest is the only pin, since no repo
+  installs golangci-lint on the host. A repo sets the lint phase digest to the
+  one named here and re-vendors `.golangci.yml` in the same commit, whichever of
+  the two prompted the change: the canonical copy can name linters that an older
+  golangci-lint rejects, and a newer golangci-lint can add linters that
+  `default: all` switches on until the canonical copy disables them.
+
+- **`script/bootstrap` installs a pinned tool by comparing versions, never by
+  testing presence.** An `if ! command -v <tool>; then install; fi` guard tests
+  `PATH` only, so on an already-provisioned machine the pin is inert and a
+  version bump is a silent no-op — while the Dockerfile, installing into a clean
+  image, gets the pinned version, so a local `make check` and `make docker` can
+  disagree about what the tool even is. The canonical form:
+    - compares the installed version against the pin over the **whole** version
+      token; a parser that stops at the first `-` reports `2.12.2` for a host
+      running `2.12.2-rc1` and skips the install;
+    - treats absent, non-zero, empty or unrecognised `--version` output as a
+      mismatch, so the failure direction is a redundant install and never a
+      skipped one;
+    - after installing, re-resolves the binary the way callers do — `hash -r`,
+      then through `PATH`, not through the directory the installer wrote to —
+      and fails naming the resolved path, since an install that a shadowing
+      binary hides succeeds while changing nothing any caller sees;
+    - is actually called, and prints the version on both success paths: a
+      function defined and never invoked has the same exit status and the same
+      empty output as one that worked.
+
+    Keep it POSIX sh: no arrays, no `[[`, no `grep -P`.
+
+    A Go tool a repo needs on the host is installed with `go install` pinned to
+    a commit hash (`go install <package>@<commit hash>`). It is never tracked as
+    a `go.mod` tool dependency or through a `tools.go` file, either of which
+    pulls the tool's own dependencies into the repo's `go.mod` and `go.sum`.
 
 - When pinning images or packages by hash, add a comment above the reference
   with the version and date (YYYY-MM-DD).
@@ -374,12 +639,14 @@ style conventions are in separate documents:
   settings.
 
 - Avoid putting files in the repo root unless necessary. Root should contain
-  only project-level config files (`README.md`, `Makefile`, `Dockerfile`,
-  `LICENSE`, `.gitignore`, `.editorconfig`, `REPO_POLICIES.md`, and
-  language-specific config). Everything else goes in a subdirectory. Canonical
-  subdirectory names:
+  only project-level config files (`README.md`, `AGENTS.md`, `Makefile`,
+  `Dockerfile`, `LICENSE`, `.gitignore`, `.editorconfig`, `REPO_POLICIES.md`,
+  and language-specific config). Everything else goes in a subdirectory.
+  Canonical subdirectory names:
     - `bin/` — executable scripts and tools
-    - `cmd/` — Go command entrypoints
+    - `cmd/` — Go command entrypoints; thin only: one `main.go` per binary whose
+      body is a single call into `internal/` or `pkg/`, no project logic in
+      `cmd/`
     - `configs/` — configuration templates and examples
     - `deploy/` — deployment manifests (k8s, compose, terraform)
     - `docs/` — documentation and markdown (README.md stays in root)
@@ -406,3 +673,7 @@ style conventions are in separate documents:
     - Go: `go.mod`, `go.sum`, `.golangci.yml`
     - JS: `package.json`, `yarn.lock`, `.prettierrc`, `.prettierignore`
     - Python: `pyproject.toml`
+
+- Guidance for coding agents lives in one `AGENTS.md` at the repository root. It
+  is never committed under a file or directory named after one agent tool, such
+  as `CLAUDE.md` or `.claude/`, and never split into separate memory files.
diff --git a/bin/tools/go.mod b/bin/tools/go.mod
deleted file mode 100644
index d8aa330..0000000
--- a/bin/tools/go.mod
+++ /dev/null
@@ -1,22 +0,0 @@
-// The developer tools this repo runs with `go tool`: gofumpt for
-// script/gofumpt and protoc-gen-go for script/generate. Kept out of the mfer
-// module so they add nothing to what mfer's users download. `go tool` builds
-// exactly the source whose hashes go.sum here records.
-module sneak.berlin/go/mfer/bin/tools
-
-go 1.26.0
-
-tool (
-	google.golang.org/protobuf/cmd/protoc-gen-go
-	mvdan.cc/gofumpt
-)
-
-require (
-	golang.org/x/mod v0.40.0 // indirect
-	golang.org/x/sync v0.22.0 // indirect
-	golang.org/x/tools v0.49.0 // indirect
-	// protoc-gen-go v1.36.11, 2026-10-04
-	google.golang.org/protobuf v1.36.11 // indirect
-	// gofumpt v0.12.0, 2026-10-04
-	mvdan.cc/gofumpt v0.12.0 // indirect
-)
diff --git a/bin/tools/go.sum b/bin/tools/go.sum
deleted file mode 100644
index 0c1d6ad..0000000
--- a/bin/tools/go.sum
+++ /dev/null
@@ -1,22 +0,0 @@
-github.com/go-quicktest/qt v1.102.0 h1:HSQxCeh5YZH3EL3W39ixjtyaEhcWSXQHtHnMBzSs474=
-github.com/go-quicktest/qt v1.102.0/go.mod h1:p4lGIVX+8Wa6ZPNDvqcxq36XpUDLh42FLetFU7odllI=
-github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
-github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
-github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
-github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
-github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/rogpeppe/go-internal v1.16.0 h1:O9DK+vNMDVGLr2BeZqmpLeMjiMNkuXfcqntWbZV6S5g=
-github.com/rogpeppe/go-internal v1.16.0/go.mod h1:DrUVZyrJU+txYW5/1kwtXQSMFio52ZOxX7yM1VHvnxs=
-golang.org/x/mod v0.40.0 h1:hUv+3cXcdRHz08UmSiOob7sadHig73uo5bkXxQ/tvUs=
-golang.org/x/mod v0.40.0/go.mod h1:0/weTWkPWGBikyTWAX3dkjVztMmBA5hM0DH6BElSupE=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
-golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI=
-golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo=
-google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
-google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
-mvdan.cc/gofumpt v0.12.0 h1:1Lbudkz2kpM9Cjz2pL4M19u7q+GaEhCTNf7N9mfpcho=
-mvdan.cc/gofumpt v0.12.0/go.mod h1:SmBHHrljiZu/uoypeKup3rFzP6eoC9UwCp2iH5E3jZA=
diff --git a/script/bootstrap b/script/bootstrap
index 7d61b77..cbb3d2d 100755
--- a/script/bootstrap
+++ b/script/bootstrap
@@ -22,6 +22,14 @@ YARN_VERSION="1.22.22"
 # protoc v33.4, 2026-10-04, for script/generate. The sha256 of each
 # platform's release archive is in ensure_protoc.
 PROTOC_VERSION="33.4"
+# gofumpt v0.12.0 for script/gofumpt and protoc-gen-go v1.36.11 for
+# script/generate, 2026-10-04: each is installed into bin/ with
+# `go install`, pinned to the commit its release tag names. Those two
+# scripts refuse any other version, so a new pin is changed there too.
+GOFUMPT_VERSION="v0.12.0"
+GOFUMPT_COMMIT="3e07e7e70ac93761d8e79ca0083a19e3d59f753d"
+PROTOC_GEN_GO_VERSION="v1.36.11"
+PROTOC_GEN_GO_COMMIT="96a179180f0ad6bba9b1e7b6e38d0affb0168e9a"
 
 PKGMGR=""
 SUDO=""
@@ -130,11 +138,13 @@ install_js_deps() {
 
 # Unpack protoc's release archive for this platform into bin/protoc, after
 # checking the archive's sha256, unless bin/protoc already holds the pinned
-# version.
+# version. script/generate runs bin/protoc/bin/protoc, so that is the
+# binary checked again after unpacking.
 ensure_protoc() {
     dir="$ROOT/bin/protoc"
     if [ "$("$dir/bin/protoc" --version 2>/dev/null)" = \
         "libprotoc $PROTOC_VERSION" ]; then
+        echo "protoc $PROTOC_VERSION"
         return 0
     fi
     case "$(uname -s) $(uname -m)" in
@@ -168,6 +178,53 @@ ensure_protoc() {
     rm -rf "$dir"
     unzip -q "$tmp/protoc.zip" -d "$dir"
     rm -rf "$tmp"
+    actual="$("$dir/bin/protoc" --version 2>/dev/null || true)"
+    if [ "$actual" != "libprotoc $PROTOC_VERSION" ]; then
+        echo "bootstrap: $dir/bin/protoc reports '$actual'," \
+            "not libprotoc $PROTOC_VERSION" >&2
+        exit 1
+    fi
+    echo "protoc $PROTOC_VERSION"
+}
+
+# Install gofumpt into bin/ unless bin/gofumpt already reports the pinned
+# version. script/gofumpt runs bin/gofumpt, so that is the binary checked
+# again after installing. Its --version prints the version, then the Go
+# version it was built with. The old file is removed first because
+# `go install` refuses to replace a file that is not a Go binary.
+ensure_gofumpt() {
+    tool="$ROOT/bin/gofumpt"
+    if [ "$("$tool" --version 2>/dev/null | cut -d' ' -f1)" != \
+        "$GOFUMPT_VERSION" ]; then
+        rm -f "$tool"
+        GOBIN="$ROOT/bin" go install "mvdan.cc/gofumpt@$GOFUMPT_COMMIT"
+    fi
+    actual="$("$tool" --version 2>/dev/null | cut -d' ' -f1)"
+    if [ "$actual" != "$GOFUMPT_VERSION" ]; then
+        echo "bootstrap: $tool reports '$actual', not $GOFUMPT_VERSION" >&2
+        exit 1
+    fi
+    echo "gofumpt $GOFUMPT_VERSION"
+}
+
+# Install protoc-gen-go into bin/ unless bin/protoc-gen-go already reports
+# the pinned version, as ensure_gofumpt does. script/generate runs
+# bin/protoc-gen-go, so that is the binary checked again after installing.
+ensure_protoc_gen_go() {
+    tool="$ROOT/bin/protoc-gen-go"
+    if [ "$("$tool" --version 2>/dev/null)" != \
+        "protoc-gen-go $PROTOC_GEN_GO_VERSION" ]; then
+        rm -f "$tool"
+        GOBIN="$ROOT/bin" go install \
+            "google.golang.org/protobuf/cmd/protoc-gen-go@$PROTOC_GEN_GO_COMMIT"
+    fi
+    actual="$("$tool" --version 2>/dev/null || true)"
+    if [ "$actual" != "protoc-gen-go $PROTOC_GEN_GO_VERSION" ]; then
+        echo "bootstrap: $tool reports '$actual'," \
+            "not protoc-gen-go $PROTOC_GEN_GO_VERSION" >&2
+        exit 1
+    fi
+    echo "protoc-gen-go $PROTOC_GEN_GO_VERSION"
 }
 
 main() {
@@ -192,10 +249,9 @@ main() {
     if missing go; then pkg_install go golang go go; fi
     # No golangci-lint: script/lint runs it in Docker only.
     go mod download
-    # gofumpt and protoc-gen-go: bin/tools/go.mod pins them, and
-    # script/gofumpt and script/generate build them from there.
-    (cd "$ROOT/bin/tools" && go mod download)
+    ensure_gofumpt
     ensure_protoc
+    ensure_protoc_gen_go
 
     # ---- Python repos ----
     # if missing python3; then pkg_install python3 python3 python3 python3; fi
diff --git a/script/check b/script/check
index cc046f7..92875f7 100755
--- a/script/check
+++ b/script/check
@@ -1,7 +1,8 @@
 #!/bin/sh
 # script/check: run all checks (test, lint, fmt-check). Our own
-# extension to scripts-to-rule-them-all. Must not modify any files.
-# Generic: usually needs no adaptation.
+# extension to scripts-to-rule-them-all. test and lint are Docker
+# phases; fmt-check is native, because a formatter writes the working
+# tree. Must not modify any files.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
diff --git a/script/cibuild b/script/cibuild
index 469c1df..d8d3200 100755
--- a/script/cibuild
+++ b/script/cibuild
@@ -1,8 +1,10 @@
 #!/bin/sh
-# script/cibuild: run the CI build; the Gitea workflow runs this on push.
-# It builds the image with the same command as script/docker. --no-cache
-# because the checks the final stage depends on are RUN steps, and a
-# cached one is a check that did not run.
+# script/cibuild: run the CI build. It bootstraps first: a CI runner
+# checks out and runs this and nothing else, and script/fmt-check runs
+# the formatter on the host, which a pristine checkout cannot do.
+# --no-cache for the same reason as script/docker: the gate phases the
+# final stage depends on are RUN steps, and a cached one is a check that
+# did not run.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
@@ -10,6 +12,8 @@ ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
+    "$SCRIPT_DIR/bootstrap"
+    "$SCRIPT_DIR/check"
     # Own line: a failing command substitution inside an argument does
     # not trip `set -e`, so the inline form degrades silently to an
     # empty constant. The VERSION build argument takes precedence over
diff --git a/script/generate b/script/generate
index 6d23b0b..a65fdc4 100755
--- a/script/generate
+++ b/script/generate
@@ -5,16 +5,18 @@
 # protoc. A test fails while mf.proto no longer matches the recorded hash.
 #
 # Runs the protoc that script/bootstrap unpacks into bin/protoc, and the
-# protoc-gen-go that bin/tools/go.mod pins. Another version of either
-# writes a different mf.pb.go.
+# protoc-gen-go it installs into bin/. Another version of either writes a
+# different mf.pb.go.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
-# The protoc version script/bootstrap installs. protoc 33.4 names itself
-# v6.33.4 in the mf.pb.go header.
+# The versions script/bootstrap installs. protoc 33.4 names itself v6.33.4
+# in the mf.pb.go header.
 PROTOC_VERSION="33.4"
 PROTOC="$ROOT/bin/protoc/bin/protoc"
+PROTOC_GEN_GO_VERSION="v1.36.11"
+PROTOC_GEN_GO="$ROOT/bin/protoc-gen-go"
 
 # sha256 <file>: print "<hash>  <file>", with sha256sum, or with shasum
 # where there is no sha256sum.
@@ -30,23 +32,26 @@ sha256() {
 }
 
 main() {
-    # A bin/protoc left from before the pin moved fails here, until
-    # script/bootstrap replaces it.
+    # A bin/protoc or bin/protoc-gen-go left from before its pin moved
+    # fails here, until script/bootstrap replaces it.
     actual="$("$PROTOC" --version 2>/dev/null || true)"
     if [ "$actual" != "libprotoc $PROTOC_VERSION" ]; then
         echo "generate: needs protoc $PROTOC_VERSION in bin/protoc," \
             "found: ${actual:-none}; run script/bootstrap" >&2
         exit 1
     fi
-    # `go tool -n` builds protoc-gen-go from bin/tools and prints where the
-    # binary is, without running it.
-    plugin="$(cd "$ROOT/bin/tools" && go tool -n protoc-gen-go)"
+    actual="$("$PROTOC_GEN_GO" --version 2>/dev/null || true)"
+    if [ "$actual" != "protoc-gen-go $PROTOC_GEN_GO_VERSION" ]; then
+        echo "generate: needs protoc-gen-go $PROTOC_GEN_GO_VERSION in" \
+            "bin/protoc-gen-go, found: ${actual:-none}; run script/bootstrap" >&2
+        exit 1
+    fi
 
     cd "$ROOT/mfer"
     # Hashed before regenerating, so a missing hash tool stops the script
     # before it changes anything. Regenerating leaves mf.proto as it is.
     proto_hash="$(sha256 mf.proto)"
-    "$PROTOC" --plugin=protoc-gen-go="$plugin" \
+    "$PROTOC" --plugin=protoc-gen-go="$PROTOC_GEN_GO" \
         --go_out=paths=source_relative:. ./mf.proto
     echo "$proto_hash" >mf.proto.sha256
 }
diff --git a/script/gofumpt b/script/gofumpt
index 0422ac5..b388a51 100755
--- a/script/gofumpt
+++ b/script/gofumpt
@@ -3,17 +3,16 @@
 #
 # Takes exactly one mode argument, --write or --check, and runs the same
 # gofumpt version over the same files in both modes. script/fmt and
-# script/fmt-check both go through here, and so does the Docker lint
-# stage, so what gets formatted and what gets verified cannot drift
-# apart.
+# script/fmt-check both go through here, so what gets formatted and what
+# gets verified cannot drift apart.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
-# The gofumpt version is the one bin/tools/go.mod pins. `go tool` run in
-# bin/tools builds it from source checked against the hashes in
-# bin/tools/go.sum, so neither a developer machine nor the lint image needs
-# it installed.
+# The gofumpt script/bootstrap installs into bin/. Must match the pin
+# there.
+GOFUMPT_VERSION="v0.12.0"
+GOFUMPT="$ROOT/bin/gofumpt"
 
 usage() {
     echo "usage: script/gofumpt --write|--check" >&2
@@ -22,15 +21,22 @@ usage() {
 
 main() {
     [ "$#" -eq 1 ] || usage
-    cd "$ROOT/bin/tools"
+    # A bin/gofumpt left from before the pin moved formats differently, so
+    # it fails here until script/bootstrap replaces it.
+    actual="$("$GOFUMPT" --version 2>/dev/null | cut -d' ' -f1)"
+    if [ "$actual" != "$GOFUMPT_VERSION" ]; then
+        echo "gofumpt: needs $GOFUMPT_VERSION in bin/gofumpt," \
+            "found: ${actual:-none}; run script/bootstrap" >&2
+        exit 1
+    fi
     # Every Go file in the repo, from $ROOT down. gofumpt holds generated
     # files, such as mfer/mf.pb.go, to gofmt's rules only.
     case "$1" in
-        --write) go tool gofumpt -l -w "$ROOT" ;;
+        --write) "$GOFUMPT" -l -w "$ROOT" ;;
         --check)
             # Own line: a failing command inside `[ -n "$(...)" ]` does
             # not trip `set -e`, so a gofumpt that never ran would pass.
-            unformatted="$(go tool gofumpt -l "$ROOT")"
+            unformatted="$("$GOFUMPT" -l "$ROOT")"
             if [ -n "$unformatted" ]; then
                 echo "gofumpt: files need formatting (run make fmt):" >&2
                 echo "$unformatted" >&2
diff --git a/script/install-precommit b/script/install-precommit
index 3519de6..bef6406 100755
--- a/script/install-precommit
+++ b/script/install-precommit
@@ -1,7 +1,6 @@
 #!/bin/sh
 # script/install-precommit: install the git pre-commit hook that runs
 # script/precommit. Our own extension to scripts-to-rule-them-all.
-# Generic: needs no adaptation.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
diff --git a/script/lint b/script/lint
index 3d5c4de..2d8b075 100755
--- a/script/lint
+++ b/script/lint
@@ -1,8 +1,13 @@
 #!/bin/sh
-# script/lint: run golangci-lint, in Docker only. Builds the lint stage of
-# the Dockerfile, whose build runs the linter, so a successful build is a
-# clean lint. --no-cache because a cached build runs no linter. The image
-# is removed afterwards, whatever the outcome.
+# script/lint: run the linter. Linting is a phase of the Dockerfile and
+# this builds that phase alone; the linter is never installed or run on
+# a developer host, where a shared result cache and a host-global lock
+# make its answer untrustworthy.
+#
+# The phase is not the last stage in the file, so it is built only when
+# --target names it. --no-cache because a cached lint layer is a lint
+# that did not run. The tag makes each build replace the previous image
+# instead of leaving a dangling one behind.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
@@ -10,11 +15,9 @@ ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    # Tagged per run, so concurrent runs never remove each other's image.
-    image="$("$SCRIPT_DIR/projectname")-lint:$$"
-    # A failed build leaves no image, so there is nothing to remove then.
-    trap 'docker image rm "$image" >/dev/null 2>&1 || true' EXIT INT TERM
-    docker build --no-cache --target lint -t "$image" .
+    docker build --no-cache \
+        --target lint \
+        -t "$("$SCRIPT_DIR/projectname")-lint" .
 }
 
 main "$@"
diff --git a/script/prettier b/script/prettier
index 9b1079c..02b4b2c 100755
--- a/script/prettier
+++ b/script/prettier
@@ -56,8 +56,7 @@ main() {
 
     # Markdown and JSON, repo-wide rather than root-only, so files in
     # subdirectories (docs/, once it exists) are covered too. Exclusions
-    # live in .prettierignore; REPO_POLICIES.md is excluded there because
-    # it is a verbatim copy of an upstream document.
+    # live in .prettierignore.
     #
     # --no-error-on-unmatched-pattern is deliberately NOT used: both
     # patterns always match at least one tracked file (README.md,
diff --git a/script/setup b/script/setup
index 53327ba..4cc5b6b 100755
--- a/script/setup
+++ b/script/setup
@@ -1,7 +1,6 @@
 #!/bin/sh
 # script/setup: set up the repo for development after a fresh clone:
-# installs dependencies (script/bootstrap) and the git pre-commit hook.
-# Add any repo-specific initialization (db init, .env template) here.
+# installs dependencies and the git pre-commit hook.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
diff --git a/script/test b/script/test
index 2d63e2d..cd239f2 100755
--- a/script/test
+++ b/script/test
@@ -1,17 +1,19 @@
 #!/bin/sh
-# script/test: run the test suite.
+# script/test: run the test suite. Testing is a phase of the Dockerfile
+# and this builds that phase alone, on the same terms as script/lint:
+# --target because a phase that is not the last stage is built only when
+# named, --no-cache because a cached test layer is a test that did not
+# run, and a tag so each build replaces the previous image.
 set -eu
 
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    go test -timeout 30s -race -cover ./... ||
-        {
-            echo "--- Rerunning with -v for details ---"
-            go test -timeout 30s -race -v ./...
-            exit 1
-        }
+    docker build --no-cache \
+        --target test \
+        -t "$("$SCRIPT_DIR/projectname")-test" .
 }
 
 main "$@"