From efa4bb929a39772a5caadae8aee7dc231681f388 Mon Sep 17 00:00:00 2001
From: sneak <sneak@sneak.berlin>
Date: Wed, 17 Dec 2025 17:08:37 -0800
Subject: [PATCH] Update README: mark FIXMEs as resolved

---
 .index.mf | Bin 0 -> 2375 bytes
 CLAUDE.md |   5 +++++
 README.md |   2 +-
 TODO.md   |  33 ---------------------------------
 4 files changed, 6 insertions(+), 34 deletions(-)
 create mode 100644 .index.mf
 delete mode 100644 TODO.md

diff --git a/.index.mf b/.index.mf
new file mode 100644
index 0000000000000000000000000000000000000000..3f1d0f126503ec49de14c646818849325cd67e6d
GIT binary patch
literal 2375
zcmV-N3ApxJPC-^vQbtFp1_7`J0k{UZ7{Uf1wdk>%>4155Y6kfjYhj!%DSrVFFi5E>
zlGz|`BeLz5x(tpID77#BWH<{2NC32Wpaub|215!7Lrg(cL`5!bWDwW`8YBuL5+L}_
zU~A~q0BALFPp#jzM;HlD8MgCYHLl8PL#GnJ5Wn&g3<%iajLHTO)|K_D0jdT>3JOGT
zV{2t{W@&6?5c3RweH@WO&#mz}i`tPD5eZuIZUCz=ASZ9?-?ap)n7s(w&VaH85TT@!
z!~?1ZK?(;<Nkc_WQ$-Mh2dIye28|^=Gw8L$sYebI(mu#=>MKq-$a*9$gK}9Pt*C;S
zLJ9~?VQXc_5ZseZ_j(@C>@&V<5B)BHPvfe-Wv{&+PK>+@Pmb*Vapv~ky_x({ML|SO
zo}~exd27t}Y-kUY{Ta^LQ@G=*MGX7e>E_Ds{qMC2f*khp5(@~!|IGcT0;&c;3I|kA
zL{GaD?=!A6XfqQHrER=~c!@8w838@?vaa(ZqzY#c%v4j!;{J)i2&x803JqduZZBtP
zbaG{OE^}xQ$eWRi^f4+*7wuuP(C~lP<CCbgez+*233kk+`e2(*@{{|sN(vBTZDcQP
zW@U0OZDDC{E@y8L#0tHjB7Eax7r~~ijpE{@;1O=NZf+sCDa<xS$P322D%r@nvIY>E
z>4|{?ss>LA6<>5^b994dp3(A^*z;vyLOclXzS!fvi|)kA)?zJeQJl@a>G}rtuf}g~
zbaH88FLiTaXJz{WM?bY_(g6k9pNXk=9bd=t;vbwEzT$3NSYV|uH+ehSu<(iDz>@}N
zZ!T?bWDw?Es}<Ln=X(~;ZdI<jyBa_LM$A#jS6PV>b%J`5{IdeqfsM)r5Q4aum~(Y)
z5Wlveb%0_*mx_M20j-jm`scp`3vbHn@PFk6AX?R(DEE!@+}ltJ7HMvDWpZv|Y%gMO
za%(STa&m8Sl-y|<tg<LTQ-`v4J(E@AIuO%$eHANX-$yXfTrO(Y!ne$-na~2N22~0h
zkb6{iqk7)f4qJG|HnDU|H_Ozgoze}bgvx@6&<XxD?Sz|%#RFq#Wjou<5H0+~{Dh-a
z2W>&)?EtZ3#6$ck_jenXRjd#di_yT}<%#L_0;&d13KeW=mLH;<#Lq~xq$t_TzxF_0
z!3XT=Lic6amOflV_GlfscVMma+tIEKWo~qGdF>7pEEWOG>cYbgUi?2&oE93U{Z1_O
zK}t9yNgD-<9m)fUqqNI>ss>aF8pd7eNL^T^&YBV_jwt2p0~AYQ)*E?T0D{Lji{?1V
z9EYZWj+Wwv0cK@%V`#QUl`SW4D#?~AiK&E>b*eK151>_a+Aj>L2}w(mAU-d?xv%-<
zY42Dn1P>I=cP%tQ+#d<9uE?vGZ|JVbMiBy00Phv<;*Fq%;NA1$-2tiwQ3@AwWpij{
zgH8_>t0KduIG@`hO+T0>#=tez0*C}!;M&{1gu>`%T06b^#Gd^B0;&d93LKaf*;%sb
z?2^h)xYsS`LaZ1yh8<wp6YJHjxxIdaMkEhy$ku_j!TkcN22BbRXX6+fbZ&;9nQ$|D
zG=};#GfIQ2cW+pNAF7?;{cz$y!ti04lH~5M0~Bm&stVF|_nDY?o56uCI7s_uBW;o0
zmi)u0!@-@bc)t*a^quhhv8B!O0{=G9I!=DRj#%a8#{=+;Wb2OP!U`xuh=(+CCt`0(
ziLM{`$@YfF18i?+(k^tgMG#tVS3zz{-~1_0**gkr&^Z=gUjnsFC6=UTk?ZH!^Y7aM
zss>UD7>WSgyecg)+_LF4xIMv@+n44HTd{MaLc%uRIM48^7&fcy!E<9_Zf<3A%U9;f
zkp8vo`~hfgxwq`W>bI~91($Xf5;+oY!GSuxW{Hfm$;9{pss>344`Ov`Y-IeG>t2yE
zc4w?yS~b1p;;XEY|NiJJVnQg|gjaq+=!@Eej@GUbV{dMAbYX6Eb4$4wng`le4aE_3
zAle&~m{-%8Gw6@2nR_G^z&zAhJ=fmjqp><<Wpib6X<=+>dS&nusWYIO0e-KyS(d-X
zfJ~9Ph+Z^WLb=GQai_+QAkzv(_3Yxz`s@L1VQy(=A#b?iBEIMgE@vJ547<ER=ZWS@
z6nWXHoikC7h)ypoy^PXB3JPXVAu|OVcBrA4<&I~LI>uVA#WjeQr`8x4Khge`@az5W
z*}w5e3Jq{#ppEoX;_cd}huQ1>CMf8C;-MnA7@2aC$OvkpRivejAa=Xt`i<;<a&L5R
z5Twgl<*8w*Mtchg^2yQvY6Nb_356@ZYz{ary!fr^TE>RDiK4s%ss>B;E!9>>!i-fO
z7kxC-LBX2eGzrXKNK&O1xTs+i(40{AkoMS%0jdT_3Jz~|bZ~X)x1lyEIJCNU8HFV=
z{dA!3_C%hdI2noKYY=N&9hS9jkm>KrjsdKAF2e_I_O%}L(1;IK^8wJ{cjjavwGlmG
z$7p>|5?7byqK?0$0}X9&WMg4tXk{*RdUJFT=D@ZMS4VNGPP#fJ8;ze;{*N+##UeLI
z(*`72U(bWHZMsx-;jg~i1F8l^3JZ2+Ze(wAmWx1TYasu*e~|79%khrXxo$F!&Tg{C
zA3jWcVqH2*N?UT=_1T^S$_xw$+kuVB1`w!+(zXMDxG1m&AUdiI5pXSbGnJ%33`_tS
zKBf<i%tB}WJ|MJOURwJreR3Zfk_elCGp+#(!!KFCh12RtjQSM-_M6UkxX6GV7<*<E
z!-Y>+i-b+Gz<_DL5P%sN7!I8Q^7E5^iZf^(#EpZ>EsK*(CwTbRIvDgkO#OiZW;BVQ
zUpO8g`i<CCZwV92-`t(vr_g0eQ8~TXBXlB6)BFR04@BN+7KN#!U+f(g;m<~Ws6~bW
z$-6d^B7v$F489R2W$-c7@T^*(4~47@yDkiRvk*244_#uMr{WN@)`T*^=tH0kDnCFa
zei!o@W9b#u{|#P|=HQTu7`$=OkJzQDBo2cjJ;dsT3yn8Hjf|lm-E63s3!HBlThd_v
ze1h@8ijmJRl<$g5#myWzYA@rJ8#n@j0lvNH@MVHijCdHouXH;givPFLYPTR?D41qo
tqk24SsKH1O3lk3gR<?%*)fqOKhH;+83^Cq7K93(zI@uIaL;<&m)J!CFZixT@

literal 0
HcmV?d00001

diff --git a/CLAUDE.md b/CLAUDE.md
index eb8a9ef..f4556e2 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -1,5 +1,10 @@
 # Important Rules
 
+* when fixing a bug, write a failing test FIRST.  only after the test fails, write
+  the code to fix the bug.  then ensure the test passes.  leave the test in
+  place and commit it with the bugfix.  don't run shell commands to test
+  bugfixes or reproduce bugs.  write tests!
+
 * never, ever mention claude or anthropic in commit messages.  do not use attribution
 
 * after each change, run "make fmt".
diff --git a/README.md b/README.md
index 30999c8..71a05b3 100644
--- a/README.md
+++ b/README.md
@@ -365,7 +365,7 @@ The manifest file would do several important things:
 
 - [x] **Add unit tests for `internal/checker`** - 88.5% coverage.
 - [x] **Add unit tests for `internal/scanner`** - 80.1% coverage.
-- [ ] **Clean up FIXMEs in manifest.go** - Validate input paths exist, validate filesystem.
+- [x] **Clean up FIXMEs in manifest.go** - Validated input paths, validated filesystem, added context cancellation.
 - [x] **Validate input paths before scanning** - Fails fast with clear error if paths don't exist.
 
 # Open Questions
diff --git a/TODO.md b/TODO.md
deleted file mode 100644
index 425694a..0000000
--- a/TODO.md
+++ /dev/null
@@ -1,33 +0,0 @@
-# TODO for 1.0 Release
-
-## High Priority
-
-- [ ] **Fix panic in log.go** - `internal/log/log.go:141` has a `panic("unable to get logger")` that should return an error or handle gracefully instead.
-
-- [ ] **Clean up FIXMEs in manifest.go** - Multiple FIXMEs need attention:
-  - Line 67: Validate input paths exist before processing
-  - Line 77: Add validation for filesystem input
-  - Line 163: Avoid redundant stat calls
-  - Line 182: Add context support for cancellation
-
-- [ ] **Fix WriteToFile overwrite behavior** - `mfer/output.go:9` has FIXME to refuse overwriting without `-f` flag.
-
-- [ ] **Consolidate legacy manifest code** - `mfer/manifest.go` has old scanning code (`Scan()`, `addFile()`) that duplicates the new `internal/scanner` + `mfer/builder.go` pattern. Remove duplication.
-
-## Medium Priority
-
-- [ ] **Add unit tests for `internal/checker`** - Currently has no test files; only tested indirectly via CLI tests.
-
-- [ ] **Add unit tests for `internal/scanner`** - Currently has no test files.
-
-- [ ] **Add context cancellation to legacy code** - The old `manifest.Scan()` doesn't support context cancellation; the new scanner does.
-
-- [ ] **Validate input paths before scanning** - Should fail fast with a clear error if paths don't exist.
-
-- [ ] **Add resume support for fetch** - Allow resuming partial downloads using HTTP Range requests and existing temp files.
-
-## Lower Priority
-
-- [ ] **Add manifest signature support** - Implement signing and verification using signify or similar.
-
-- [ ] **Improve error messages** - Ensure all error messages are clear and actionable.