Rewrite AGENTS.md in short plain sentences (#327)

Every rule keeps its meaning and emphasis. Sentences are split so each
holds one idea, with the main rule before its exception and every
command, file name and identifier in backticks.

Three statements were false against the repo or the standing rulings
on record and are corrected:

- the format check is `make fmt-check`, not `make check-fmt`
- a feature branch reaches `next` through a PR that passes review, is
  merged only when the feature is completely finished and the code is
  up to standards, and is deleted after the merge; only the user
  merges `next` into `main`
- the naming example uses the code's term: `al` is bad,
  `SourceHostAllowlist` is good

The `Last Updated` line takes today's date.

Model: fable-5-1

AGENTS.md

@@ -1,75 +1,76 @@
 # Repository Rules
 
-Last Updated 2026-01-08
+Last Updated 2026-10-27
 
-These rules MUST be followed at all times, it is very important.
+These rules MUST be followed at all times. This is very important.
 
-- Never use `git add -A` - add specific changes to a deliberate commit. A commit
+- Never use `git add -A`. Stage specific changes for a deliberate commit. A
-  should contain one change. After each change, make a commit with a good
+  commit holds one change. After each change, make a commit with a good one-line
-  one-line summary.
+  summary.
 
 - NEVER modify the linter config without asking first.
 
-- NEVER modify tests to exclude special cases or otherwise get them to pass
+- NEVER modify a test to exclude special cases or otherwise make it pass without
-  without asking first. In almost all cases, the code should be changed, NOT the
+  asking first. In almost all cases, change the code, NOT the test. You need
-  tests. If you think the test needs to be changed, make your case for that and
+  explicit user approval to modify an existing test. If you think a test needs
-  ask for permission to proceed, then stop. You need explicit user approval to
+  to change, make your case and ask for permission to proceed. Then stop. A bug
-  modify existing tests. A bug fix may change an existing test without asking
+  fix may change an existing test without asking only when that test pins
-  when that test pins exactly the behavior the filed bug calls wrong, and the
+  exactly the behavior the filed bug calls wrong. The change must then move the
-  change moves it to the fixed behavior and nothing else; any other change to an
+  test to the fixed behavior and nothing else. Any other change to an existing
-  existing test still needs explicit user approval. (You do not need user
+  test needs explicit user approval. Writing NEW tests needs no approval.
-  approval for writing NEW tests.)
 
-- When linting, assume the linter config is CORRECT, and that each item output
+- When linting, assume the linter config is CORRECT. Treat each item the linter
-  by the linter is something that legitimately needs fixing in the code.
+  reports as something that legitimately needs fixing in the code.
 
 - When running tests, use `make test`.
 
-- Before commits, run `make check`. This runs `make lint` and `make test` and
+- Before committing, run `make check`. It runs `make test`, `make lint` and
-  `make check-fmt`. Any issues discovered MUST be resolved before committing
+  `make fmt-check`. Any issue it finds MUST be resolved before committing,
-  unless explicitly told otherwise.
+  unless you are explicitly told otherwise.
 
 - When fixing a bug, write a failing test for the bug FIRST. Add appropriate
-  logging to the test to ensure it is written correctly. Commit that. Then go
+  logging to the test, to make sure the test is written correctly. Commit that.
-  about fixing the bug until the test passes (without modifying the test
+  Then work on the fix until the test passes, without changing the test further.
-  further). Then commit that.
+  Then commit the fix.
 
-- When adding a new feature, do the same - implement a test first (TDD). It
+- When adding a new feature, do the same: write a test first (test-driven
-  doesn't have to be super complex. Commit the test, then commit the feature.
+  development, TDD). The test does not need to be very complex. Commit the test,
+  then commit the feature.
 
-- When adding a new feature, use a feature branch. When the feature is
+- When adding a new feature, use a feature branch. The feature branch reaches
-  completely finished and the code is up to standards (passes `make check`) then
+  `next` through a PR that passes review. It is merged only when the feature is
-  and only then can the feature branch be merged into `main` and the branch
+  completely finished and the code is up to standards. The code is up to
-  deleted.
+  standards when it passes `make check`. The branch is deleted after the merge.
+  Only the user merges `next` into `main`.
 
-- Write godoc documentation comments for all exported types and functions as you
+- Write `godoc` comments for all exported types and functions as you go along.
-  go along.
 
-- ALWAYS be consistent in naming. If you name something one thing in one place,
+- ALWAYS be consistent in naming. If you name something one way in one place,
-  name it the EXACT SAME THING in another place.
+  use the EXACT SAME name in every other place.
 
-- Be descriptive and specific in naming. `wl` is bad; `SourceHostWhitelist` is
+- Be descriptive and specific in naming. `al` is bad; `SourceHostAllowlist` is
   good. `ConnsPerHost` is bad; `MaxConnectionsPerHost` is good.
 
-- This is not prototype or teaching code - this is designed for production. Any
+- This is not prototype or teaching code. It is designed for production. Any
-  security issues (such as denial of service) or other web vulnerabilities are
+  security issue (such as denial of service) or other web vulnerability is a P1
-  P1 bugs and must be added to TODO.md at the top.
+  bug. It must be added at the top of `TODO.md`.
 
-- As this is production code, no stubbing of implementations unless specifically
+- Do not stub an implementation unless you are specifically instructed to. This
-  instructed. We need working implementations.
+  is production code, and we need working implementations.
 
 - NEVER silently fall back to a different setting when a user's parameter
-  explicitly specifies a value. If a user requests format=webp and WebP encoding
+  explicitly specifies a value. For example, if a user requests `format=webp`
-  is not supported, return an error - do NOT silently output PNG instead. If a
+  and WebP encoding is not supported, return an error. Do NOT silently output
-  user specifies fit=invalid and that fit mode doesn't exist, return an error -
+  PNG instead. If a user specifies `fit=invalid` and that fit mode does not
-  do NOT silently default to "cover". Silent fallbacks violate the principle of
+  exist, return an error. Do NOT silently default to `cover`. A silent fallback
-  least surprise and mask bugs. The only acceptable defaults are for OMITTED
+  violates the principle of least surprise and masks bugs. Defaults are
-  parameters, never for INVALID explicit values.
+  acceptable only for OMITTED parameters, never for INVALID explicit values.
 
-- Avoid vendoring deps unless specifically instructed to. NEVER commit the
+- Avoid vendoring dependencies unless specifically instructed to. NEVER commit
-  vendor directory, NEVER commit compiled binaries. If these directories or
+  the `vendor/` directory. NEVER commit compiled binaries. If such a directory
-  files exist, add them to .gitignore (and commit the .gitignore) if they are
+  or file exists and `.gitignore` does not list it, add it to `.gitignore`.
-  not already in there. Keep the entire git repository (with history) small -
+  Commit that `.gitignore` change. Keep the entire git repository, history
-  under 20MiB, unless you specifically must commit larger files (e.g. test
+  included, under 20 MiB. Go over 20 MiB only when you specifically must commit
-  fixture example media files). Only OUR source code and immediately supporting
+  a large file, such as a media file used as a test fixture. Only OUR source
-  files (such as test examples) goes into the repo/history.
+  code and its immediately supporting files, such as test examples, go into the
+  repository and its history.

README.md

@@ -256,9 +256,10 @@ Each look also drops the rows of variants whose files are missing. When pixa
 cannot read a variant file's size for another reason, it keeps the variant's
 row. It logs a warning naming the variant key and the error.
 
-During a look, pixa skips any file or directory in the cache that it cannot
+During a look, pixa skips a directory it cannot list and a file whose size it
-read. It logs a warning naming the path and the error, and goes on with the rest
+cannot read. It logs a warning naming the path and the error, and goes on with
-of the look.
+the rest of the look. A file renamed or removed after pixa listed its directory
+gets no warning.
 
 pixa's target is 1-5k r/s, which has not been measured at that rate (see Load
 Test). Toward it, a cache hit opens the variant's file and nothing else, and

TODO.md

@@ -31,12 +31,15 @@ P2: security: per-origin rate limiting
 # Completed Steps
 
 - 2026-10-27 the reconciliation pass skips a directory it cannot list and a file
-  whose info it cannot read, and goes on (closes #343). It returned the error,
+  whose info it cannot read, and goes on (closes #343). It stopped before its
-  so one such entry stopped every pass before its later checks.
+  later checks at a directory it could not list, or at a source or variant file
-    - Each skipped entry gets the warning "skipped unreadable entry in cache
+  whose info it could not read.
-      directory", with its path and the error.
+    - It logs the warning "skipped unreadable entry in cache directory", with
-    - `reconcileFiles` reads each file's info and hands it to
+      the path and the error.
-      `reconcileVariantFile` and `reconcileSourceFile`.
+    - A file renamed or removed after its directory was listed gets no warning.
+    - `reconcileFiles` reads each file's info once, before the temp-file check,
+      and hands it to `sweepStaleTempFile`, `reconcileVariantFile` or
+      `reconcileSourceFile`.
     - A cancelled context still stops the walk with its error.
 - 2026-10-26 the reconciliation pass drops a variant's accounting row only when
   its file is missing (closes #340). Any other error reading the file's size

internal/imgcache/eviction.go

@@ -517,9 +517,10 @@ func (c *Cache) reconcileAccounting(ctx context.Context) error {
 // reconcileFiles walks baseDir, one of the cache's storage directories,
 // sweeping stale temp files and passing each other file, with its info and
 // name, to reconcileFile. It skips a directory it cannot list and a file
-// whose info it cannot read. Each gets a warning naming its path and the
+// whose info it cannot read, so one such entry does not stop the pass. It
-// error, and the walk goes on, so one such entry does not stop the pass.
+// logs a warning naming the path and the error. A file renamed or removed
-// Once ctx is cancelled it stops at the next file and returns ctx's error.
+// after its directory was listed is skipped with no warning. Once ctx is
+// cancelled it stops at the next file and returns ctx's error.
 func (c *Cache) reconcileFiles(
 	ctx context.Context, baseDir string,
 	reconcileFile func(path string, info fs.FileInfo, name string) error,
@@ -542,18 +543,22 @@ func (c *Cache) reconcileFiles(
 				return nil
 			}
 
-			name := entry.Name()
+			info, err := entry.Info()
+			if errors.Is(err, fs.ErrNotExist) {
+				return nil
+			}
 
-			if strings.HasPrefix(name, tempFilePrefix) {
+			if err != nil {
-				c.sweepStaleTempFile(path, entry)
+				c.log.Warn("skipped unreadable entry in cache directory",
+					"path", path, "error", err)
 
 				return nil
 			}
 
-			info, err := entry.Info()
+			name := entry.Name()
-			if err != nil {
+
-				c.log.Warn("skipped unreadable entry in cache directory",
+			if strings.HasPrefix(name, tempFilePrefix) {
-					"path", path, "error", err)
+				c.sweepStaleTempFile(path, info)
 
 				return nil
 			}
@@ -907,17 +912,12 @@ func (c *Cache) correctUsageTotal(
 
 // sweepStaleTempFile removes a temp file left behind by a crashed
 // write once it is old enough that no in-flight store can own it.
-func (c *Cache) sweepStaleTempFile(path string, entry fs.DirEntry) {
+func (c *Cache) sweepStaleTempFile(path string, info fs.FileInfo) {
-	info, err := entry.Info()
-	if err != nil {
-		return
-	}
-
 	if time.Since(info.ModTime()) < staleTempFileAge {
 		return
 	}
 
-	err = os.Remove(path)
+	err := os.Remove(path)
 	if err != nil && !os.IsNotExist(err) {
 		c.log.Warn("failed to remove stale temp file", "path", path, "error", err)
 

internal/imgcache/eviction_internal_test.go

@@ -787,15 +787,14 @@ func TestReconcileVariantRowsDropsOnlyRowsOfMissingFiles(t *testing.T) {
 	}
 }
 
-// makeEntriesTooLongToRead makes a chain of directories inside dir, each
+// openDirectoryNearPathLimit makes a chain of directories inside dir, each
 // named with 255 zeros, the longest name Linux allows. Linux refuses a path
 // of 4096 bytes or more, and the chain goes as deep as it can below that.
-// In its deepest directory it makes a directory and a file whose paths
+// It returns the chain's deepest directory as an os.Root, closed when the
-// reach that length. Even root can then neither list that directory nor
+// test ends. An entry made through it with a 255-byte name has a path even
-// read the file's info. It returns their two paths. It makes them through
+// the root user cannot read. The os.Root can make that entry because it
-// an os.Root, which names one directory at a time, as no call may name
+// names the entry only by its name, not by the whole path.
-// the whole path.
+func openDirectoryNearPathLimit(t *testing.T, dir string) *os.Root {
-func makeEntriesTooLongToRead(t *testing.T, dir string) []string {
 	t.Helper()
 
 	name := strings.Repeat("0", 255)
@@ -805,32 +804,85 @@ func makeEntriesTooLongToRead(t *testing.T, dir string) []string {
 		deepest = filepath.Join(deepest, name)
 	}
 
-	chain, err := filepath.Rel(dir, deepest)
+	err := os.MkdirAll(deepest, StorageDirPerm)
 	if err != nil {
-		t.Fatalf("filepath.Rel() error = %v", err)
+		t.Fatalf("failed to make a chain of directories: %v", err)
 	}
 
-	root, err := os.OpenRoot(dir)
+	root, err := os.OpenRoot(deepest)
 	if err != nil {
-		t.Fatalf("os.OpenRoot(%s) error = %v", dir, err)
+		t.Fatalf("os.OpenRoot(%s) error = %v", deepest, err)
 	}
 
-	defer func() { _ = root.Close() }()
+	t.Cleanup(func() { _ = root.Close() })
 
-	err = root.MkdirAll(filepath.Join(chain, name), StorageDirPerm)
+	return root
+}
+
+// makeEntriesTooLongToRead makes a new directory and a new file in the
+// deepest directory of the chain that openDirectoryNearPathLimit makes
+// inside dir. Even the root user can then neither list the new directory
+// nor read the new file's info. It returns the paths of the new directory
+// and the new file.
+func makeEntriesTooLongToRead(t *testing.T, dir string) []string {
+	t.Helper()
+
+	deepest := openDirectoryNearPathLimit(t, dir)
+	dirName := strings.Repeat("0", 255)
+
+	err := deepest.Mkdir(dirName, StorageDirPerm)
 	if err != nil {
 		t.Fatalf("failed to make a directory too deep to list: %v", err)
 	}
 
 	fileName := strings.Repeat("1", 255)
 
-	err = root.WriteFile(filepath.Join(chain, fileName), []byte("unreadable"),
+	err = deepest.WriteFile(fileName, []byte("unreadable"), StorageFilePerm)
-		StorageFilePerm)
 	if err != nil {
 		t.Fatalf("failed to make a file too deep to read: %v", err)
 	}
 
-	return []string{filepath.Join(deepest, name), filepath.Join(deepest, fileName)}
+	return []string{
+		filepath.Join(deepest.Name(), dirName),
+		filepath.Join(deepest.Name(), fileName),
+	}
+}
+
+// makeTempFileTooLongToRead makes a temp file in the deepest directory of
+// the chain that openDirectoryNearPathLimit makes inside dir. Even the
+// root user then cannot read the temp file's info. It returns the temp
+// file's path.
+func makeTempFileTooLongToRead(t *testing.T, dir string) string {
+	t.Helper()
+
+	deepest := openDirectoryNearPathLimit(t, dir)
+	name := tempFilePrefix + strings.Repeat("1", 255-len(tempFilePrefix))
+
+	err := deepest.WriteFile(name, []byte("partial"), StorageFilePerm)
+	if err != nil {
+		t.Fatalf("failed to make a temp file too deep to read: %v", err)
+	}
+
+	return filepath.Join(deepest.Name(), name)
+}
+
+// assertSkippedEntryWarning checks that logs hold the warning "skipped
+// unreadable entry in cache directory" naming path, with the error
+// ENAMETOOLONG for that path.
+func assertSkippedEntryWarning(t *testing.T, logs, path string) {
+	t.Helper()
+
+	for line := range strings.Lines(logs) {
+		if strings.Contains(line, `"level":"WARN"`) &&
+			strings.Contains(line, `"msg":"skipped unreadable entry in cache directory"`) &&
+			strings.Contains(line, `"path":"`+path+`"`) &&
+			strings.Contains(line, path+": "+syscall.ENAMETOOLONG.Error()) {
+			return
+		}
+	}
+
+	t.Errorf("no warning %q names %s with the error %q",
+		"skipped unreadable entry in cache directory", path, syscall.ENAMETOOLONG)
 }
 
 // TestReconciliationGoesOnPastEntriesItCannotRead puts, in each storage
@@ -884,11 +936,7 @@ func TestReconciliationGoesOnPastEntriesItCannotRead(t *testing.T) {
 	logs := reconcileAsAtStartup(t, cache)
 
 	for _, path := range unreadable {
-		assertWarningNames(t, logs, path)
+		assertSkippedEntryWarning(t, logs, path)
-
-		if !strings.Contains(logs, path+": "+syscall.ENAMETOOLONG.Error()) {
-			t.Errorf("no log line gives the error reading %s", path)
-		}
 	}
 
 	rowQuery := `SELECT COUNT(*) FROM variant_content WHERE cache_key = ?`
@@ -917,6 +965,27 @@ func TestReconciliationGoesOnPastEntriesItCannotRead(t *testing.T) {
 	}
 }
 
+// TestReconciliationWarnsOfTempFilesWhoseInfoItCannotRead puts, in each
+// storage directory, a temp file whose info the pass cannot read. The
+// pass must log a warning naming each one's path and the error, as it
+// does for any other file whose info it cannot read.
+func TestReconciliationWarnsOfTempFilesWhoseInfoItCannotRead(t *testing.T) {
+	t.Parallel()
+
+	cache, _ := newEvictionTestCache(t, 1<<30)
+
+	unreadable := []string{
+		makeTempFileTooLongToRead(t, cache.variants.baseDir),
+		makeTempFileTooLongToRead(t, cache.srcContent.baseDir),
+	}
+
+	logs := reconcileAsAtStartup(t, cache)
+
+	for _, path := range unreadable {
+		assertSkippedEntryWarning(t, logs, path)
+	}
+}
+
 // TestPeriodicReconciliationAdoptsFileThatAppearsAfterStartup proves
 // reconciliation is not a one-shot startup-only pass: it must also run
 // on the periodic ticker, so a variant file that lands on disk with no