REPO_POLICIES: apply the wordings from the latest compaction review

Applies the "Acceptable" wording of each of the seven findings at
#159 (comment), as
#159 (comment) says.

`TODO.md` carries the new size: 982 lines and 7,281 words.

Model: opus-5-5

.dockerignore

@@ -35,6 +35,12 @@
 # `services/api/.claude/` and must add its own anchored entry.
 .claude
 
+# yarn's install state and cache stay out, and its release file stays
+# in. Docker obeys the last matching line, so these two lines sit above
+# the secret patterns, which must win under .yarn/releases/.
+.yarn/*
+!.yarn/releases
+
 # Environment files. `*.env` covers bare `.env` and the `prod.env`
 # convention. Re-include a committed template with a negation if the
 # build needs one: `!docs/example.env`.
@@ -55,11 +61,8 @@
 **/[iI][dD]_[eE][dD]25519
 **/[iI][dD]_[eE][dD]25519_[sS][kK]
 
-# Dependencies: restored inside the image, never copied in. yarn's install
-# state and cache stay out, and its release file stays in.
+# Dependencies: restored inside the image, never copied in.
 **/node_modules
-.yarn/*
-!.yarn/releases
 
 # OS metadata.
 **/.DS_Store

.gitignore

@@ -22,9 +22,9 @@ node_modules/
 .yarn/*
 !.yarn/releases
 
-# Secrets. Unanchored like every entry above, so each matches at every
-# depth. Matching is case-sensitive on Linux, so names use character
-# ranges rather than a lowercase form that misses `Server.Key`.
+# Secrets. Unanchored, so each matches at every depth. Matching is
+# case-sensitive on Linux, so names use character ranges rather than a
+# lowercase form that misses `Server.Key`.
 
 # Environment files. `*.env` covers bare `.env` and the `prod.env`
 # convention. Only the templates `example.env` and `sample.env` are

Dockerfile

@@ -6,8 +6,8 @@
 # system packages. script/ passes a new value on every build. That value
 # reruns every RUN step below the ARG line, and the install step keeps
 # its layer. node and yarn come from the distribution, which is trusted,
-# so they need no version and no hash. That yarn hands the work to the
-# release file in .yarn/releases/, so every stage copies that file and
+# so they need no version and no hash. That yarn only starts the release
+# file in .yarn/releases/, so every stage copies that file and
 # .yarnrc.yml before it runs script/bootstrap.
 #
 # alpine 3.24.3, 2026-11-04

README.md

@@ -172,7 +172,8 @@ share, and evolve prompts across projects.
 The repository is a collection of Markdown files organized in the `prompts/`
 subdirectory. Each file contains one or more related prompts or policy
 documents. There is no build step or runtime component; the prompts are consumed
-by copying them into other projects or referencing them directly.
+by copying them into other projects or referencing them directly. `examples/`
+holds the example `Dockerfile` files that `prompts/REPO_POLICIES.md` links to.
 
 ## Template Repos
 

TODO.md

@@ -21,6 +21,23 @@ fmt-check, and commit.
 
 # Completed Steps
 
+- 2026-11-09: Compacted `prompts/REPO_POLICIES.md` from 1,165 lines and 8,556
+  words to 982 lines and 7,281 words
+  (https://git.eeqj.de/sneak/prompts/issues/158). Every rule keeps its meaning.
+  The rules now sit under headings, the pinning rule first. Each rule that was
+  stated in several places is stated once. The Makefile copies of the Go and
+  Python test commands are gone, because the `Dockerfile` examples carry the
+  same commands. Both checklists name the `.golangci.yml` section.
+- 2026-11-07: Go code is now formatted with `gofmt` and then `golines -m 77`
+  (https://git.eeqj.de/sneak/prompts/issues/160). `prompts/REPO_POLICIES.md`
+  says how `script/fmt`, `script/fmt-check` and `script/bootstrap` do it and
+  pins `golines`. The Go style guide and both checklists say the same. `lll`
+  stays at 88, since `golines` leaves long strings and comments as they are.
+- 2026-11-06: The pinning rule in `prompts/REPO_POLICIES.md` now opens with its
+  scope: what we download and install ourselves in scripts and Dockerfiles
+  (https://git.eeqj.de/sneak/prompts/issues/154). Distribution packages are
+  outside the rule, and updating and upgrading them is allowed. Both checklists
+  say the same.
 - 2026-11-04: Each repository now commits yarn 4 and installs with
   `yarn install --immutable` (https://git.eeqj.de/sneak/prompts/issues/149), on
   sneak's ruling at
@@ -36,6 +53,13 @@ fmt-check, and commit.
       and yarn.
     - Both checklists give the steps, and the ignore files keep yarn's install
       state out of git and the build context.
+- 2026-11-04: An agent whose work is confined to one package may run `go test`
+  directly on that package's suite, or on individual tests in it, while
+  iterating (https://git.eeqj.de/sneak/prompts/issues/51), on sneak's ruling at
+  https://git.eeqj.de/sneak/prompts/issues/51#issuecomment-167600. The full
+  `make check` is still required before every push, and the `Makefile` gains
+  nothing. The rule on Docker now names the lint and test gates, because a run
+  while iterating is not one.
 - 2026-11-04: node, yarn, npm, python, pip and venv now come from the
   distribution with no version and no hash
   (https://git.eeqj.de/sneak/prompts/issues/146), on sneak's ruling at

examples/go-lint-system-libraries.Dockerfile

@@ -0,0 +1,8 @@
+FROM golangci/golangci-lint@sha256:... AS lint
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends libvips-dev \
+    && rm -rf /var/lib/apt/lists/*
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
+ARG CACHEBUST

examples/go.Dockerfile

@@ -0,0 +1,85 @@
+# In every stage ARG CACHEBUST comes right after the steps that install
+# system packages and download Go's modules, or right after FROM in a
+# stage with neither, and every step that lints, tests or compiles
+# comes after it. script/ passes a new value on every build, which
+# reruns every RUN step after it. Docker keeps the layers above it
+# until the base image, their own lines or go.mod and go.sum change.
+# The steps that compile mount Go's build cache, and golangci-lint run
+# also mounts golangci-lint's; both survive from build to build.
+
+# Lint phase
+# golangci/golangci-lint:v2.x.x, YYYY-MM-DD
+FROM golangci/golangci-lint@sha256:... AS lint
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
+ARG CACHEBUST
+COPY . .
+RUN --mount=type=cache,target=/root/.cache/go-build \
+    --mount=type=cache,target=/root/.cache/golangci-lint \
+    golangci-lint run --config .golangci.yml ./...
+
+# Test phase. -race needs cgo and so a C compiler, which the Debian Go
+# image ships and the alpine one does not. -count=1 because the mounted
+# cache also holds test results, which go test would otherwise replay.
+# A first run that timed out gets no rerun, because a rerun would only
+# wait for the same hang.
+# golang:1.x, YYYY-MM-DD
+FROM golang@sha256:... AS test
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
+ARG CACHEBUST
+COPY . .
+RUN --mount=type=cache,target=/root/.cache/go-build \
+    status=0; \
+    output=$(go test -count=1 -timeout 90s -race -cover ./... 2>&1) || status=$?; \
+    printf '%s\n' "$output"; \
+    test "$status" -eq 0 && exit 0; \
+    case "$output" in \
+        *"panic: test timed out"*|*"*** Test killed"*) exit 1 ;; \
+    esac; \
+    echo "--- Rerunning with -v for details ---"; \
+    go test -count=1 -timeout 90s -race -v ./...; \
+    exit 1
+
+# Build stage. Nothing is wanted from either phase above; the copies
+# are what make BuildKit build them first, so nothing after them can
+# run unless lint and test passed.
+# golang:1.x-alpine, YYYY-MM-DD
+FROM golang@sha256:... AS builder
+# git comes from the base image's own distribution package index, which
+# is trusted, so it needs no version and no hash.
+RUN apk add --no-cache git
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
+ARG CACHEBUST
+COPY --from=lint /src/go.sum /dev/null
+COPY --from=test /src/go.sum /dev/null
+# A tar-stream context keeps the sender's file owners, which git refuses.
+RUN git config --system --add safe.directory /src
+COPY . .
+
+# The VERSION build arg when one is given, otherwise
+# `git describe --tags --always` on the .git in the build context. With
+# .git present, a version that is still empty, dev or unknown fails the
+# build: git is missing or could not read the checkout.
+ARG VERSION
+RUN --mount=type=cache,target=/root/.cache/go-build \
+    VERSION="${VERSION:-$(git describe --tags --always)}"; \
+    if [ -e .git ]; then \
+        case "$VERSION" in ""|dev|unknown) \
+            echo "version is '$VERSION' although .git is present" >&2; \
+            exit 1 ;; \
+        esac; \
+    fi; \
+    CGO_ENABLED=0 go build -trimpath \
+        -ldflags="-s -w -X main.Version=${VERSION}" \
+        -o /app ./cmd/app/
+
+# Runtime stage, and the last one
+FROM alpine@sha256:...
+ARG CACHEBUST
+COPY --from=builder /app /usr/local/bin/app
+ENTRYPOINT ["app"]

examples/python-test-phase.Dockerfile

@@ -0,0 +1,24 @@
+# Test phase. Both pytest runs share one 90-second timeout, so a hang
+# uses it once and gets no rerun.
+# debian:trixie-slim, YYYY-MM-DD
+FROM debian@sha256:... AS test
+# Python, pip and venv come from the distribution, which is trusted, so
+# they need no version and no hash. make and git are base tools that
+# script/bootstrap installs when they are missing. Installed here, they
+# stay in their own layer when script/ changes.
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends ca-certificates make git \
+        python3 python3-venv \
+    && rm -rf /var/lib/apt/lists/*
+# script/bootstrap installs pipenv in a virtual environment at
+# $HOME/.pipenv, and the tests below run that pipenv.
+ENV PATH=/root/.pipenv/bin:$PATH
+WORKDIR /app
+COPY script/ script/
+COPY Pipfile Pipfile.lock ./
+RUN script/bootstrap
+ARG CACHEBUST
+COPY . .
+RUN timeout 90 sh -c 'pipenv run pytest || { \
+        echo "--- Rerunning with -v for details ---"; \
+        pipenv run pytest -v; exit 1; }'

prompts/CODE_STYLEGUIDE_GO.md

@@ -1,13 +1,16 @@
 ---
 title: Code Styleguide — Go
-last_modified: 2026-10-18
+last_modified: 2026-11-07
 ---
 
-1.  Try to hard wrap long lines at 77 characters or less.
+1.  Format Go code with `gofmt` and then `golines -m 77`, through `make fmt`.
+    Don't commit anything `make fmt` would change. The only exception is when
+    committing things that aren't yet syntactically valid, which should only
+    happen pre-v0.0.1 or on a non-`main` branch.
 
-1.  Don't commit anything that hasn't been `go fmt`'d. The only exception is
-    when committing things that aren't yet syntactically valid, which should
-    only happen pre-v0.0.1 or on a non-`main` branch.
+1.  Hard wrap long lines at 77 characters or less. `golines` does this for code.
+    Wrap comments and long string literals by hand, since `golines` leaves them
+    as they are.
 
 1.  Even if you are planning to deal with only positive integers, use
     `int`/`int64` types instead of `uint`/`uint64` types. This is for

prompts/EXISTING_REPO_CHECKLIST.md

@@ -1,6 +1,6 @@
 ---
 title: Existing Repo Checklist
-last_modified: 2026-11-04
+last_modified: 2026-11-09
 ---
 
 Use this checklist when beginning work in a repo that may not yet conform to our
@@ -71,8 +71,8 @@ with your task.
       also mounts golangci-lint's
       (`--mount=type=cache,target=/root/.cache/golangci-lint`), and no step
       mounts anything else; both `go test` runs carry `-count=1`; a first run
-      that timed out gets no rerun, as in the canonical Go `Dockerfile` in
-      `REPO_POLICIES.md`
+      that timed out gets no rerun, as in `examples/go.Dockerfile` in the
+      `prompts` repo
 - [ ] Python: a `test` phase that installs its packages from `Pipfile.lock` does
       it above `ARG CACHEBUST`, with `COPY script/ script/`,
       `COPY Pipfile Pipfile.lock ./` and `RUN script/bootstrap`. When
@@ -92,8 +92,8 @@ with your task.
     installs no Python, because a step above it already did. `Pipfile` names no
     `python_version`, because `--deploy` stops when the distribution's Python
     differs from it. The tests run after `ARG CACHEBUST`, and every other stage
-    installs its Python packages after it, as in the Python `test` phase example
-    in `REPO_POLICIES.md`
+    installs its Python packages after it, as in
+    `examples/python-test-phase.Dockerfile` in the `prompts` repo
 
 - [ ] The gate phases invoke their tools directly, never through `make lint` or
       `script/test` — those are themselves a `docker build` and would recurse
@@ -163,17 +163,18 @@ with your task.
     - [ ] Go: `go.mod`, `go.sum`, `.golangci.yml` (fetch from
           `https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml` and,
           in the same commit, set the lint phase digest to the one named in the
-          `.golangci.yml` paragraph of `REPO_POLICIES.md`)
+          `.golangci.yml` section of `REPO_POLICIES.md`)
     - [ ] JS: `package.json`, `yarn.lock`, `.yarnrc.yml`, `.yarn/releases/`,
-          `.prettierrc`, `.prettierignore` (fetch the last two from
-          `https://git.eeqj.de/sneak/prompts/raw/branch/main/.prettierrc` and
+          `.gitattributes`, `.prettierrc`, `.prettierignore` (fetch the last two
+          from `https://git.eeqj.de/sneak/prompts/raw/branch/main/.prettierrc`
+          and
           `https://git.eeqj.de/sneak/prompts/raw/branch/main/.prettierignore`).
-    - [ ] JS: `yarn.lock` is in yarn 4's format. If its second line says
-          `yarn lockfile v1`, convert it with the steps below. Do them in one
-          commit with the re-vendored scripts, because yarn 1 ignores
-          `--immutable` and exits 0 on a tree with no `.yarnrc.yml`. Run them
-          with any distribution's node and yarn, and use `yarnpkg` on Debian and
-          Ubuntu.
+    - [ ] Any repository with `yarn.lock`: that file is in yarn 4's format. If
+          its second line says `yarn lockfile v1`, convert it with the steps
+          below. Do them in one commit with the re-vendored scripts, because
+          yarn 1 ignores `--immutable` and exits 0 on a tree with no
+          `.yarnrc.yml`. Run them with any distribution's node and yarn, and use
+          `yarnpkg` on Debian and Ubuntu.
         1. Read the version from `yarnPath` in
            `https://git.eeqj.de/sneak/prompts/raw/branch/main/.yarnrc.yml`.
         2. Run `yarn set version <version>`. It writes
@@ -187,12 +188,14 @@ with your task.
            `npmMinimalAgeGate` from `.yarnrc.yml`. The conversion wrote them.
            They allow install scripts, any git repository and packages of any
            age, which yarn otherwise refuses.
-        6. Name any package that must run its install script in `package.json`,
+        6. In `package.json`, name any package that must run its install script,
            as `"dependenciesMeta": { "<name>": { "built": true } }`, and run
            `yarn install` again.
-        7. Add `.yarn/*` and `!.yarn/releases` to `.gitignore` and
-           `.dockerignore`, `.yarn/` to `.prettierignore`, and
-           `.yarn/releases/** binary` to `.gitattributes`.
+        7. Add `.yarn/*` and `!.yarn/releases` above the secret patterns in
+           `.gitignore` and `.dockerignore`. Docker obeys the last matching
+           line, and the secret patterns must win. Add `.yarn/` to
+           `.prettierignore`, and `.yarn/releases/** binary` to
+           `.gitattributes`.
         8. Run `yarn install --immutable`. It must pass and change nothing.
     - [ ] Python: `pyproject.toml`
     - [ ] Docs/writing: `.prettierrc`, `.prettierignore` (same URLs as above)
@@ -231,8 +234,9 @@ with your task.
 - [ ] `script/bootstrap` installs node, yarn and the node packages only when
       `yarn.lock` is in the tree. node and yarn come from the distribution when
       they are missing. It installs the node packages with
-      `yarn install --immutable`. Whichever yarn the distribution packages hands
-      the work to the release file that `yarnPath` in `.yarnrc.yml` names.
+      `yarn install --immutable`. The distribution's yarn only starts the
+      release file that `yarnPath` in `.yarnrc.yml` names, and that file does
+      the work.
 - [ ] A `Dockerfile` stage that needs yarn may start from any distribution that
       packages node and yarn. It copies `package.json`, `yarn.lock`,
       `.yarnrc.yml` and `.yarn/releases/` before it runs `script/bootstrap`. A
@@ -255,29 +259,34 @@ with your task.
 
 # Formatting
 
-- [ ] Platform-standard formatter is configured (`black`, `prettier`, `go fmt`)
-- [ ] Default formatter config, only exception: four-space indents (except Go)
+- [ ] Platform-standard formatter is configured (`black`, `prettier`, and for Go
+      `gofmt` then `golines -m 77`)
+- [ ] Default formatter config, except four-space indents (not Go),
+      `proseWrap: always` for Markdown, and the Go 77-column limit
+- [ ] Go: `script/bootstrap` installs `golines` with `go install` pinned to a
+      commit hash; `script/fmt-check` fails when `gofmt` or `golines -m 77`
+      would change a file
 - [ ] All files pass `make fmt-check`
 
 # Git Hygiene
 
 - [ ] Pre-commit hook is installed (`make hooks`)
 - [ ] No secrets in the repo (`.env`, keys, credentials)
-- [ ] No mutable references in Dockerfiles or scripts (tags, `@latest`) — all
-      pinned by cryptographic hash with version/date comment. The one exception
-      is a package from the distribution's own package index, which needs no
-      version and no hash. Pulling that index is also allowed. In a
-      `Dockerfile`, the distribution is the pinned base image's. On a host, it
-      is the host's, and the host's package manager stands for it, nix and brew
-      included. A package source that a `Dockerfile` adds itself does not get
-      this exception
+- [ ] No mutable references (tags, `@latest`) to what the repo downloads and
+      installs itself in scripts and Dockerfiles — all pinned by cryptographic
+      hash with version/date comment. Distribution packages are outside this
+      rule. They need no version and no hash, and updating and upgrading them is
+      fine too. In a `Dockerfile`, the distribution is the pinned base image's.
+      On a host, it is the host's, and the host's package manager stands for it,
+      nix and brew included. A package source that a `Dockerfile` adds itself is
+      not the distribution's own, so its packages are pinned
 - [ ] node, yarn, npm, python, pip and venv come from the distribution wherever
       possible, never from nvm, pyenv, corepack or `npm install -g yarn`. If the
       distribution's version is too old, use a newer distribution. node means
       the distribution's newest Node package, such as `nodejs-current` on Alpine
       3.24
 - [ ] yarn's release file is in git under `.yarn/releases/`, written once by
-      `yarn set version` with an exact version
+      `yarn set version` with an exact version (repositories with `yarn.lock`)
 - [ ] Using `yarn`, not `npm` (JS projects)
 
 # Directory Structure

prompts/NEW_REPO_CHECKLIST.md

@@ -1,6 +1,6 @@
 ---
 title: New Repo Checklist
-last_modified: 2026-11-04
+last_modified: 2026-11-09
 ---
 
 Use this checklist when creating a new repository from scratch. Follow the steps
@@ -138,8 +138,8 @@ Template files can be fetched from:
       also mounts golangci-lint's
       (`--mount=type=cache,target=/root/.cache/golangci-lint`), and no step
       mounts anything else; both `go test` runs carry `-count=1`; a first run
-      that timed out gets no rerun, as in the canonical Go `Dockerfile` in
-      `REPO_POLICIES.md`
+      that timed out gets no rerun, as in `examples/go.Dockerfile` in the
+      `prompts` repo
     - Python: a `test` phase that installs its packages from `Pipfile.lock` does
       it above `ARG CACHEBUST`, with `COPY script/ script/`,
       `COPY Pipfile Pipfile.lock ./` and `RUN script/bootstrap`. When
@@ -160,8 +160,8 @@ Template files can be fetched from:
         because a step above it already did. `Pipfile` names no
         `python_version`, because `--deploy` stops when the distribution's
         Python differs from it. The tests run after `ARG CACHEBUST`, and every
-        other stage installs its Python packages after it, as in the Python
-        `test` phase example in `REPO_POLICIES.md`
+        other stage installs its Python packages after it, as in
+        `examples/python-test-phase.Dockerfile` in the `prompts` repo
 
     - Server: the final stage builds and runs the application
     - Non-server: the final stage brings up the dev environment
@@ -178,11 +178,12 @@ Template files can be fetched from:
     - [ ] Go: `go mod init sneak.berlin/go/<name>`, `.golangci.yml` (fetch from
           `https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml` and,
           in the same commit, set the lint phase digest to the one named in the
-          `.golangci.yml` paragraph of `REPO_POLICIES.md`)
-    - [ ] JS: make the first `yarn.lock` with the steps below.
-          `script/bootstrap` installs no yarn until `yarn.lock` exists, so run
-          them with any distribution's node and yarn, such as Alpine's
-          (`apk add nodejs-current yarn`). Use `yarnpkg` on Debian and Ubuntu.
+          `.golangci.yml` section of `REPO_POLICIES.md`)
+    - [ ] JS, or any repository that runs prettier through yarn: make the first
+          `yarn.lock` with the steps below. `script/bootstrap` installs no yarn
+          until `yarn.lock` exists, so run them with any distribution's node and
+          yarn, such as Alpine's (`apk add nodejs-current yarn`). Use `yarnpkg`
+          on Debian and Ubuntu.
         1. Read the version from `yarnPath` in
            `https://git.eeqj.de/sneak/prompts/raw/branch/main/.yarnrc.yml`.
         2. Run `yarn set version <version>`. It writes
@@ -210,9 +211,9 @@ are thin shims calling them. Model scripts:
     - It installs node, yarn and the node packages only when `yarn.lock` is in
       the tree. node and yarn come from that package manager when they are
       missing.
-    - It installs the node packages with `yarn install --immutable`. Whichever
-      yarn the distribution packages hands the work to the release file that
-      `yarnPath` in `.yarnrc.yml` names.
+    - It installs the node packages with `yarn install --immutable`. The
+      distribution's yarn only starts the release file that `yarnPath` in
+      `.yarnrc.yml` names, and that file does the work.
     - A non-server repo's development environment stage runs it, with only
       system packages installed inline above it.
     - A gate phase or the build stage installs what its base image lacks, either
@@ -232,9 +233,11 @@ are thin shims calling them. Model scripts:
       which writes no image. No lint verdict may come from a host invocation of
       the linter.
 - [ ] `script/fmt` / `make fmt` — formats code (writes; native, never in a
-      container)
+      container). Go code gets `gofmt`, then `golines -m 77`.
 - [ ] `script/fmt-check` / `make fmt-check` — checks formatting (read-only;
-      native)
+      native). Fails when `gofmt` or `golines -m 77` would change a Go file.
+- [ ] Go: `script/bootstrap` installs `golines` with `go install` pinned to a
+      commit hash
 - [ ] `script/check` / `make check` — runs `test`, `lint`, `fmt-check`; must not
       modify files
 - [ ] `script/projectname` — outputs the project name (used by `script/docker`
@@ -284,19 +287,20 @@ are thin shims calling them. Model scripts:
       final stage is missing its `COPY --from=` edge to the gate phases.
 - [ ] No secrets in repo, and none in the build context: enumerate a probe image
       rather than reading `.dockerignore`
-- [ ] No mutable image/package references. The one exception is a package from
-      the distribution's own package index, which needs no version and no hash.
-      Pulling that index is also allowed. In a `Dockerfile`, the distribution is
-      the pinned base image's. On a host, it is the host's, and the host's
-      package manager stands for it, nix and brew included. A package source
-      that a `Dockerfile` adds itself does not get this exception
+- [ ] No mutable references to what the repo downloads and installs itself in
+      scripts and Dockerfiles. Distribution packages are outside this rule. They
+      need no version and no hash, and updating and upgrading them is fine too.
+      In a `Dockerfile`, the distribution is the pinned base image's. On a host,
+      it is the host's, and the host's package manager stands for it, nix and
+      brew included. A package source that a `Dockerfile` adds itself is not the
+      distribution's own, so its packages are pinned
 - [ ] node, yarn, npm, python, pip and venv come from the distribution wherever
       possible, never from nvm, pyenv, corepack or `npm install -g yarn`. If the
       distribution's version is too old, use a newer distribution. node means
       the distribution's newest Node package, such as `nodejs-current` on Alpine
       3.24
 - [ ] yarn's release file is in git under `.yarn/releases/`, written once by
-      `yarn set version` with an exact version
+      `yarn set version` with an exact version (repositories with `yarn.lock`)
 - [ ] No unnecessary files in repo root
 - [ ] All dates written as YYYY-MM-DD
 

script/bootstrap

@@ -4,10 +4,10 @@
 # installed tools are skipped. Base tools, node and yarn come from nix,
 # apt, brew, or apk (detected in that order), with no version and no
 # hash, because the distribution is trusted. It installs node, yarn and
-# the node packages only when yarn.lock is in the tree. Whichever yarn
-# the distribution packages hands the work to the release file that
-# yarnPath in .yarnrc.yml names, so git pins the yarn that runs. Assumes
-# nothing is present.
+# the node packages only when yarn.lock is in the tree. The
+# distribution's yarn only starts the release file that yarnPath in
+# .yarnrc.yml names, and that file does the work. So git pins the yarn
+# that runs. Assumes nothing is present.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
@@ -80,7 +80,7 @@ main() {
 
     # A Dockerfile stage that needs no yarn copies no yarn.lock.
     if [ -f yarn.lock ]; then
-        if missing node; then pkg_install nodejs nodejs node nodejs-current; fi
+        if missing node; then pkg_install nodejs_latest nodejs node nodejs-current; fi
         if missing yarn && missing yarnpkg; then
             pkg_install yarn yarnpkg yarn yarn
         fi