TODO.md: remove the work log, keep only open work (closes #167)

Drop the Completed Steps log and the finished "commit this TODO.md"
item. Git keeps the history.

Model: opus-5-5

.gitattributes

@@ -1,2 +1,7 @@
+# Every PR adds an entry at the top of TODO.md's Completed Steps; union keeps
+# both sides instead of conflicting. Git never reports a conflict here: read
+# the merged entries after every merge or rebase.
+TODO.md merge=union
+
 # yarn's release file is one opaque file in diffs and merges.
 .yarn/releases/** binary

TODO.md

@@ -2,7 +2,7 @@
 
 - branch (from `main`)
 - do the work in Next Step
-- delete Next Step from `TODO.md`
+- move Next Step to the top of Completed Steps
 - move the top item of Future Steps into Next Step
 - commit (`TODO.md` changes in the same commit as the work)
 - merge to `main` if the branch is not protected, otherwise open a PR

script/install-precommit

@@ -8,8 +8,8 @@ ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 main() {
     cd "$ROOT"
     hook=".git/hooks/pre-commit"
-    printf '#!/bin/sh\nset -e\nscript/precommit\n' > "$hook"
-    chmod +x "$hook"
+    printf '#!/bin/sh\nset -e\nscript/precommit\n' > .git/hooks/pre-commit
+    chmod +x .git/hooks/pre-commit
     echo "pre-commit hook installed: runs script/precommit"
 }
 

script/lint

@@ -1,11 +1,11 @@
 #!/bin/sh
 # script/lint: run the linter. Linting is a phase of the Dockerfile and
-# this builds that phase; the linter is never installed or run on
+# this builds that phase alone; the linter is never installed or run on
 # a developer host, where a shared result cache and a host-global lock
 # make its answer untrustworthy.
 #
-# --target builds the lint phase and the stages it depends on, nothing
-# else. A new CACHEBUST value reruns every RUN step after
+# The phase is not the last stage in the file, so it is built only when
+# --target names it. A new CACHEBUST value reruns every RUN step after
 # the ARG CACHEBUST line, since a cached lint layer is a lint that did
 # not run; unlike --no-cache, it keeps the layers above that line and
 # the cache mounts. This relies on every stage of the Dockerfile

script/test

@@ -1,8 +1,8 @@
 #!/bin/sh
 # script/test: run the test suite. Testing is a phase of the Dockerfile
-# and this builds that phase, on the same terms as script/lint:
-# --target so that only the test phase and the stages it depends on are
-# built, and a new CACHEBUST value because a cached test layer is a test
+# and this builds that phase alone, on the same terms as script/lint:
+# --target because a phase that is not the last stage is built only when
+# named, and a new CACHEBUST value because a cached test layer is a test
 # that did not run; unlike --no-cache, it keeps the layers above the ARG
 # CACHEBUST line and the cache mounts. This relies on every stage of the
 # Dockerfile declaring ARG CACHEBUST before every step that lints, tests