build: add a make cover target for per-function coverage (closes #17)

make cover writes build/coverage.out and prints the per-function report;
make cover-html renders the same profile to build/coverage.html. The
per-package percentage make test prints cannot say which function is
untested.

Both write files, so neither is in check, and neither may be added to it:
check must not modify the working tree. Their output lands under the
already-ignored build/.

Verified: make cover printed per-function lines and a 62.6% total,
make cover-html wrote build/coverage.html, and git status stayed clean.
GOFLAGS=-count=1 make check green in 24s with the lint layer executing
(12.0s, "0 issues.", not CACHED) and the suite running for real (cmd/rogue
1.037s, game 3.410s); check is still fmt-check lint test and git status is
clean afterwards.

.dockerignore

@@ -0,0 +1,8 @@
+# Part of the lint gate: only what reaches the container is linted, so
+# excluding a self-contained Go source here drops it from the lint silently.
+# Never exclude Go sources, go.mod/go.sum or .golangci.yml.
+.git
+
+# Generated artifacts only; `make build` puts a multi-megabyte binary here
+# and it would otherwise be shipped into the build context.
+/build/

.gitignore

@@ -1,4 +1,5 @@
 *.log
 *.out
 *.test
+/build/
 /rogue

Dockerfile.lint

@@ -0,0 +1,20 @@
+# Lint image, built by script/lint: golangci-lint runs as a build step, so
+# a successful build is a clean lint.
+
+# golangci/golangci-lint:v2.12.2 (Debian-based), 2026-08-07
+FROM golangci/golangci-lint:v2.12.2@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240 AS deps
+
+WORKDIR /src
+
+COPY go.mod go.sum ./
+RUN go mod download
+
+# This stage must stay the one that runs golangci-lint, and its name must
+# match $stage in script/lint. --target halts the build at this stage, so
+# moving the lint step to another stage, or adding a stage after this one,
+# is not caught.
+FROM deps AS lint
+
+COPY . .
+
+RUN golangci-lint run --config .golangci.yml ./...

Makefile

@@ -1,18 +1,47 @@
 # Development convenience targets. This repo is exempt from the standard
-# policy scaffold (no Dockerfile, CI, or REPO_POLICIES.md); this Makefile
-# is only a thin wrapper around the Go toolchain, golangci-lint, and
-# prettier so `make fmt` / `make check` behave the same as in sneak's
-# other repos.
+# policy scaffold (no CI config, no REPO_POLICIES.md, no application
+# Dockerfile) except for the lint container: per sneak's 2026-08-09
+# ruling, linting runs in docker only, so Dockerfile.lint and script/lint
+# are part of this repo. This Makefile is otherwise only a thin wrapper
+# around the Go toolchain and prettier so `make fmt` / `make check` behave
+# the same as in sneak's other repos.
 
 GO_PKGS   := ./...
 MD_FILES  := $(shell git ls-files '*.md')
 PRETTIER  := prettier --tab-width 4 --prose-wrap always
 
-.PHONY: check fmt fmt-check lint test
+# Every generated artifact goes here, and the whole directory is
+# git-ignored. Targets that write outside it can commit their output.
+BUILD_DIR := build
+BIN       := $(BUILD_DIR)/rogue
+COVERPROF := $(BUILD_DIR)/coverage.out
+COVERHTML := $(BUILD_DIR)/coverage.html
 
-# Format, lint, and test — the full local pre-commit gate.
+.PHONY: build check cover cover-html fmt fmt-check lint test
+
+# Format, lint, and test — the full local pre-commit gate. Keep this list
+# to targets that write nothing into the working tree.
 check: fmt-check lint test
 
+# Build the executable into $(BUILD_DIR). `go build -o` does not create the
+# parent directory.
+build:
+	@mkdir -p $(BUILD_DIR)
+	go build -o $(BIN) ./cmd/rogue
+
+# Per-function coverage, for finding which functions are untested. The
+# percentage `make test` prints is a per-package total and cannot answer
+# that. Writes files, so it stays out of `check`.
+cover:
+	@mkdir -p $(BUILD_DIR)
+	go test -timeout 30s -coverprofile=$(COVERPROF) $(GO_PKGS)
+	go tool cover -func=$(COVERPROF)
+
+# Render the same profile as annotated source.
+cover-html: cover
+	go tool cover -html=$(COVERPROF) -o $(COVERHTML)
+	@echo "wrote $(COVERHTML)"
+
 # Format Go and Markdown in place.
 fmt:
 	gofmt -w .
@@ -26,9 +55,11 @@ fmt-check:
 	fi
 	$(PRETTIER) --check $(MD_FILES)
 
-# Run the house linter (config in .golangci.yml).
+# Run the house linter. golangci-lint is never installed on the host: the
+# work happens inside the pinned container built by Dockerfile.lint, and
+# this target is a thin shim over the script that builds it.
 lint:
-	golangci-lint run $(GO_PKGS)
+	./script/lint
 
 # Run the test suite. Quiet on success; on failure, rerun verbosely for the
 # full output and still fail the target (the first run already proved the

README.md

@@ -21,19 +21,19 @@ original program structure and the design of this port.
 Requires Go 1.25 or later and a terminal at least 80x24.
 
 ```bash
-go build ./cmd/rogue
-./rogue
+make build
+./build/rogue
 ```
 
 ```bash
 # Restore a saved game
-./rogue ~/rogue.save
+./build/rogue ~/rogue.save
 
 # View high scores
-./rogue -s
+./build/rogue -s
 
 # Test the death screen (demo mode)
-./rogue -d
+./build/rogue -d
 ```
 
 ## In-game commands
@@ -57,7 +57,7 @@ Press `?` in game for the full list.
 export ROGUEOPTS="name=YourName,terse,jump,fruit=mango"
 
 # Wizard (debug) mode, with a reproducible dungeon
-ROGUE_WIZARD=1 SEED=12345 ./rogue
+ROGUE_WIZARD=1 SEED=12345 ./build/rogue
 ```
 
 The scoreboard is kept in `~/.rogue.scores`. Save files are Go gob snapshots
@@ -77,10 +77,14 @@ sequences, dungeon-generation golden checks, and an RNG compatibility test
 against the original C generator.
 
 For development, the `Makefile` wraps the toolchain: `make fmt` (gofmt +
-prettier), `make lint` (golangci-lint), `make test` (the suite, under the race
-detector with coverage and a timeout), and `make check` (all three). Use the
-targets rather than invoking `go test` directly — they carry the flags the
-project relies on.
+prettier), `make lint` (`script/lint`, which runs golangci-lint inside the
+pinned container built from `Dockerfile.lint` — it is never installed on the
+host, so docker is required), `make test` (the suite, under the race detector
+with coverage and a timeout), `make check` (all three), `make build` (the
+executable), and `make cover` / `make cover-html` (per-function coverage, and
+the same profile as annotated source at `build/coverage.html`). Everything they
+generate lands in the git-ignored `build/`. Use the targets rather than the
+toolchain directly — they carry the flags the project relies on.
 
 ## License
 

TODO.md

@@ -35,6 +35,125 @@ is finished.
 
 # Completed Steps
 
+- 2026-08-10 `make cover` added (https://git.eeqj.de/sneak/rgoue/issues/17).
+  `make cover` writes `build/coverage.out` and prints the per-function report;
+  `make cover-html` renders the same profile to `build/coverage.html`. The
+  per-package percentage `make test` prints cannot say _which_ function is
+  untested, which is how the coverage gaps closed so far had to be found — by
+  grepping test files for identifiers.
+
+    Neither target is in `check`, and neither may be added to it: both write
+    files, and `make check` must not modify the working tree.
+
+- 2026-08-10 `make build` added (https://git.eeqj.de/sneak/rgoue/issues/19). The
+  executable is built to `build/rogue`; `README.md` no longer contains a raw
+  `go` invocation anywhere. `build` is in neither `check` nor `test` —
+  `make check` stays `fmt-check lint test` and still writes nothing into the
+  working tree.
+
+    Generated artifacts now all live under `build/`, which `.gitignore` covers
+    as a whole. Anything written outside it is committable, so a target that
+    puts its output elsewhere reintroduces the stray-artifact problem.
+
+- 2026-08-10 Linting moved into a container
+  (https://git.eeqj.de/sneak/rgoue/issues/41). `golangci-lint` is no longer
+  invoked on the host anywhere in the repo: `Dockerfile.lint` pins
+  `golangci/golangci-lint:v2.12.2` by digest and runs the linter as a build
+  step, so a successful build is a clean lint, and `make lint` is now a shim
+  over `script/lint`. This is what killed the false green seen earlier, where a
+  branch that was genuinely red with a `goconst` finding reported `0 issues` off
+  the shared host cache; a container per run has its own cache and lock.
+
+    `script/lint` builds with `--target "$stage"`, `--no-cache-filter="$stage"`
+    and `--output=type=cacheonly`. The durable property to check when touching
+    any of this: the lint stage executes on every run and is never served from
+    cache. Three things no tooling checks, left to whoever edits the gate —
+    `$stage` must match the stage name in `Dockerfile.lint`; that stage must
+    stay the one running `golangci-lint`, since `--target` halts the build
+    there; and `.dockerignore` governs what reaches the container, so excluding
+    a self-contained Go source drops it from the lint silently.
+
+    Verified rather than assumed, since a green docker build is the classic
+    false green: two consecutive runs on an unchanged tree each showed the
+    `golangci-lint run` layer executing and reporting `0 issues.` while the
+    `deps` layers reported `CACHED`; the same build with `--no-cache-filter`
+    removed reported that layer `CACHED`, so the re-execution is attributable to
+    the flag rather than to a changed context; deliberate violations failed the
+    build naming the specific finding and reverted clean; a stage-name typo
+    failed loudly at exit 1; and a Go file excluded via `.dockerignore` reported
+    `0 issues.` at exit 0 with the violation still in the tree. Wall-clock
+    durations vary per host and per run, so they are not recorded here.
+
+- 2026-08-09 `TestAutoSaveOnSignalRacesTurnLoop` de-flaked at the cause
+  (`fix/autosave-turn-budget-36`, closes #36). The failure text was captured
+  before anything was changed and it is **not** a data race: the assertion was
+  `driveUntilDone`'s
+  `t.Fatal("the turn loop ran out of turns before the saves were taken")`, with
+  no `WARNING: DATA RACE` anywhere in the log. The handoff fixed in #24 was
+  working; the test's own drive loop was running out of its fixed 1000-turn
+  budget first.
+
+    Confirmed rather than taken on trust. Instrumenting the loop to report the
+    turns it actually used showed the count tracking scheduling pressure and
+    nothing else: about 60-120 turns at host load ~57 with the whole machine to
+    spread over, 418 at `GOMAXPROCS=4`, 539 and 655 at 2 and 1, and past 1000 —
+    the recorded failure — under the doubled load of the verbose rerun that the
+    test target performs after a failure. The turns between one save being
+    answered and the next request arriving are not work; they are the saving
+    goroutine's wake-up latency, so a fixed turn count is a wall-clock
+    assumption in disguise, which is why raising it would have hidden the flake
+    rather than fixed it.
+
+    So the budget is gone rather than larger. `driveUntilDone` now drives until
+    the saving goroutine finishes and nothing else. Termination is not lost, it
+    just belongs to the code under test instead of to the test: every
+    `AutoSaveOnSignal` returns within the timeout it is handed, so the saving
+    goroutine always finishes. A handoff that has stopped answering costs one
+    `autoSaveWait` in total — `g.sigSave` is one deep, so an unserviced request
+    stays in the channel and every later call finds it full and fails at once —
+    and the failure is then the real assertion (`saves taken = 0, want 25`)
+    instead of "out of turns". The worst case is not that one: a handoff that
+    drains each request but slower than `autoSaveWait` costs one timeout per
+    save, `wantSaves × autoSaveWait` = 250s, which would run past the 30s
+    package timeout instead of reaching the assertion. It takes ~10s of
+    scheduler starvation per save against a measured 0.12s per 1000 turns, so it
+    is remote, and the turn cap did not bound it either. The comment in the test
+    states that bound rather than the optimistic one.
+
+    Removing the cap exposed a second assumption underneath it, which is the
+    reason this is not a one-line diff. `testTerm` answers space and newline for
+    ever once its script is exhausted, and neither key takes a turn, so
+    `command()` — which loops until the player consumes one — never returns; the
+    old cap was silently sized to the script (4000 characters, two per turn,
+    against 1000 turns). An uncapped drive wedged inside a single `command()`
+    call. The two drive tests therefore use a new `driveTerm`, a headless
+    terminal whose script repeats. Repeating is necessary but not sufficient,
+    and the test says so: `' '` clears `After` outright and all eight movement
+    keys clear it on a refused step, so a script of only those keys wedges just
+    as `testTerm`'s tail did. What makes the wedge impossible is that the cycle
+    always holds an _unconditional_ turn-taker, and these scripts hold two —
+    `'.'` (empty handler) and `'s'` (`search`, which writes `After` on no path),
+    neither refusable by blocked-in-all-directions, `Held`, a bear trap, or
+    `NoCommand > 0`. Removing both would bring the wedge back.
+
+    Both halves of the definition of done were demonstrated by mutation, with
+    the deliberately-broken tree reverted afterwards and `.golangci.yml` left
+    byte-identical (sha256 `021cc83f...46bcb`). Reverting #24 —
+    `AutoSaveOnSignal` replaced by a direct `g.autoSave()`, encoding on the
+    calling goroutine — still fails the test with 139 `WARNING: DATA RACE`
+    reports naming `snapshotHeader` reading what `executeCommand` writes, so the
+    guard is undiminished. Removing the `serviceAutoSaveRequest` call from
+    `command()` still fails it too, now in 10s with `saves taken = 0, want 25`
+    rather than by hanging.
+
+    Under load, an A/B at `GOMAXPROCS=2` on a 48-core host at load ~150, with an
+    unrelated deliberate failure in the tree so that every run took the verbose
+    rerun: the old code failed 8 of 8 runs with "ran out of turns"; the new code
+    failed 0 of 8, the only failure being the planted one. Also green across 24
+    concurrent unconstrained runs at load ~120, 10 runs alongside a spinner
+    load, and 5 runs each at `GOMAXPROCS` 1, 2 and 4. `make check` green, lint 0
+    issues.
+
 - 2026-08-09 Wizard commands under test (`test/wizard-coverage`, closes #7): the
   last of the three thin spots, so the coverage step is now closed rather than
   narrowed. `game/wizard.go`'s eight functions had no tests of their own, and
@@ -55,29 +174,40 @@ is finished.
     from the port leaves every weapon test green — which is the evidence that
     the line is dead for weapons. The armor arm has no such clobber and does
     keep the curse. (2) **`show_map`'s standout is asymmetric in C and symmetric
-    here.** C tests `!(real & F_REAL)` before drawing and `!real` after, and
-    since `new_level` seeds every square with `p_flags = F_REAL` the squares
-    that lose it keep other bits (`F_PASS` from `putpass`, a non-zero
-    `rnd(NTRAPS)` from the trap loop), so C turns standout on at the first
-    secret square and never off — the rest of the map renders reversed.
-    `game/wizard.go` tests `isReal` both times and highlights the one square.
-    That is a display-only difference in a wizard-only command and was reported
-    on the issue rather than changed here; the test asserts the map characters
-    unconditionally but the standout attribute only up to the first secret
-    square, so it pins nothing that C contradicts.
+    here.** C tests `!(real & F_REAL)` before drawing and `!real` — the whole
+    flag word — after. `new_level` seeds every square with `p_flags = F_REAL`,
+    and exactly three sites clear that bit. `passages.c putpass` sets `F_PASS`
+    first, so its secret passage is left at `0x80`. `passages.c door`'s
+    secret-door arm clears it on a room-wall exit whose flags are still exactly
+    `F_REAL` (`rooms.c` writes no `p_flags` at all), leaving `p_flags == 0`; its
+    per-square gate is `rnd(5) == 0` against `putpass`'s `rnd(40) == 0`, and
+    `game/passages.go`'s `door` reproduces it. `new_level`'s trap loop then ORs
+    in `rnd(NTRAPS)`, which is `abs((int) RN) % 8` and so yields `0..7`, and
+    `T_DOOR` is `00` — an unsprung trapdoor square is also exactly zero
+    (`be_trapped` is what later ORs `F_SEEN` into it). So C _does_ turn standout
+    off again, at secret doors and unsprung trapdoors; what it gets wrong is
+    leaking the attribute forward from a secret passage or a non-trapdoor trap
+    until it reaches one of those. Intermittent bands of reverse video, not a
+    permanently reversed map. `game/wizard.go` tests `isReal` both times and
+    highlights the one square. That is a display-only difference in a
+    wizard-only command and was reported on the issue rather than changed here;
+    the test asserts the map characters unconditionally but the standout
+    attribute only up to the first secret square, so it pins nothing that C
+    contradicts.
 
     Two things the tests had to be built around. The `insist` arm of `whatis` is
     a loop whose only exits are picking a matching item and `n_objs == 0`, so a
-    script that runs dry hangs instead of failing — every sequence here ends in
-    an abort tail, the `n_objs == 0` exit is reached the way a player reaches it
-    (`*` for a list with nothing appropriate in the pack) rather than by poking
-    the counter, and the one mutation that deletes that exit is the only one of
-    the 30 that fails by timeout instead of fast, necessarily so. And `show_map`
-    does **not** mark squares seen — it writes into `hw` and touches no `PLACE`
-    at all — so the issue's wording for it could not be tested as written; the
-    loop bounds are asserted instead by planting a marker in the rows C's loop
-    excludes, since those rows are blank on a real level and copying blanks over
-    blanks would have made the bound unfalsifiable.
+    script that runs dry hangs instead of failing — every sequence that can
+    re-prompt ends in an abort tail, the `n_objs == 0` exit is reached the way a
+    player reaches it (`*` for a list with nothing appropriate in the pack)
+    rather than by poking the counter, and the one mutation that deletes that
+    exit is the only one of the 30 that fails by timeout instead of fast,
+    necessarily so. And `show_map` does **not** mark squares seen — it writes
+    into `hw` and touches no `PLACE` at all — so the issue's wording for it
+    could not be tested as written; the loop bounds are asserted instead by
+    planting a marker in the rows C's loop excludes, since those rows are blank
+    on a real level and copying blanks over blanks would have made the bound
+    unfalsifiable.
 
 - 2026-08-09 Wands and staffs under test (`test/sticks-coverage`, closes #6):
   the second of the three thin spots the Next Step names. `game/sticks.go` was
@@ -114,6 +244,92 @@ is finished.
   reach only mean something against known walls and a known passage number. All
   27 mutations tried against the new tests were caught.
 
+- 2026-08-09 Trap unit-test coverage (`test/traps-coverage`, closes #14):
+  `trapHandlers` had eight entries and **zero** direct tests, on the one
+  subsystem besides combat that can kill the hero outright. New
+  `game/traps_test.go` (19 tests, 15 subtests) covers all eight arms of
+  `move.c be_trapped`, the prologue every trap runs through, and the
+  `rust_armor` tail `T_RUST` calls. Package coverage 56.2% -> 57.9% measured on
+  `main` at `bf820e3`, the branch point, before the sticks tests landed. Every
+  expected value is transcribed from `origin/c-master` and quoted in the file.
+  **No divergence from C was found.**
+
+    The issue body's trap list was wrong and the correction is the first thing
+    worth recording: there is no separate "poison dart" trap — `T_DART` **is**
+    the poisoned dart, its death message being "a poisoned dart killed you" —
+    and the list omitted `T_MYST`, the mystery trap, whose arm is an eleven-way
+    `rnd(11)` message switch. `rogue.h` 192-200 is the authority
+    (`T_DOOR`/`T_ARROW`/`T_SLEEP`/`T_BEAR`/`T_TELEP`/`T_DART`/`T_RUST`/`T_MYST`,
+    `NTRAPS` 8) and the Go `TrapKind` iota matches it index-for-index.
+
+    Three C details the tests are built around. (1) `BEARTIME` and `SLEEPTIME`
+    are `spread(3)` and `spread(5)` (`rogue.h` 108-109), and `spread` is
+    `nm - nm/20 + rnd(nm/10)`; for both, `nm/10` is 0 and C's `rnd` short
+    circuits a zero range without touching the generator, so each is an exact
+    constant that costs **no** random number — and the tests assert the no-draw
+    half as well as the value, because a stray draw desynchronises the
+    seed-compatible stream. (2) `T_ARROW` swings at `s_lvl - 1` and `T_DART` at
+    `s_lvl + 1`: opposite signs, which is exactly the kind of detail a
+    transliterating port drops. (3) The strength loss is gated on
+    `!ISWEARING(R_SUSTSTR) && !save(VS_POISON)`, and the `&&` is load-bearing —
+    with the ring on, C never rolls the save, so the arm must spend two random
+    numbers and not three.
+
+    Two shapes worth keeping, both forced by mutation results rather than
+    foresight. Damage dice are checked by a **sweep**, not one shot: `rnd(n)` is
+    "raw value % n", so a single draw agrees between a d6 and a d5 five times in
+    six and leaves the generator identical either way — the first draft's
+    single-trial arrow test passed with `roll(1,6)` mutated to `roll(1,5)`.
+    Likewise the swing arguments are pinned by a 200-trial boundary sweep at a
+    mid-range to-hit target: a forced hit and a forced miss cannot see a wrong
+    `at_lvl` or a dropped `op_arm`, because both arms are reachable at any level
+    and swing spends one `rnd(20)` regardless.
+
+    Mutation-proved, 33 mutations, each reverted, and every one of them is now
+    caught. Three were **not** caught on the first pass and the tests were
+    strengthened until they were, which is the useful part of the record. (a)
+    Deleting `new_level()` from `T_DOOR` left the suite green: `be_trapped`'s
+    own prologue stamps the trap glyph into the cell the hero fell through, so
+    "the map changed" is true even with no new level dug. The test now counts
+    differing cells — exactly one can change that way — and also requires the
+    staircase to move and the hero to be re-placed. (b) The `roll(1,6)` case
+    above.
+
+    (c) **`be_trapped` takes a coordinate, and which coordinate decides whether
+    `T_TELEP`'s `mvaddch(tc, TRAP)` does anything.** Deleting that line first
+    left the suite green, and the first draft wrote that off as an unavoidable
+    redundancy — wrongly, because the test only exercised one of the two call
+    sites. `move.go` 105-108 (`case Floor`) springs a trap under the hero and
+    passes `p.Pos`; there `tc` **is** the hero's square, the prologue has
+    already set its `p_ch` to `TRAP`, and `teleport()` opens by drawing
+    `floor_at()` — which returns `chat(hero)` — over it, so the glyph is on
+    screen before the line runs. But `move.go` 94-98 (`case Trap`), the ordinary
+    walk onto a hidden trap, passes `nh`, the square being stepped **onto**,
+    with the hero still on the previous square: `teleport()`'s opening `mvaddch`
+    paints the old square, `leave_room` writes blanks and never `TRAP`, and
+    nothing calls `look()` afterwards because the `case Trap` arm returns before
+    `finishMove` for a teleporter. There `mvaddch(tc, TRAP)` is the only writer,
+    exactly as C's comment says.
+    `TestTrapTeleportDrawsTheTrapOnTheSquareSteppedOnto` springs the trap at a
+    floor square next to the hero and pins it: unmutated the screen at `tc`
+    reads `^`, with the line deleted it reads `.`.
+
+    The other 30 each failed their own test and only their own; two also moved
+    `TestAutoSaveOnSignalRacesTurnLoop`, which drives real turns and is
+    legitimately sensitive to `BEARTIME` and to armor rusting.
+
+    Deliberately uncovered: the two death messages, "an arrow killed you" and "a
+    poisoned dart killed you". Each is printed immediately before `death()`,
+    which reaches `myExit` and `os.Exit`, so provoking either would take the
+    test binary with it; the hero is pinned with `fortify()` and the damage
+    rolls are checked by replaying C's arithmetic instead of by letting HP reach
+    zero. They are the only two: `rust_armor`'s `|| ISWEARING(R_SUSTARM)`
+    operand and its `if (!to_death)` suppression of the rust-vanishes message,
+    the last predicates that had no assertion, are pinned by
+    `TestTrapRustHonoursTheRingAndTheToDeathFlag`. This entry does **not**
+    rotate `Next Step`: #14 was an out-of-band gap found while surveying, not
+    part of the rings/sticks/wizard step.
+
 - 2026-08-09 Ring unit-test coverage (`test/rings-coverage`, closes #5): the
   first third of the standing coverage step. `game/rings.go` had **zero** tests
   — not one of the 32 in the suite touched wear, removal, hand choice, or the
@@ -538,7 +754,11 @@ is finished.
   24 long lines wrapped or their comments tightened, control bytes in
   `term/tcell.go` as character literals, and two `wsl_v5` defer cuddles. The
   repo has no golangci-lint version pin to bump (no Dockerfile or CI;
-  `make lint` runs whatever `golangci-lint` is on the host).
+  `make lint` runs whatever `golangci-lint` is on the host). Superseded
+  2026-08-10: there is a pin now, and no host lint path — `Dockerfile.lint` pins
+  the linter image by digest and `script/lint` runs it in a container. See the
+  2026-08-10 entry at the top of this section
+  (https://git.eeqj.de/sneak/rgoue/issues/41).
 
 - 2026-07-24 Seed compatibility — item tables (seed-compat): instrumented the C
   reference on modern-rogue with a DUMP mode (testdata/c_seedcompat.patch) that
@@ -686,7 +906,13 @@ is finished.
    per-game dungeon dimensions instead of the 80x24 constants; open design
    questions are resize policy, gameplay tuning at larger sizes, and a --classic
    80x24 mode.
-2. Note: this repo is exempt from the standard policy scaffold. A minimal dev
-   Makefile (fmt/fmt-check/lint/test/check targets) exists per sneak's
-   2026-07-07 request, but do not add a Dockerfile, CI config, or
-   REPO_POLICIES.md.
+2. Note: this repo is exempt from the standard policy scaffold, but the
+   exemption is narrower than it was. A minimal dev Makefile
+   (fmt/fmt-check/lint/test/check targets) exists per sneak's 2026-07-07
+   request. `Dockerfile.lint` and `script/lint` are now also permitted, and
+   required, along with the `.dockerignore` that scopes their build context:
+   sneak's 2026-08-09 ruling (https://git.eeqj.de/sneak/rgoue/issues/41) is that
+   every repo lints in a container invoked through `script/lint`, and being
+   later and explicit it overrides the 2026-07-07 exemption for those three
+   files only. Still do not add: CI config, `REPO_POLICIES.md`, an application
+   `Dockerfile`, or any other `script/` entrypoint.

game/autosave_test.go

@@ -9,7 +9,6 @@ import (
 	"io"
 	"os"
 	"path/filepath"
-	"strings"
 	"testing"
 	"time"
 )
@@ -17,7 +16,9 @@ import (
 // autoSaveWait is the deadline the tests hand AutoSaveOnSignal when they
 // expect the save to be taken. It is long enough that a loaded machine
 // cannot turn a working handoff into a spurious failure, and it is never
-// actually waited out on a passing run.
+// actually waited out on a passing run. It is also what bounds
+// driveUntilDone, by way of the saving goroutine it waits for — see
+// there for what that bound comes to.
 const autoSaveWait = 10 * time.Second
 
 // TestAutoSaveOnSignalRacesTurnLoop is the test issue #24 exists for: it
@@ -34,12 +35,14 @@ const autoSaveWait = 10 * time.Second
 func TestAutoSaveOnSignalRacesTurnLoop(t *testing.T) {
 	t.Parallel()
 
-	// Same mix as TestTurnLoopCrashSweep: the spaces answer any --More--
-	// prompt, and the script is long enough that the drive never runs it
-	// out.
-	script := []byte(strings.Repeat("h j k l y u b n s . ", 400))
+	// Same mix as TestTurnLoopCrashSweep — the spaces answer any --More--
+	// prompt — on a driveTerm, so the drive can run for as long as the
+	// saves take rather than for as long as a script lasts. The '.' and
+	// the 's' are what make an unbounded drive safe, and at least one of
+	// the two has to stay in the cycle: see driveTerm.
+	term := &driveTerm{script: []byte("h j k l y u b n s . ")}
 
-	g := New(Params{Seed: 20260809, Term: &testTerm{input: script}})
+	g := New(Params{Seed: 20260809, Term: term})
 	g.FileName = filepath.Join(t.TempDir(), "rogue.save")
 	g.startLevel()
 	g.prePlay()
@@ -74,14 +77,50 @@ func TestAutoSaveOnSignalRacesTurnLoop(t *testing.T) {
 
 // driveUntilDone runs turns until the saving goroutine is finished,
 // fortifying the hero each turn so no death exits the test binary. The
-// turn cap keeps a broken handoff from hanging the suite instead of
-// failing it.
+// condition it waits on is that goroutine finishing — nothing else.
+//
+// It used to stop after a fixed 1000 turns and fail, and that cap was a
+// load-sensitive assumption wearing a counter's clothes (issue #36). The
+// turns this loop spends between one save request being answered and the
+// next arriving are not work; they are the saving goroutine's scheduling
+// latency, so the turn count 25 saves costs is a function of how
+// contended the machine is rather than of anything the code under test
+// does. Measured here on a 48-core host at load ~57: about 60-120 turns
+// with a whole machine to spread over, 418 to 655 as GOMAXPROCS was cut
+// from 4 to 1, and past 1000 under the doubled load of the verbose
+// rerun, which is the flake this replaces. A budget that has to be
+// guessed cannot be guessed right, so there is no budget.
+//
+// Dropping it costs no termination guarantee, because the bound belongs
+// to the code under test and not to this loop: each AutoSaveOnSignal
+// call returns within the timeout the caller hands it, so the saving
+// goroutine always finishes and done always closes. That bound is worth
+// stating exactly, because it is not one autoSaveWait.
+//
+// A handoff that has stopped answering altogether costs one, in total,
+// however many saves were asked for. g.sigSave
+// is one deep, so the unserviced request stays in the channel and every
+// later call finds it full and reports failure immediately — measured
+// at 10.0s for 25 saves with the service point deleted from command().
+// What fails is then the caller's own assertion, the count of saves
+// actually taken, which says far more than "out of turns" ever did.
+//
+// A handoff that still drains every request but takes longer than
+// autoSaveWait to do it is the worst case, and costs one timeout per
+// save: wantSaves * autoSaveWait, 250s at these constants, which would
+// run past the package timeout rather than reach the assertion. It
+// takes about ten seconds of scheduler starvation per save to get
+// there, against a regime measured at 0.12s per 1000 turns, so it is
+// remote — and the 1000-turn cap did not bound it either, a turn count
+// being no kind of time bound. `go test -timeout 30s` is the backstop
+// under all of it.
+//
+// The one thing the caller does have to supply is a terminal that can
+// feed an unbounded drive: see driveTerm.
 func driveUntilDone(t *testing.T, g *RogueGame, done <-chan struct{}) {
 	t.Helper()
 
-	const maxTurns = 1000
-
-	for range maxTurns {
+	for {
 		select {
 		case <-done:
 			return
@@ -91,8 +130,6 @@ func driveUntilDone(t *testing.T, g *RogueGame, done <-chan struct{}) {
 		fortify(g)
 		g.command()
 	}
-
-	t.Fatal("the turn loop ran out of turns before the saves were taken")
 }
 
 // TestAutoSaveOnSignalWhileBlockedOnInput is the case the fix is really
@@ -266,9 +303,7 @@ func TestAutoSaveOnSignalTimesOutLeavingTheOldSave(t *testing.T) {
 func TestAutoSaveOnSignalWithoutASaveFile(t *testing.T) {
 	t.Parallel()
 
-	g := New(Params{Seed: 5, Term: &testTerm{
-		input: []byte(strings.Repeat("s . ", 200)),
-	}})
+	g := New(Params{Seed: 5, Term: &driveTerm{script: []byte("s . ")}})
 	g.FileName = ""
 	g.startLevel()
 	g.prePlay()
@@ -437,6 +472,66 @@ func mkBlockedGame(t *testing.T, term Terminal) *RogueGame {
 	return g
 }
 
+// driveTerm is a headless Terminal whose script repeats instead of
+// running out, for the tests that drive the turn loop until something
+// else finishes rather than for a set number of turns.
+//
+// testTerm cannot do that job. Once its script is exhausted it answers
+// space and newline for ever, and neither takes a turn, so command() —
+// which loops until the player does something that consumes one, the
+// `if !g.After { ntimes++ }` in command.c — never returns. A drive with
+// a turn cap sized to its script never notices; a drive that runs until
+// the saves are taken wedges inside a single command() call, which is
+// what a first attempt at issue #36 did.
+//
+// Repeating the script is necessary but nowhere near sufficient, and
+// the difference is what anyone editing one of these scripts has to
+// know. Most keys take a turn only conditionally. ' ' is the "legal
+// illegal command" and clears After outright (tables.go). All eight
+// movement keys clear it whenever the step is refused: a wall or the
+// map edge (move.go moveResolve), an illegal diagonal (moveTarget), or
+// a confused step that lands back in place (moveHero). A script of
+// nothing but those keys wedges exactly the way testTerm's tail does,
+// repetition or no repetition — with the script set to just " " this
+// drive hits the 30s package timeout inside command().
+//
+// What actually makes the wedge impossible is that the cycle always
+// contains at least one *unconditional* turn-taker, and the scripts
+// here carry two: '.', the rest command, whose handler is empty, and
+// 's', search, which writes After on no path. Nothing refuses either
+// one — not being blocked in all eight directions, not Held, not stuck
+// in a bear trap, and not NoCommand > 0, where playTurn skips
+// executeCommand altogether and After is simply left true. Trim both
+// out and the wedge this test exists to remove comes straight back.
+//
+// One further precondition, from what this fake does not supply:
+// testTerm's tail answered a newline every other read and this does
+// not. Nothing reachable from these scripts asks for one — waitFor('\n')
+// sits on the death and score paths (rip.go, score.go), which fortify
+// prevents from ever being reached — but a script that could reach them
+// would park in waitFor for ever.
+type driveTerm struct {
+	script []byte
+	pos    int
+}
+
+func (t *driveTerm) Render(*Window) {}
+
+func (t *driveTerm) Repaint() {}
+
+func (t *driveTerm) Fini() {}
+
+// Interrupt has nothing to wake: this terminal's ReadChar never blocks.
+func (t *driveTerm) Interrupt() {}
+
+// ReadChar hands out the next scripted key, wrapping at the end.
+func (t *driveTerm) ReadChar() (byte, bool) {
+	ch := t.script[t.pos]
+	t.pos = (t.pos + 1) % len(t.script)
+
+	return ch, true
+}
+
 // blockingTerm is a Terminal that genuinely blocks in ReadChar until a
 // key is pushed or Interrupt wakes it — which testTerm, whose reads never
 // block, cannot reproduce.

game/wizard_test.go

@@ -928,12 +928,18 @@ func TestCreateRingOtherKindsAreLeftAlone(t *testing.T) {
 //	...
 //	if (!real) wstandend(hw);        /* whole word, not the bit */
 //
-// new_level.c seeds every square with p_flags = F_REAL, and the squares
-// that lose F_REAL keep other bits (F_PASS from putpass, a non-zero
-// rnd(NTRAPS) from the trap loop), so C turns standout on at the first
-// secret square and never turns it off again. game/wizard.go tests isReal
-// both times and highlights the single square. That divergence is
-// reported on issue #7 rather than settled here, so this test asserts only
+// new_level.c seeds every square with p_flags = F_REAL, and exactly three
+// sites clear that bit. putpass sets F_PASS first, so a secret passage is
+// left at 0x80. door's secret-door arm clears it on a room-wall exit whose
+// flags are still exactly F_REAL, leaving p_flags == 0. And the trap loop
+// ORs in rnd(NTRAPS), which is 0..7, so the T_DOOR (00) case is zero too
+// until be_trapped ORs F_SEEN in. So C's wstandend does fire, at secret
+// doors and unsprung trapdoors; what it gets wrong is leaking standout
+// forward from a secret passage or a non-trapdoor trap until it reaches
+// one of those — intermittent bands, not a permanently reversed map.
+// game/wizard.go tests isReal both times and highlights the single square.
+// That divergence is reported on issue #7 rather than settled here, so
+// this test asserts only
 // what both agree on: the characters everywhere, standout on every
 // non-real square, and no standout on real squares before the first
 // non-real one.
@@ -979,10 +985,10 @@ func TestShowMapRendersTheWholeLevel(t *testing.T) {
 	}
 }
 
-// TestShowMapLeavesTheRowsCOmits pins the loop bounds. C starts at y = 1
+// TestShowMapLoopBoundsMatchC pins the loop bounds. C starts at y = 1
 // and stops before NUMLINES-1, so the top line stays free for show_win's
 // prompt and the status line is never overwritten.
-func TestShowMapLeavesTheRowsCOmits(t *testing.T) {
+func TestShowMapLoopBoundsMatchC(t *testing.T) {
 	t.Parallel()
 
 	g := mkWizard(t, 32, 10)

script/lint

@@ -0,0 +1,37 @@
+#!/bin/sh
+# script/lint: lint in docker. golangci-lint is never installed on the host.
+#
+# Traps, each of which yields a green run over an unlinted or partly linted
+# tree:
+#
+# 1. --target and --no-cache-filter must both stay, and $stage must match
+#    the stage name in Dockerfile.lint. BuildKit ignores --no-cache-filter
+#    when no stage matches its argument, serving the lint layer from cache
+#    without a word; --target rejects a name that is not in the file, which
+#    is what makes the single $stage safe.
+#
+# 2. --target checks that the stage exists, not that it is the stage
+#    running golangci-lint, and it halts the build there. Moving the lint
+#    step to another stage, or adding a stage after it, is not caught.
+#
+# 3. .dockerignore decides what reaches the container, and only what
+#    reaches it is linted. Excluding a self-contained Go file drops it from
+#    the lint silently. Never exclude Go sources, go.mod/go.sum or
+#    .golangci.yml.
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+# Must match the stage name in Dockerfile.lint.
+stage=lint
+
+main() {
+    cd "$ROOT"
+    docker build \
+        --target "$stage" \
+        --no-cache-filter="$stage" \
+        --output=type=cacheonly \
+        -f Dockerfile.lint .
+}
+
+main "$@"