Cover the wizard commands with C-verified unit tests (closes #7)

game/wizard.go had no tests of its own. It is not purely a debug
surface: set_know writes the per-game discovered tables that name items
in ordinary play, and teleport is what the teleport ring calls every
fiftieth turn, so a defect in either leaks into a normal game.

Adds coverage for createObj (pack filing and the gold arm),
createWeaponArmor, createRing, showMap, whatis, whatisPick, setKnow,
teleport and command.go's wizardKit. Package coverage 60.6% -> 62.4%.
Expected values are transcribed from wizard.c, command.c, extern.c,
weapons.c and rogue.h rather than read off the port; wizard mode is
entered through Params.Wizard, the field main.go fills from
ROGUE_WIZARD, so no test pokes the flag.

Two notes from the C. A wizard-created "cursed" weapon is not cursed in
either language: init_weapon assigns o_flags over the ISCURSED bit
create_obj had just set, leaving only the o_hplus penalty, and the test
pins the whole flag word to the init_dam[] row to say so. C's show_map
turns standout on for a non-real square but only off for a square whose
whole flag word is zero, which no secret square has, so C leaks the
attribute across the rest of the map where the port does not; that
display-only difference is reported on the issue and left alone here,
and the test asserts standout only up to the first secret square.

No game behavior is changed.

.dockerignore

@@ -1,8 +0,0 @@
-# Part of the lint gate: only what reaches the container is linted, so
-# excluding a self-contained Go source here drops it from the lint silently.
-# Never exclude Go sources, go.mod/go.sum or .golangci.yml.
-.git
-
-# Generated artifacts only; `make build` puts a multi-megabyte binary here
-# and it would otherwise be shipped into the build context.
-/build/

.gitignore

@@ -1,5 +1,4 @@
 *.log
 *.out
 *.test
-/build/
 /rogue

Dockerfile.lint

@@ -1,20 +0,0 @@
-# Lint image, built by script/lint: golangci-lint runs as a build step, so
-# a successful build is a clean lint.
-
-# golangci/golangci-lint:v2.12.2 (Debian-based), 2026-08-07
-FROM golangci/golangci-lint:v2.12.2@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240 AS deps
-
-WORKDIR /src
-
-COPY go.mod go.sum ./
-RUN go mod download
-
-# This stage must stay the one that runs golangci-lint, and its name must
-# match $stage in script/lint. --target halts the build at this stage, so
-# moving the lint step to another stage, or adding a stage after this one,
-# is not caught.
-FROM deps AS lint
-
-COPY . .
-
-RUN golangci-lint run --config .golangci.yml ./...

Makefile

@@ -1,47 +1,18 @@
 # Development convenience targets. This repo is exempt from the standard
-# policy scaffold (no CI config, no REPO_POLICIES.md, no application
-# Dockerfile) except for the lint container: per sneak's 2026-08-09
-# ruling, linting runs in docker only, so Dockerfile.lint and script/lint
-# are part of this repo. This Makefile is otherwise only a thin wrapper
-# around the Go toolchain and prettier so `make fmt` / `make check` behave
-# the same as in sneak's other repos.
+# policy scaffold (no Dockerfile, CI, or REPO_POLICIES.md); this Makefile
+# is only a thin wrapper around the Go toolchain, golangci-lint, and
+# prettier so `make fmt` / `make check` behave the same as in sneak's
+# other repos.
 
-GO_PKGS   := ./...
-MD_FILES  := $(shell git ls-files '*.md')
-PRETTIER  := prettier --tab-width 4 --prose-wrap always
+GO_PKGS  := ./...
+MD_FILES := $(shell git ls-files '*.md')
+PRETTIER := prettier --tab-width 4 --prose-wrap always
 
-# Every generated artifact goes here, and the whole directory is
-# git-ignored. Targets that write outside it can commit their output.
-BUILD_DIR := build
-BIN       := $(BUILD_DIR)/rogue
-COVERPROF := $(BUILD_DIR)/coverage.out
-COVERHTML := $(BUILD_DIR)/coverage.html
+.PHONY: check fmt fmt-check lint test
 
-.PHONY: build check cover cover-html fmt fmt-check lint test
-
-# Format, lint, and test — the full local pre-commit gate. Keep this list
-# to targets that write nothing into the working tree.
+# Format, lint, and test — the full local pre-commit gate.
 check: fmt-check lint test
 
-# Build the executable into $(BUILD_DIR). `go build -o` does not create the
-# parent directory.
-build:
-	@mkdir -p $(BUILD_DIR)
-	go build -o $(BIN) ./cmd/rogue
-
-# Per-function coverage, for finding which functions are untested. The
-# percentage `make test` prints is a per-package total and cannot answer
-# that. Writes files, so it stays out of `check`.
-cover:
-	@mkdir -p $(BUILD_DIR)
-	go test -timeout 30s -coverprofile=$(COVERPROF) $(GO_PKGS)
-	go tool cover -func=$(COVERPROF)
-
-# Render the same profile as annotated source.
-cover-html: cover
-	go tool cover -html=$(COVERPROF) -o $(COVERHTML)
-	@echo "wrote $(COVERHTML)"
-
 # Format Go and Markdown in place.
 fmt:
 	gofmt -w .
@@ -55,11 +26,9 @@ fmt-check:
 	fi
 	$(PRETTIER) --check $(MD_FILES)
 
-# Run the house linter. golangci-lint is never installed on the host: the
-# work happens inside the pinned container built by Dockerfile.lint, and
-# this target is a thin shim over the script that builds it.
+# Run the house linter (config in .golangci.yml).
 lint:
-	./script/lint
+	golangci-lint run $(GO_PKGS)
 
 # Run the test suite. Quiet on success; on failure, rerun verbosely for the
 # full output and still fail the target (the first run already proved the

README.md

@@ -21,19 +21,19 @@ original program structure and the design of this port.
 Requires Go 1.25 or later and a terminal at least 80x24.
 
 ```bash
-make build
-./build/rogue
+go build ./cmd/rogue
+./rogue
 ```
 
 ```bash
 # Restore a saved game
-./build/rogue ~/rogue.save
+./rogue ~/rogue.save
 
 # View high scores
-./build/rogue -s
+./rogue -s
 
 # Test the death screen (demo mode)
-./build/rogue -d
+./rogue -d
 ```
 
 ## In-game commands
@@ -57,7 +57,7 @@ Press `?` in game for the full list.
 export ROGUEOPTS="name=YourName,terse,jump,fruit=mango"
 
 # Wizard (debug) mode, with a reproducible dungeon
-ROGUE_WIZARD=1 SEED=12345 ./build/rogue
+ROGUE_WIZARD=1 SEED=12345 ./rogue
 ```
 
 The scoreboard is kept in `~/.rogue.scores`. Save files are Go gob snapshots
@@ -77,14 +77,10 @@ sequences, dungeon-generation golden checks, and an RNG compatibility test
 against the original C generator.
 
 For development, the `Makefile` wraps the toolchain: `make fmt` (gofmt +
-prettier), `make lint` (`script/lint`, which runs golangci-lint inside the
-pinned container built from `Dockerfile.lint` — it is never installed on the
-host, so docker is required), `make test` (the suite, under the race detector
-with coverage and a timeout), `make check` (all three), `make build` (the
-executable), and `make cover` / `make cover-html` (per-function coverage, and
-the same profile as annotated source at `build/coverage.html`). Everything they
-generate lands in the git-ignored `build/`. Use the targets rather than the
-toolchain directly — they carry the flags the project relies on.
+prettier), `make lint` (golangci-lint), `make test` (the suite, under the race
+detector with coverage and a timeout), and `make check` (all three). Use the
+targets rather than invoking `go test` directly — they carry the flags the
+project relies on.
 
 ## License
 

TODO.md

@@ -35,125 +35,6 @@ is finished.
 
 # Completed Steps
 
-- 2026-08-10 `make cover` added (https://git.eeqj.de/sneak/rgoue/issues/17).
-  `make cover` writes `build/coverage.out` and prints the per-function report;
-  `make cover-html` renders the same profile to `build/coverage.html`. The
-  per-package percentage `make test` prints cannot say _which_ function is
-  untested, which is how the coverage gaps closed so far had to be found — by
-  grepping test files for identifiers.
-
-    Neither target is in `check`, and neither may be added to it: both write
-    files, and `make check` must not modify the working tree.
-
-- 2026-08-10 `make build` added (https://git.eeqj.de/sneak/rgoue/issues/19). The
-  executable is built to `build/rogue`; `README.md` no longer contains a raw
-  `go` invocation anywhere. `build` is in neither `check` nor `test` —
-  `make check` stays `fmt-check lint test` and still writes nothing into the
-  working tree.
-
-    Generated artifacts now all live under `build/`, which `.gitignore` covers
-    as a whole. Anything written outside it is committable, so a target that
-    puts its output elsewhere reintroduces the stray-artifact problem.
-
-- 2026-08-10 Linting moved into a container
-  (https://git.eeqj.de/sneak/rgoue/issues/41). `golangci-lint` is no longer
-  invoked on the host anywhere in the repo: `Dockerfile.lint` pins
-  `golangci/golangci-lint:v2.12.2` by digest and runs the linter as a build
-  step, so a successful build is a clean lint, and `make lint` is now a shim
-  over `script/lint`. This is what killed the false green seen earlier, where a
-  branch that was genuinely red with a `goconst` finding reported `0 issues` off
-  the shared host cache; a container per run has its own cache and lock.
-
-    `script/lint` builds with `--target "$stage"`, `--no-cache-filter="$stage"`
-    and `--output=type=cacheonly`. The durable property to check when touching
-    any of this: the lint stage executes on every run and is never served from
-    cache. Three things no tooling checks, left to whoever edits the gate —
-    `$stage` must match the stage name in `Dockerfile.lint`; that stage must
-    stay the one running `golangci-lint`, since `--target` halts the build
-    there; and `.dockerignore` governs what reaches the container, so excluding
-    a self-contained Go source drops it from the lint silently.
-
-    Verified rather than assumed, since a green docker build is the classic
-    false green: two consecutive runs on an unchanged tree each showed the
-    `golangci-lint run` layer executing and reporting `0 issues.` while the
-    `deps` layers reported `CACHED`; the same build with `--no-cache-filter`
-    removed reported that layer `CACHED`, so the re-execution is attributable to
-    the flag rather than to a changed context; deliberate violations failed the
-    build naming the specific finding and reverted clean; a stage-name typo
-    failed loudly at exit 1; and a Go file excluded via `.dockerignore` reported
-    `0 issues.` at exit 0 with the violation still in the tree. Wall-clock
-    durations vary per host and per run, so they are not recorded here.
-
-- 2026-08-09 `TestAutoSaveOnSignalRacesTurnLoop` de-flaked at the cause
-  (`fix/autosave-turn-budget-36`, closes #36). The failure text was captured
-  before anything was changed and it is **not** a data race: the assertion was
-  `driveUntilDone`'s
-  `t.Fatal("the turn loop ran out of turns before the saves were taken")`, with
-  no `WARNING: DATA RACE` anywhere in the log. The handoff fixed in #24 was
-  working; the test's own drive loop was running out of its fixed 1000-turn
-  budget first.
-
-    Confirmed rather than taken on trust. Instrumenting the loop to report the
-    turns it actually used showed the count tracking scheduling pressure and
-    nothing else: about 60-120 turns at host load ~57 with the whole machine to
-    spread over, 418 at `GOMAXPROCS=4`, 539 and 655 at 2 and 1, and past 1000 —
-    the recorded failure — under the doubled load of the verbose rerun that the
-    test target performs after a failure. The turns between one save being
-    answered and the next request arriving are not work; they are the saving
-    goroutine's wake-up latency, so a fixed turn count is a wall-clock
-    assumption in disguise, which is why raising it would have hidden the flake
-    rather than fixed it.
-
-    So the budget is gone rather than larger. `driveUntilDone` now drives until
-    the saving goroutine finishes and nothing else. Termination is not lost, it
-    just belongs to the code under test instead of to the test: every
-    `AutoSaveOnSignal` returns within the timeout it is handed, so the saving
-    goroutine always finishes. A handoff that has stopped answering costs one
-    `autoSaveWait` in total — `g.sigSave` is one deep, so an unserviced request
-    stays in the channel and every later call finds it full and fails at once —
-    and the failure is then the real assertion (`saves taken = 0, want 25`)
-    instead of "out of turns". The worst case is not that one: a handoff that
-    drains each request but slower than `autoSaveWait` costs one timeout per
-    save, `wantSaves × autoSaveWait` = 250s, which would run past the 30s
-    package timeout instead of reaching the assertion. It takes ~10s of
-    scheduler starvation per save against a measured 0.12s per 1000 turns, so it
-    is remote, and the turn cap did not bound it either. The comment in the test
-    states that bound rather than the optimistic one.
-
-    Removing the cap exposed a second assumption underneath it, which is the
-    reason this is not a one-line diff. `testTerm` answers space and newline for
-    ever once its script is exhausted, and neither key takes a turn, so
-    `command()` — which loops until the player consumes one — never returns; the
-    old cap was silently sized to the script (4000 characters, two per turn,
-    against 1000 turns). An uncapped drive wedged inside a single `command()`
-    call. The two drive tests therefore use a new `driveTerm`, a headless
-    terminal whose script repeats. Repeating is necessary but not sufficient,
-    and the test says so: `' '` clears `After` outright and all eight movement
-    keys clear it on a refused step, so a script of only those keys wedges just
-    as `testTerm`'s tail did. What makes the wedge impossible is that the cycle
-    always holds an _unconditional_ turn-taker, and these scripts hold two —
-    `'.'` (empty handler) and `'s'` (`search`, which writes `After` on no path),
-    neither refusable by blocked-in-all-directions, `Held`, a bear trap, or
-    `NoCommand > 0`. Removing both would bring the wedge back.
-
-    Both halves of the definition of done were demonstrated by mutation, with
-    the deliberately-broken tree reverted afterwards and `.golangci.yml` left
-    byte-identical (sha256 `021cc83f...46bcb`). Reverting #24 —
-    `AutoSaveOnSignal` replaced by a direct `g.autoSave()`, encoding on the
-    calling goroutine — still fails the test with 139 `WARNING: DATA RACE`
-    reports naming `snapshotHeader` reading what `executeCommand` writes, so the
-    guard is undiminished. Removing the `serviceAutoSaveRequest` call from
-    `command()` still fails it too, now in 10s with `saves taken = 0, want 25`
-    rather than by hanging.
-
-    Under load, an A/B at `GOMAXPROCS=2` on a 48-core host at load ~150, with an
-    unrelated deliberate failure in the tree so that every run took the verbose
-    rerun: the old code failed 8 of 8 runs with "ran out of turns"; the new code
-    failed 0 of 8, the only failure being the planted one. Also green across 24
-    concurrent unconstrained runs at load ~120, 10 runs alongside a spinner
-    load, and 5 runs each at `GOMAXPROCS` 1, 2 and 4. `make check` green, lint 0
-    issues.
-
 - 2026-08-09 Wizard commands under test (`test/wizard-coverage`, closes #7): the
   last of the three thin spots, so the coverage step is now closed rather than
   narrowed. `game/wizard.go`'s eight functions had no tests of their own, and
@@ -174,40 +55,29 @@ is finished.
     from the port leaves every weapon test green — which is the evidence that
     the line is dead for weapons. The armor arm has no such clobber and does
     keep the curse. (2) **`show_map`'s standout is asymmetric in C and symmetric
-    here.** C tests `!(real & F_REAL)` before drawing and `!real` — the whole
-    flag word — after. `new_level` seeds every square with `p_flags = F_REAL`,
-    and exactly three sites clear that bit. `passages.c putpass` sets `F_PASS`
-    first, so its secret passage is left at `0x80`. `passages.c door`'s
-    secret-door arm clears it on a room-wall exit whose flags are still exactly
-    `F_REAL` (`rooms.c` writes no `p_flags` at all), leaving `p_flags == 0`; its
-    per-square gate is `rnd(5) == 0` against `putpass`'s `rnd(40) == 0`, and
-    `game/passages.go`'s `door` reproduces it. `new_level`'s trap loop then ORs
-    in `rnd(NTRAPS)`, which is `abs((int) RN) % 8` and so yields `0..7`, and
-    `T_DOOR` is `00` — an unsprung trapdoor square is also exactly zero
-    (`be_trapped` is what later ORs `F_SEEN` into it). So C _does_ turn standout
-    off again, at secret doors and unsprung trapdoors; what it gets wrong is
-    leaking the attribute forward from a secret passage or a non-trapdoor trap
-    until it reaches one of those. Intermittent bands of reverse video, not a
-    permanently reversed map. `game/wizard.go` tests `isReal` both times and
-    highlights the one square. That is a display-only difference in a
-    wizard-only command and was reported on the issue rather than changed here;
-    the test asserts the map characters unconditionally but the standout
-    attribute only up to the first secret square, so it pins nothing that C
-    contradicts.
+    here.** C tests `!(real & F_REAL)` before drawing and `!real` after, and
+    since `new_level` seeds every square with `p_flags = F_REAL` the squares
+    that lose it keep other bits (`F_PASS` from `putpass`, a non-zero
+    `rnd(NTRAPS)` from the trap loop), so C turns standout on at the first
+    secret square and never off — the rest of the map renders reversed.
+    `game/wizard.go` tests `isReal` both times and highlights the one square.
+    That is a display-only difference in a wizard-only command and was reported
+    on the issue rather than changed here; the test asserts the map characters
+    unconditionally but the standout attribute only up to the first secret
+    square, so it pins nothing that C contradicts.
 
     Two things the tests had to be built around. The `insist` arm of `whatis` is
     a loop whose only exits are picking a matching item and `n_objs == 0`, so a
-    script that runs dry hangs instead of failing — every sequence that can
-    re-prompt ends in an abort tail, the `n_objs == 0` exit is reached the way a
-    player reaches it (`*` for a list with nothing appropriate in the pack)
-    rather than by poking the counter, and the one mutation that deletes that
-    exit is the only one of the 30 that fails by timeout instead of fast,
-    necessarily so. And `show_map` does **not** mark squares seen — it writes
-    into `hw` and touches no `PLACE` at all — so the issue's wording for it
-    could not be tested as written; the loop bounds are asserted instead by
-    planting a marker in the rows C's loop excludes, since those rows are blank
-    on a real level and copying blanks over blanks would have made the bound
-    unfalsifiable.
+    script that runs dry hangs instead of failing — every sequence here ends in
+    an abort tail, the `n_objs == 0` exit is reached the way a player reaches it
+    (`*` for a list with nothing appropriate in the pack) rather than by poking
+    the counter, and the one mutation that deletes that exit is the only one of
+    the 30 that fails by timeout instead of fast, necessarily so. And `show_map`
+    does **not** mark squares seen — it writes into `hw` and touches no `PLACE`
+    at all — so the issue's wording for it could not be tested as written; the
+    loop bounds are asserted instead by planting a marker in the rows C's loop
+    excludes, since those rows are blank on a real level and copying blanks over
+    blanks would have made the bound unfalsifiable.
 
 - 2026-08-09 Wands and staffs under test (`test/sticks-coverage`, closes #6):
   the second of the three thin spots the Next Step names. `game/sticks.go` was
@@ -244,92 +114,6 @@ is finished.
   reach only mean something against known walls and a known passage number. All
   27 mutations tried against the new tests were caught.
 
-- 2026-08-09 Trap unit-test coverage (`test/traps-coverage`, closes #14):
-  `trapHandlers` had eight entries and **zero** direct tests, on the one
-  subsystem besides combat that can kill the hero outright. New
-  `game/traps_test.go` (19 tests, 15 subtests) covers all eight arms of
-  `move.c be_trapped`, the prologue every trap runs through, and the
-  `rust_armor` tail `T_RUST` calls. Package coverage 56.2% -> 57.9% measured on
-  `main` at `bf820e3`, the branch point, before the sticks tests landed. Every
-  expected value is transcribed from `origin/c-master` and quoted in the file.
-  **No divergence from C was found.**
-
-    The issue body's trap list was wrong and the correction is the first thing
-    worth recording: there is no separate "poison dart" trap — `T_DART` **is**
-    the poisoned dart, its death message being "a poisoned dart killed you" —
-    and the list omitted `T_MYST`, the mystery trap, whose arm is an eleven-way
-    `rnd(11)` message switch. `rogue.h` 192-200 is the authority
-    (`T_DOOR`/`T_ARROW`/`T_SLEEP`/`T_BEAR`/`T_TELEP`/`T_DART`/`T_RUST`/`T_MYST`,
-    `NTRAPS` 8) and the Go `TrapKind` iota matches it index-for-index.
-
-    Three C details the tests are built around. (1) `BEARTIME` and `SLEEPTIME`
-    are `spread(3)` and `spread(5)` (`rogue.h` 108-109), and `spread` is
-    `nm - nm/20 + rnd(nm/10)`; for both, `nm/10` is 0 and C's `rnd` short
-    circuits a zero range without touching the generator, so each is an exact
-    constant that costs **no** random number — and the tests assert the no-draw
-    half as well as the value, because a stray draw desynchronises the
-    seed-compatible stream. (2) `T_ARROW` swings at `s_lvl - 1` and `T_DART` at
-    `s_lvl + 1`: opposite signs, which is exactly the kind of detail a
-    transliterating port drops. (3) The strength loss is gated on
-    `!ISWEARING(R_SUSTSTR) && !save(VS_POISON)`, and the `&&` is load-bearing —
-    with the ring on, C never rolls the save, so the arm must spend two random
-    numbers and not three.
-
-    Two shapes worth keeping, both forced by mutation results rather than
-    foresight. Damage dice are checked by a **sweep**, not one shot: `rnd(n)` is
-    "raw value % n", so a single draw agrees between a d6 and a d5 five times in
-    six and leaves the generator identical either way — the first draft's
-    single-trial arrow test passed with `roll(1,6)` mutated to `roll(1,5)`.
-    Likewise the swing arguments are pinned by a 200-trial boundary sweep at a
-    mid-range to-hit target: a forced hit and a forced miss cannot see a wrong
-    `at_lvl` or a dropped `op_arm`, because both arms are reachable at any level
-    and swing spends one `rnd(20)` regardless.
-
-    Mutation-proved, 33 mutations, each reverted, and every one of them is now
-    caught. Three were **not** caught on the first pass and the tests were
-    strengthened until they were, which is the useful part of the record. (a)
-    Deleting `new_level()` from `T_DOOR` left the suite green: `be_trapped`'s
-    own prologue stamps the trap glyph into the cell the hero fell through, so
-    "the map changed" is true even with no new level dug. The test now counts
-    differing cells — exactly one can change that way — and also requires the
-    staircase to move and the hero to be re-placed. (b) The `roll(1,6)` case
-    above.
-
-    (c) **`be_trapped` takes a coordinate, and which coordinate decides whether
-    `T_TELEP`'s `mvaddch(tc, TRAP)` does anything.** Deleting that line first
-    left the suite green, and the first draft wrote that off as an unavoidable
-    redundancy — wrongly, because the test only exercised one of the two call
-    sites. `move.go` 105-108 (`case Floor`) springs a trap under the hero and
-    passes `p.Pos`; there `tc` **is** the hero's square, the prologue has
-    already set its `p_ch` to `TRAP`, and `teleport()` opens by drawing
-    `floor_at()` — which returns `chat(hero)` — over it, so the glyph is on
-    screen before the line runs. But `move.go` 94-98 (`case Trap`), the ordinary
-    walk onto a hidden trap, passes `nh`, the square being stepped **onto**,
-    with the hero still on the previous square: `teleport()`'s opening `mvaddch`
-    paints the old square, `leave_room` writes blanks and never `TRAP`, and
-    nothing calls `look()` afterwards because the `case Trap` arm returns before
-    `finishMove` for a teleporter. There `mvaddch(tc, TRAP)` is the only writer,
-    exactly as C's comment says.
-    `TestTrapTeleportDrawsTheTrapOnTheSquareSteppedOnto` springs the trap at a
-    floor square next to the hero and pins it: unmutated the screen at `tc`
-    reads `^`, with the line deleted it reads `.`.
-
-    The other 30 each failed their own test and only their own; two also moved
-    `TestAutoSaveOnSignalRacesTurnLoop`, which drives real turns and is
-    legitimately sensitive to `BEARTIME` and to armor rusting.
-
-    Deliberately uncovered: the two death messages, "an arrow killed you" and "a
-    poisoned dart killed you". Each is printed immediately before `death()`,
-    which reaches `myExit` and `os.Exit`, so provoking either would take the
-    test binary with it; the hero is pinned with `fortify()` and the damage
-    rolls are checked by replaying C's arithmetic instead of by letting HP reach
-    zero. They are the only two: `rust_armor`'s `|| ISWEARING(R_SUSTARM)`
-    operand and its `if (!to_death)` suppression of the rust-vanishes message,
-    the last predicates that had no assertion, are pinned by
-    `TestTrapRustHonoursTheRingAndTheToDeathFlag`. This entry does **not**
-    rotate `Next Step`: #14 was an out-of-band gap found while surveying, not
-    part of the rings/sticks/wizard step.
-
 - 2026-08-09 Ring unit-test coverage (`test/rings-coverage`, closes #5): the
   first third of the standing coverage step. `game/rings.go` had **zero** tests
   — not one of the 32 in the suite touched wear, removal, hand choice, or the
@@ -754,11 +538,7 @@ is finished.
   24 long lines wrapped or their comments tightened, control bytes in
   `term/tcell.go` as character literals, and two `wsl_v5` defer cuddles. The
   repo has no golangci-lint version pin to bump (no Dockerfile or CI;
-  `make lint` runs whatever `golangci-lint` is on the host). Superseded
-  2026-08-10: there is a pin now, and no host lint path — `Dockerfile.lint` pins
-  the linter image by digest and `script/lint` runs it in a container. See the
-  2026-08-10 entry at the top of this section
-  (https://git.eeqj.de/sneak/rgoue/issues/41).
+  `make lint` runs whatever `golangci-lint` is on the host).
 
 - 2026-07-24 Seed compatibility — item tables (seed-compat): instrumented the C
   reference on modern-rogue with a DUMP mode (testdata/c_seedcompat.patch) that
@@ -906,13 +686,7 @@ is finished.
    per-game dungeon dimensions instead of the 80x24 constants; open design
    questions are resize policy, gameplay tuning at larger sizes, and a --classic
    80x24 mode.
-2. Note: this repo is exempt from the standard policy scaffold, but the
-   exemption is narrower than it was. A minimal dev Makefile
-   (fmt/fmt-check/lint/test/check targets) exists per sneak's 2026-07-07
-   request. `Dockerfile.lint` and `script/lint` are now also permitted, and
-   required, along with the `.dockerignore` that scopes their build context:
-   sneak's 2026-08-09 ruling (https://git.eeqj.de/sneak/rgoue/issues/41) is that
-   every repo lints in a container invoked through `script/lint`, and being
-   later and explicit it overrides the 2026-07-07 exemption for those three
-   files only. Still do not add: CI config, `REPO_POLICIES.md`, an application
-   `Dockerfile`, or any other `script/` entrypoint.
+2. Note: this repo is exempt from the standard policy scaffold. A minimal dev
+   Makefile (fmt/fmt-check/lint/test/check targets) exists per sneak's
+   2026-07-07 request, but do not add a Dockerfile, CI config, or
+   REPO_POLICIES.md.

game/autosave_test.go

@@ -9,6 +9,7 @@ import (
 	"io"
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 	"time"
 )
@@ -16,9 +17,7 @@ import (
 // autoSaveWait is the deadline the tests hand AutoSaveOnSignal when they
 // expect the save to be taken. It is long enough that a loaded machine
 // cannot turn a working handoff into a spurious failure, and it is never
-// actually waited out on a passing run. It is also what bounds
-// driveUntilDone, by way of the saving goroutine it waits for — see
-// there for what that bound comes to.
+// actually waited out on a passing run.
 const autoSaveWait = 10 * time.Second
 
 // TestAutoSaveOnSignalRacesTurnLoop is the test issue #24 exists for: it
@@ -35,14 +34,12 @@ const autoSaveWait = 10 * time.Second
 func TestAutoSaveOnSignalRacesTurnLoop(t *testing.T) {
 	t.Parallel()
 
-	// Same mix as TestTurnLoopCrashSweep — the spaces answer any --More--
-	// prompt — on a driveTerm, so the drive can run for as long as the
-	// saves take rather than for as long as a script lasts. The '.' and
-	// the 's' are what make an unbounded drive safe, and at least one of
-	// the two has to stay in the cycle: see driveTerm.
-	term := &driveTerm{script: []byte("h j k l y u b n s . ")}
+	// Same mix as TestTurnLoopCrashSweep: the spaces answer any --More--
+	// prompt, and the script is long enough that the drive never runs it
+	// out.
+	script := []byte(strings.Repeat("h j k l y u b n s . ", 400))
 
-	g := New(Params{Seed: 20260809, Term: term})
+	g := New(Params{Seed: 20260809, Term: &testTerm{input: script}})
 	g.FileName = filepath.Join(t.TempDir(), "rogue.save")
 	g.startLevel()
 	g.prePlay()
@@ -77,50 +74,14 @@ func TestAutoSaveOnSignalRacesTurnLoop(t *testing.T) {
 
 // driveUntilDone runs turns until the saving goroutine is finished,
 // fortifying the hero each turn so no death exits the test binary. The
-// condition it waits on is that goroutine finishing — nothing else.
-//
-// It used to stop after a fixed 1000 turns and fail, and that cap was a
-// load-sensitive assumption wearing a counter's clothes (issue #36). The
-// turns this loop spends between one save request being answered and the
-// next arriving are not work; they are the saving goroutine's scheduling
-// latency, so the turn count 25 saves costs is a function of how
-// contended the machine is rather than of anything the code under test
-// does. Measured here on a 48-core host at load ~57: about 60-120 turns
-// with a whole machine to spread over, 418 to 655 as GOMAXPROCS was cut
-// from 4 to 1, and past 1000 under the doubled load of the verbose
-// rerun, which is the flake this replaces. A budget that has to be
-// guessed cannot be guessed right, so there is no budget.
-//
-// Dropping it costs no termination guarantee, because the bound belongs
-// to the code under test and not to this loop: each AutoSaveOnSignal
-// call returns within the timeout the caller hands it, so the saving
-// goroutine always finishes and done always closes. That bound is worth
-// stating exactly, because it is not one autoSaveWait.
-//
-// A handoff that has stopped answering altogether costs one, in total,
-// however many saves were asked for. g.sigSave
-// is one deep, so the unserviced request stays in the channel and every
-// later call finds it full and reports failure immediately — measured
-// at 10.0s for 25 saves with the service point deleted from command().
-// What fails is then the caller's own assertion, the count of saves
-// actually taken, which says far more than "out of turns" ever did.
-//
-// A handoff that still drains every request but takes longer than
-// autoSaveWait to do it is the worst case, and costs one timeout per
-// save: wantSaves * autoSaveWait, 250s at these constants, which would
-// run past the package timeout rather than reach the assertion. It
-// takes about ten seconds of scheduler starvation per save to get
-// there, against a regime measured at 0.12s per 1000 turns, so it is
-// remote — and the 1000-turn cap did not bound it either, a turn count
-// being no kind of time bound. `go test -timeout 30s` is the backstop
-// under all of it.
-//
-// The one thing the caller does have to supply is a terminal that can
-// feed an unbounded drive: see driveTerm.
+// turn cap keeps a broken handoff from hanging the suite instead of
+// failing it.
 func driveUntilDone(t *testing.T, g *RogueGame, done <-chan struct{}) {
 	t.Helper()
 
-	for {
+	const maxTurns = 1000
+
+	for range maxTurns {
 		select {
 		case <-done:
 			return
@@ -130,6 +91,8 @@ func driveUntilDone(t *testing.T, g *RogueGame, done <-chan struct{}) {
 		fortify(g)
 		g.command()
 	}
+
+	t.Fatal("the turn loop ran out of turns before the saves were taken")
 }
 
 // TestAutoSaveOnSignalWhileBlockedOnInput is the case the fix is really
@@ -303,7 +266,9 @@ func TestAutoSaveOnSignalTimesOutLeavingTheOldSave(t *testing.T) {
 func TestAutoSaveOnSignalWithoutASaveFile(t *testing.T) {
 	t.Parallel()
 
-	g := New(Params{Seed: 5, Term: &driveTerm{script: []byte("s . ")}})
+	g := New(Params{Seed: 5, Term: &testTerm{
+		input: []byte(strings.Repeat("s . ", 200)),
+	}})
 	g.FileName = ""
 	g.startLevel()
 	g.prePlay()
@@ -472,66 +437,6 @@ func mkBlockedGame(t *testing.T, term Terminal) *RogueGame {
 	return g
 }
 
-// driveTerm is a headless Terminal whose script repeats instead of
-// running out, for the tests that drive the turn loop until something
-// else finishes rather than for a set number of turns.
-//
-// testTerm cannot do that job. Once its script is exhausted it answers
-// space and newline for ever, and neither takes a turn, so command() —
-// which loops until the player does something that consumes one, the
-// `if !g.After { ntimes++ }` in command.c — never returns. A drive with
-// a turn cap sized to its script never notices; a drive that runs until
-// the saves are taken wedges inside a single command() call, which is
-// what a first attempt at issue #36 did.
-//
-// Repeating the script is necessary but nowhere near sufficient, and
-// the difference is what anyone editing one of these scripts has to
-// know. Most keys take a turn only conditionally. ' ' is the "legal
-// illegal command" and clears After outright (tables.go). All eight
-// movement keys clear it whenever the step is refused: a wall or the
-// map edge (move.go moveResolve), an illegal diagonal (moveTarget), or
-// a confused step that lands back in place (moveHero). A script of
-// nothing but those keys wedges exactly the way testTerm's tail does,
-// repetition or no repetition — with the script set to just " " this
-// drive hits the 30s package timeout inside command().
-//
-// What actually makes the wedge impossible is that the cycle always
-// contains at least one *unconditional* turn-taker, and the scripts
-// here carry two: '.', the rest command, whose handler is empty, and
-// 's', search, which writes After on no path. Nothing refuses either
-// one — not being blocked in all eight directions, not Held, not stuck
-// in a bear trap, and not NoCommand > 0, where playTurn skips
-// executeCommand altogether and After is simply left true. Trim both
-// out and the wedge this test exists to remove comes straight back.
-//
-// One further precondition, from what this fake does not supply:
-// testTerm's tail answered a newline every other read and this does
-// not. Nothing reachable from these scripts asks for one — waitFor('\n')
-// sits on the death and score paths (rip.go, score.go), which fortify
-// prevents from ever being reached — but a script that could reach them
-// would park in waitFor for ever.
-type driveTerm struct {
-	script []byte
-	pos    int
-}
-
-func (t *driveTerm) Render(*Window) {}
-
-func (t *driveTerm) Repaint() {}
-
-func (t *driveTerm) Fini() {}
-
-// Interrupt has nothing to wake: this terminal's ReadChar never blocks.
-func (t *driveTerm) Interrupt() {}
-
-// ReadChar hands out the next scripted key, wrapping at the end.
-func (t *driveTerm) ReadChar() (byte, bool) {
-	ch := t.script[t.pos]
-	t.pos = (t.pos + 1) % len(t.script)
-
-	return ch, true
-}
-
 // blockingTerm is a Terminal that genuinely blocks in ReadChar until a
 // key is pushed or Interrupt wakes it — which testTerm, whose reads never
 // block, cannot reproduce.

game/wizard_test.go

@@ -928,18 +928,12 @@ func TestCreateRingOtherKindsAreLeftAlone(t *testing.T) {
 //	...
 //	if (!real) wstandend(hw);        /* whole word, not the bit */
 //
-// new_level.c seeds every square with p_flags = F_REAL, and exactly three
-// sites clear that bit. putpass sets F_PASS first, so a secret passage is
-// left at 0x80. door's secret-door arm clears it on a room-wall exit whose
-// flags are still exactly F_REAL, leaving p_flags == 0. And the trap loop
-// ORs in rnd(NTRAPS), which is 0..7, so the T_DOOR (00) case is zero too
-// until be_trapped ORs F_SEEN in. So C's wstandend does fire, at secret
-// doors and unsprung trapdoors; what it gets wrong is leaking standout
-// forward from a secret passage or a non-trapdoor trap until it reaches
-// one of those — intermittent bands, not a permanently reversed map.
-// game/wizard.go tests isReal both times and highlights the single square.
-// That divergence is reported on issue #7 rather than settled here, so
-// this test asserts only
+// new_level.c seeds every square with p_flags = F_REAL, and the squares
+// that lose F_REAL keep other bits (F_PASS from putpass, a non-zero
+// rnd(NTRAPS) from the trap loop), so C turns standout on at the first
+// secret square and never turns it off again. game/wizard.go tests isReal
+// both times and highlights the single square. That divergence is
+// reported on issue #7 rather than settled here, so this test asserts only
 // what both agree on: the characters everywhere, standout on every
 // non-real square, and no standout on real squares before the first
 // non-real one.
@@ -985,10 +979,10 @@ func TestShowMapRendersTheWholeLevel(t *testing.T) {
 	}
 }
 
-// TestShowMapLoopBoundsMatchC pins the loop bounds. C starts at y = 1
+// TestShowMapLeavesTheRowsCOmits pins the loop bounds. C starts at y = 1
 // and stops before NUMLINES-1, so the top line stays free for show_win's
 // prompt and the status line is never overwritten.
-func TestShowMapLoopBoundsMatchC(t *testing.T) {
+func TestShowMapLeavesTheRowsCOmits(t *testing.T) {
 	t.Parallel()
 
 	g := mkWizard(t, 32, 10)

script/lint

@@ -1,37 +0,0 @@
-#!/bin/sh
-# script/lint: lint in docker. golangci-lint is never installed on the host.
-#
-# Traps, each of which yields a green run over an unlinted or partly linted
-# tree:
-#
-# 1. --target and --no-cache-filter must both stay, and $stage must match
-#    the stage name in Dockerfile.lint. BuildKit ignores --no-cache-filter
-#    when no stage matches its argument, serving the lint layer from cache
-#    without a word; --target rejects a name that is not in the file, which
-#    is what makes the single $stage safe.
-#
-# 2. --target checks that the stage exists, not that it is the stage
-#    running golangci-lint, and it halts the build there. Moving the lint
-#    step to another stage, or adding a stage after it, is not caught.
-#
-# 3. .dockerignore decides what reaches the container, and only what
-#    reaches it is linted. Excluding a self-contained Go file drops it from
-#    the lint silently. Never exclude Go sources, go.mod/go.sum or
-#    .golangci.yml.
-set -eu
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-
-# Must match the stage name in Dockerfile.lint.
-stage=lint
-
-main() {
-    cd "$ROOT"
-    docker build \
-        --target "$stage" \
-        --no-cache-filter="$stage" \
-        --output=type=cacheonly \
-        -f Dockerfile.lint .
-}
-
-main "$@"