Release-cycle branch, opening a new cycle after #43 merged. One commit per work unit accumulates here.
Landed so far
6f997b8 — trim the lint-gate comments to the traps (#44)
Comments and documentation only, per sneak's 2026-08-10 rule that comments keep what a reader needs to avoid a trap and drop reasoning, history and self-justification.
Cut from script/lint and Dockerfile.lint: why the image has two stages, why golangci-lint config verify was omitted, and what earlier drafts of the comments claimed. TODO.md loses its "Hardened" and "Corrected" paragraphs, which argued with earlier versions of themselves.
Kept, because each silently yields a green run over an unlinted or partly linted tree:
--target and --no-cache-filter must both stay, and $stage must match the stage name in Dockerfile.lint.
--target checks that the stage exists, not that it runs golangci-lint, and halts the build there — relocating the lint step or appending a stage after it is not caught.
.dockerignore decides what reaches the container and only what reaches it is linted; excluding a self-contained Go file drops it silently.
The TODO.md entry keeps the flags, the durable property (the lint stage executes every run and is never served from cache), the three unguarded seams, and the evidence that the gate was verified rather than assumed.
Evidence
No behaviour change. Changed lines that are not comments, in each touched file:
Stripping comments and blank lines from each file before and after the commit gives byte-identical content (diff reports no difference for all three). The docker build invocation still reads --target "$stage" --no-cache-filter="$stage" --output=type=cacheonly -f Dockerfile.lint ., and .dockerignore's only rule is still .git.
script/lint run, lint layer executing:
#11 [lint 2/2] RUN golangci-lint run --config .golangci.yml ./...
#11 11.83 0 issues.
#11 DONE 12.2s
EXIT_LINT=0
Not CACHED.
make check green in full, forced uncached through the make target (GOFLAGS=-count=1), re-run after the rebase onto current main:
#10 [lint 2/2] RUN golangci-lint run --config .golangci.yml ./...
#10 10.96 0 issues.
ok git.eeqj.de/sneak/rgoue/cmd/rogue 1.027s coverage: 29.7% of statements
ok git.eeqj.de/sneak/rgoue/game 3.138s coverage: 64.0% of statements
MAKE_CHECK_EXIT=0
Real durations, no (cached). git status empty around every evidence run; scratch kept outside the clone. No prune of any kind.
Release-cycle branch, opening a new cycle after https://git.eeqj.de/sneak/rgoue/pulls/43 merged. One commit per work unit accumulates here.
## Landed so far
### `6f997b8` — trim the lint-gate comments to the traps (https://git.eeqj.de/sneak/rgoue/issues/44)
Comments and documentation only, per sneak's 2026-08-10 rule that comments keep what a reader needs to avoid a trap and drop reasoning, history and self-justification.
Cut from `script/lint` and `Dockerfile.lint`: why the image has two stages, why `golangci-lint config verify` was omitted, and what earlier drafts of the comments claimed. `TODO.md` loses its "Hardened" and "Corrected" paragraphs, which argued with earlier versions of themselves.
Kept, because each silently yields a green run over an unlinted or partly linted tree:
1. `--target` and `--no-cache-filter` must both stay, and `$stage` must match the stage name in `Dockerfile.lint`.
2. `--target` checks that the stage exists, not that it runs `golangci-lint`, and halts the build there — relocating the lint step or appending a stage after it is not caught.
3. `.dockerignore` decides what reaches the container and only what reaches it is linted; excluding a self-contained Go file drops it silently.
The `TODO.md` entry keeps the flags, the durable property (the lint stage executes every run and is never served from cache), the three unguarded seams, and the evidence that the gate was verified rather than assumed.
## Evidence
**No behaviour change.** Changed lines that are not comments, in each touched file:
```
$ git diff script/lint | grep -E '^[+-]' | grep -vE '^[+-]#|^[+-][+-]' → (empty)
$ git diff .dockerignore | grep -E '^[+-]' | grep -vE '^[+-]#|^[+-][+-]' → (empty)
$ git diff Dockerfile.lint| grep -E '^[+-]' | grep -vE '^[+-]#|^[+-][+-]' → (empty)
```
Stripping comments and blank lines from each file before and after the commit gives byte-identical content (`diff` reports no difference for all three). The `docker build` invocation still reads `--target "$stage" --no-cache-filter="$stage" --output=type=cacheonly -f Dockerfile.lint .`, and `.dockerignore`'s only rule is still `.git`.
**`script/lint` run**, lint layer executing:
```
#11 [lint 2/2] RUN golangci-lint run --config .golangci.yml ./...
#11 11.83 0 issues.
#11 DONE 12.2s
EXIT_LINT=0
```
Not `CACHED`.
**`make check` green in full**, forced uncached through the make target (`GOFLAGS=-count=1`), re-run after the rebase onto current `main`:
```
#10 [lint 2/2] RUN golangci-lint run --config .golangci.yml ./...
#10 10.96 0 issues.
ok git.eeqj.de/sneak/rgoue/cmd/rogue 1.027s coverage: 29.7% of statements
ok git.eeqj.de/sneak/rgoue/game 3.138s coverage: 64.0% of statements
MAKE_CHECK_EXIT=0
```
Real durations, no `(cached)`. `git status` empty around every evidence run; scratch kept outside the clone. No prune of any kind.
Comments and documentation only; the docker build invocation and its three
flags are byte-identical and .dockerignore's effective rules are unchanged.
script/lint and Dockerfile.lint stated how the shape was derived — why two
stages, why `golangci-lint config verify` was omitted, what earlier drafts
of the comments claimed. That is in the history. What survives is the three
traps, each of which yields a green run over an unlinted or partly linted
tree: --target and --no-cache-filter must both stay with $stage matching the
stage name in Dockerfile.lint; --target checks that the stage exists, not
that it runs golangci-lint, and halts the build there; and .dockerignore
decides what reaches the container, so excluding a self-contained Go file
drops it from the lint silently.
The TODO.md entry loses its "Hardened" and "Corrected" paragraphs, which
argued with earlier versions of themselves, and keeps the flags, the durable
property, the three unguarded seams, and the evidence that the gate was
verified rather than assumed.
Merged. Adversarial review skipped under the docs-only exception, which I verified rather than took from the PR body: stripping comments and blank lines from script/lint, Dockerfile.lint and .dockerignore gives byte-identical files before and after, and the invocation still carries --target "$stage" --no-cache-filter="$stage" --output=type=cacheonly. All three traps survive in the trimmed comments.
make check green, run twice — the first came back ok (cached) for both packages, which is not evidence the tests ran, so it was re-run forced: lint layer executed (0 issues., not CACHED), ok cmd/rogue 1.019s, ok game 2.998s.
Merged. Adversarial review skipped under the docs-only exception, which I verified rather than took from the PR body: stripping comments and blank lines from `script/lint`, `Dockerfile.lint` and `.dockerignore` gives byte-identical files before and after, and the invocation still carries `--target "$stage" --no-cache-filter="$stage" --output=type=cacheonly`. All three traps survive in the trimmed comments.
`make check` green, run twice — the first came back `ok (cached)` for both packages, which is not evidence the tests ran, so it was re-run forced: lint layer executed (`0 issues.`, not `CACHED`), `ok cmd/rogue 1.019s`, `ok game 2.998s`.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Release-cycle branch, opening a new cycle after #43 merged. One commit per work unit accumulates here.
Landed so far
6f997b8— trim the lint-gate comments to the traps (#44)Comments and documentation only, per sneak's 2026-08-10 rule that comments keep what a reader needs to avoid a trap and drop reasoning, history and self-justification.
Cut from
script/lintandDockerfile.lint: why the image has two stages, whygolangci-lint config verifywas omitted, and what earlier drafts of the comments claimed.TODO.mdloses its "Hardened" and "Corrected" paragraphs, which argued with earlier versions of themselves.Kept, because each silently yields a green run over an unlinted or partly linted tree:
--targetand--no-cache-filtermust both stay, and$stagemust match the stage name inDockerfile.lint.--targetchecks that the stage exists, not that it runsgolangci-lint, and halts the build there — relocating the lint step or appending a stage after it is not caught..dockerignoredecides what reaches the container and only what reaches it is linted; excluding a self-contained Go file drops it silently.The
TODO.mdentry keeps the flags, the durable property (the lint stage executes every run and is never served from cache), the three unguarded seams, and the evidence that the gate was verified rather than assumed.Evidence
No behaviour change. Changed lines that are not comments, in each touched file:
Stripping comments and blank lines from each file before and after the commit gives byte-identical content (
diffreports no difference for all three). Thedocker buildinvocation still reads--target "$stage" --no-cache-filter="$stage" --output=type=cacheonly -f Dockerfile.lint ., and.dockerignore's only rule is still.git.script/lintrun, lint layer executing:Not
CACHED.make checkgreen in full, forced uncached through the make target (GOFLAGS=-count=1), re-run after the rebase onto currentmain:Real durations, no
(cached).git statusempty around every evidence run; scratch kept outside the clone. No prune of any kind.Merged. Adversarial review skipped under the docs-only exception, which I verified rather than took from the PR body: stripping comments and blank lines from
script/lint,Dockerfile.lintand.dockerignoregives byte-identical files before and after, and the invocation still carries--target "$stage" --no-cache-filter="$stage" --output=type=cacheonly. All three traps survive in the trimmed comments.make checkgreen, run twice — the first came backok (cached)for both packages, which is not evidence the tests ran, so it was re-run forced: lint layer executed (0 issues., notCACHED),ok cmd/rogue 1.019s,ok game 2.998s.