scan: show each phase as N of M, with progress, elapsed time and ETA, also while it waits (closes #112)

Every scan display names its phase and its place among the five, as
"[2/5] walk", with its progress, elapsed time and ETA. load counts the
records first; the walk estimates its total from the records under the
operands; the content phase adds up the sizes of the matching groups
and says it is searching until the first record returns. Each display
redraws every 100 ms on a terminal and every 5 seconds in plain mode.

On a terminal no line reaches the last column: a line too wide drops
its rate, then its bar. After the terminal is made narrower than the
widest line drawn, the display makes a new library object, whose erase
fits.

Judgement call: load and the content checks draw the bar too, once their totals are known.
Judgement call: the bar is 10 columns wide, not the width the line leaves.

Model: opus-5-5

.claude/settings.json

@@ -1,5 +0,0 @@
-{
-    "worktree": {
-        "bgIsolation": "none"
-    }
-}

.dockerignore

@@ -1,12 +1,79 @@
+# .dockerignore does NOT use .gitignore semantics. Docker matches with
+# moby/patternmatcher: filepath.Match plus `**`, so `*` does not cross
+# `/` and an unprefixed pattern is anchored at the context root. Every
+# depth-independent pattern therefore needs `**/`, or `config/.env` and
+# `certs/server.key` still ship while this file reads as solved. Only
+# genuinely root-anchored entries go unprefixed. Never transplant these
+# into .gitignore, where `**/` is wrong.
+#
+# Matching is case-sensitive, so secrets use character ranges rather
+# than an ALL-CAPS twin, which would still miss `Server.Key`.
+#
+# Extend with this repo's own host-built artifacts, written anchored:
+# `/myapp`, never `**/myapp`, which also matches `cmd/myapp/` and
+# deletes the package directory from the context.
+
 # .git is sent without its config. Without a VERSION build argument the
 # stage that compiles runs `git describe --tags --always` on .git, which
 # does not need .git/config; that file can hold a credential, such as a
 # password in a remote URL or the token the CI checkout step stores there.
-.git/config
+# Each submodule keeps a config with the same exposure in its git directory
+# under .git/modules/, nested again for a submodule's own submodules, or in
+# its own .git directory when it keeps one.
+# KNOWN GAP: a submodule whose name has a `config` segment (`config`,
+# `deploy/config`, `config/lib`) loses its whole git directory, because
+# `**/.git/modules/**/config` also matches that segment's directory
+# under .git/modules/. Go's version stamping then fails the build;
+# nothing leaks. Name such a submodule without that segment:
+# `git submodule add --name`.
+**/.git/config
+**/.git/modules/**/config
 
+# Agent scratch: one full checkout of the repo per in-flight agent.
+# Anchored because it occurs once where agents run at the repo root.
+# KNOWN GAP: a repo running agents in subdirectories still ships
+# `services/api/.claude/` and must add its own anchored entry.
 .claude
-.DS_Store
-sfdupes
-*.log
-*.out
-*.test
+
+# Environment files. `*.env` covers bare `.env` and the `prod.env`
+# convention. Re-include a committed template with a negation if the
+# build needs one: `!docs/example.env`.
+**/*.[eE][nN][vV]
+**/.[eE][nN][vV].*
+**/.[eE][nN][vV][rR][cC]
+
+# Private keys and the bundles carrying them. Public certificates
+# (*.crt, *.cer) are deliberately absent: they are legitimate inputs.
+**/*.[pP][eE][mM]
+**/*.[kK][eE][yY]
+**/*.[pP]12
+**/*.[pP][fF][xX]
+**/[iI][dD]_[rR][sS][aA]
+**/[iI][dD]_[dD][sS][aA]
+**/[iI][dD]_[eE][cC][dD][sS][aA]
+**/[iI][dD]_[eE][cC][dD][sS][aA]_[sS][kK]
+**/[iI][dD]_[eE][dD]25519
+**/[iI][dD]_[eE][dD]25519_[sS][kK]
+
+# Dependencies: restored inside the image, never copied in.
+**/node_modules
+
+# OS metadata.
+**/.DS_Store
+**/Thumbs.db
+
+# Editor state: never a build input, and it churns COPY.
+**/*.swp
+**/*.swo
+**/*~
+**/*.bak
+**/.idea
+**/.vscode
+**/*.sublime-*
+
+# This repository's host-built artifacts: the binary `make build` writes,
+# and test binaries, coverage output and logs.
+/sfdupes
+/*.test
+/*.out
+/*.log

.editorconfig

@@ -13,3 +13,6 @@ indent_style = tab
 
 [*.go]
 indent_style = tab
+
+# This repository's own sections, such as one for another language it
+# uses, go below this comment, and a re-vendor keeps them.

.gitea/workflows/check.yml

@@ -1,11 +1,20 @@
 name: check
 on: [push]
+# Free the shared runner: a new push cancels only the same branch's older run.
+concurrency:
+    group: ${{ github.workflow }}-${{ github.ref }}
+    cancel-in-progress: true
 jobs:
     check:
         runs-on: ubuntu-latest
+        # Free the shared runner from a hung build.
+        timeout-minutes: 20
         steps:
             # actions/checkout v4.2.2, 2026-02-22
             - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+              # script/cibuild needs no token, so none is left in .git/config.
               with:
+                  persist-credentials: false
+                  # All history and tags, so git describe finds the version tag.
                   fetch-depth: 0
             - run: script/cibuild

.gitignore

@@ -11,25 +11,50 @@ Thumbs.db
 .vscode/
 *.sublime-*
 
+# Agent scratch (worktrees of this repo, created and destroyed by
+# in-flight tooling). Unanchored: .gitignore patterns already match at
+# every depth, so no prefix is wanted here. This is not a .dockerignore
+# entry and must not be given a `**/` prefix on the way into one.
+.claude/
+
 # Node
 node_modules/
 
-# Environment / secrets
-.env
-.env.*
-*.pem
-*.key
+# Secrets. Unanchored like every entry above, so each matches at every
+# depth. Matching is case-sensitive on Linux, so names use character
+# ranges rather than a lowercase form that misses `Server.Key`.
 
-# Go build artifacts
+# Environment files. `*.env` covers bare `.env` and the `prod.env`
+# convention. Only the templates `example.env` and `sample.env` are
+# re-included below. A repository that commits any other template adds
+# its own negation at the end of this file, for example `!.env.example`.
+*.[eE][nN][vV]
+.[eE][nN][vV].*
+.[eE][nN][vV][rR][cC]
+!example.env
+!sample.env
+
+# Private keys and the bundles carrying them.
+*.[pP][eE][mM]
+*.[kK][eE][yY]
+*.[pP]12
+*.[pP][fF][xX]
+[iI][dD]_[rR][sS][aA]
+[iI][dD]_[dD][sS][aA]
+[iI][dD]_[eE][cC][dD][sS][aA]
+[iI][dD]_[eE][cC][dD][sS][aA]_[sS][kK]
+[iI][dD]_[eE][dD]25519
+[iI][dD]_[eE][dD]25519_[sS][kK]
+
+# This repository's own entries, such as its build outputs, go below
+# this comment, and a re-vendor keeps them. Anchor a binary built at the
+# root: `/myapp`, never `myapp`, which also ignores `cmd/myapp/`.
 /sfdupes
-*.test
-*.out
 *.log
+*.out
+*.test
 
-# Local scan data
+# A scan database lists every path it scanned.
 *.sqlite
 *.sqlite-shm
 *.sqlite-wal
-
-# Agent worktrees
-.claude/worktrees/

.golangci.yml

@@ -17,6 +17,7 @@ linters:
   disable:
     # Genuinely incompatible with project patterns
     - exhaustruct      # Requires all struct fields
+    - exhaustruct_v5   # Requires all struct fields (successor to exhaustruct)
     - godot            # Requires comments to end with periods
     - wrapcheck        # Too verbose for internal packages
     - varnamelen       # Short names like db, id are idiomatic Go
@@ -24,6 +25,8 @@ linters:
     # silenced by disabling that name, not by enabling the successor.
     - wsl              # Deprecated, replaced by wsl_v5
     - gomodguard       # Deprecated, replaced by gomodguard_v2
+    # Misses findings at random in v2.14.0; back once a pinned release fixes it
+    - canonicalheader
   settings:
     lll:
       line-length: 88

Dockerfile

@@ -1,159 +1,80 @@
-# Lint stage — fast feedback on formatting and lint issues
-# golangci/golangci-lint:v2.12.2, 2026-08-07
-FROM golangci/golangci-lint@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240 AS lint
+# Every stage declares ARG CACHEBUST first: script/ passes a new value
+# on every build, which reruns every RUN step after it. The steps that
+# compile mount Go's build cache, which survives from build to build.
+
+# Lint phase, built alone by script/lint. The tools are invoked directly
+# rather than through `make lint`, which runs docker itself and so cannot
+# run inside a build step.
+# golangci/golangci-lint:v2.14.0, 2026-10-07
+FROM golangci/golangci-lint@sha256:ad862ba6b3798cbe0fd9fd7408d498fd74fbd2623a92406b2fd3898faf0bf98f AS lint
+ARG CACHEBUST
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download
 COPY . .
 
-# Cache-buster for the gate layers, and only for them: on an unchanged
-# tree Docker would serve the gates below from cache and the build would
-# exit 0 having run nothing. script/cibuild and script/docker pass a
-# fresh CHECK_EPOCH; a build without one, such as a bare
-# `docker build .`, fails at the check right after the ARG.
-#
-# ARG is per-stage, so the markdown and build stages declare it again.
-# Each gate RUN must reference the value: BuildKit hashes the expanded
-# command, so a declared but unreferenced ARG invalidates nothing. Keep
-# it below the dependency layers so they stay cached.
-ARG CHECK_EPOCH
-RUN if [ -z "${CHECK_EPOCH}" ]; then \
-        echo "CHECK_EPOCH is unset; build via script/cibuild or script/docker" >&2; \
-        exit 1; \
-    fi
-
-# These gates call the tools directly, not through `make lint` or
-# `make fmt-check`: both run docker, which cannot run inside a docker
-# build. This step is the gofmt half of `make fmt-check`; the markdown
-# stage is its prettier half. gofmt's output is assigned to a variable
-# first so that its own exit status, as when it cannot parse a file,
-# still fails the step.
-RUN echo "gate gofmt, epoch ${CHECK_EPOCH}" && \
-    files="$(gofmt -s -l .)" && \
+# The gofmt half of `make fmt-check`. gofmt's output is assigned to a
+# variable first so that its own exit status, as when it cannot parse a
+# file, still fails the step.
+RUN files="$(gofmt -s -l .)" && \
     if [ -n "$files" ]; then \
         echo "gofmt: files not formatted:" >&2; echo "$files" >&2; exit 1; \
     fi
 
-# Fails the build when the FROM above and the one in Dockerfile.lint pin
-# different linter images.
-RUN echo "gate lint-image-pin, epoch ${CHECK_EPOCH}" && \
-    script/verify-lint-image-pin
-
-# Same config-schema check Dockerfile.lint runs, kept here so this build
-# gates on exactly what script/lint gates on. It validates against a
-# schema the pinned binary embeds, so it needs no network.
-RUN echo "gate config verify, epoch ${CHECK_EPOCH}" && \
-    golangci-lint config verify --config .golangci.yml
-
-RUN echo "gate lint, epoch ${CHECK_EPOCH}" && \
+# Validates .golangci.yml against the schema the pinned binary embeds.
+RUN golangci-lint config verify --config .golangci.yml
+RUN --mount=type=cache,target=/root/.cache/go-build \
     golangci-lint run --config .golangci.yml ./...
 
-# Prettier stage: the prettier that formats this repository's Markdown,
-# never installed on a host. script/fmt and script/fmt-check build this
-# stage alone and run it with the repository mounted on /src. prettier
-# is installed in /tools so that the repository, mounted or copied onto
-# /src, cannot hide it.
-# node:22-alpine, 2026-02-22
-FROM node@sha256:e4bf2a82ad0a4037d28035ae71529873c069b13eb0455466ae0bc13363826e34 AS prettier
-WORKDIR /tools
-# yarn.lock pins prettier by hash, and --frozen-lockfile fails rather
-# than install anything yarn.lock does not name.
-COPY package.json yarn.lock ./
-RUN yarn install --frozen-lockfile
-ENV PATH=/tools/node_modules/.bin:$PATH
+# Test phase, built alone by script/test. -race needs cgo and so a C
+# compiler, which the Debian Go image ships and the alpine one does not.
+# -count=1 because the mounted cache also holds test results, which go
+# test would otherwise replay.
+#
+# The tests run as nobody: several of them make a file unreadable and
+# expect reading it to fail, and root reads it anyway. nobody has no home
+# directory, so HOME is /tmp, and Go keeps its build cache in
+# /tmp/.cache/go-build. That is where the cache is mounted, owned by
+# nobody (65534) so the tests can write to it.
+# golang:1.25-trixie, 2026-10-04
+FROM golang@sha256:2c4c60ef415fbfa5e90300722293bef36c5e63fae17570ce18f580af933dbd73 AS test
+ARG CACHEBUST
+USER nobody
+ENV HOME=/tmp
 WORKDIR /src
-
-# Markdown stage: the Markdown half of `make fmt-check`, as a gate.
-FROM prettier AS markdown
+COPY go.mod go.sum ./
+RUN go mod download
 COPY . .
-# Second per-stage declaration of the gate cache-buster and its check;
-# see the lint stage above.
-ARG CHECK_EPOCH
-RUN if [ -z "${CHECK_EPOCH}" ]; then \
-        echo "CHECK_EPOCH is unset; build via script/cibuild or script/docker" >&2; \
-        exit 1; \
-    fi
-RUN echo "gate prettier, epoch ${CHECK_EPOCH}" && \
-    prettier --check '**/*.md' --tab-width 4 --prose-wrap always
+RUN --mount=type=cache,target=/tmp/.cache/go-build,uid=65534,gid=65534 \
+    go test -count=1 -timeout 90s -race -cover ./... || \
+    { echo "--- Rerunning with -v for details ---"; \
+      go test -count=1 -timeout 90s -race -v ./...; exit 1; }
 
-# Build stage
+# Build stage. Nothing is wanted from either phase above; the copies are
+# what make BuildKit build them first, so this stage cannot run unless
+# lint and test passed.
 # golang:1.25-alpine, 2026-07-23
 FROM golang@sha256:56961d79ea8129efddcc0b8643fd8a5416b4e6228cfd477e3fd61deb2672c587 AS builder
-
-# We never build or run as root. Create an unprivileged user and point
-# HOME and the build cache at its home so go build and go test can write
-# it when we drop to it below.
-#
-# The module cache stays at the base image's default /go/pkg/mod and
-# belongs to root: script/bootstrap fills it as root. Do not move it
-# into the home and hand it over with `chown -R`: that walks every file
-# in it, which took from about 80 s to over ten minutes on a shared
-# host, depending on load.
-RUN adduser -D -u 1000 builder
-ENV HOME=/home/builder
-ENV GOPATH=/home/builder/go
-ENV GOMODCACHE=/go/pkg/mod
-ENV GOCACHE=/home/builder/.cache/go-build
-
-WORKDIR /src
-
-# No-op file copies whose only purpose is the build-graph edge: they
-# make this stage depend on the lint and markdown stages, so BuildKit
-# finishes those gates before compilation and tests start. Remove one
-# and the build silently stops gating on that stage and still exits 0.
+ARG CACHEBUST
 COPY --from=lint /src/go.sum /dev/null
-COPY --from=markdown /src/go.sum /dev/null
-
-# Install development prerequisites the same way a developer does. Only
-# script/ and the dependency manifests are copied first, so this layer
-# stays cached until they change. Bootstrap ends in `go mod download`.
-COPY script/ script/
+COPY --from=test /src/go.sum /dev/null
+RUN apk add --no-cache git make
+# A tar-stream context keeps the sender's file owners, which git refuses.
+RUN git config --system --add safe.directory /src
+WORKDIR /src
 COPY go.mod go.sum ./
-RUN script/bootstrap
-
-# Hand builder only what it writes to, without walking the module cache.
-# This layer stays cached with bootstrap.
-# - /src itself: make build writes the binary into it, and git refuses
-#   a repository whose top directory belongs to another user.
-# - the module cache's cache/download directory itself, not what is in
-#   it: Go only reads the downloaded modules, but make build saves its
-#   lookup of this module's own version from git there, in a new
-#   directory named after the module path.
-# - builder's home: the go commands bootstrap ran as root left Go's
-#   telemetry files there, a few small files.
-RUN chown builder:builder /src /go/pkg/mod/cache/download && \
-    chown -R builder:builder /home/builder
-
-# The sources are handed to builder as they are copied, so no layer has
-# to walk them. Then drop root before running any checks or builds.
-COPY --chown=builder:builder . .
-USER builder
-
-# Fail the build unless the branch is green. Runs as non-root: root
-# would bypass the chmod(0) the permission-denied tests rely on.
-#
-# The gate is `make test`, not `make check`, which runs docker; lint and
-# the format checks ran in the lint and markdown stages above. `make`,
-# not the script directly, because the Makefile's
-# `export CGO_ENABLED = 0` applies only to what it invokes.
-#
-# Third per-stage declaration of the gate cache-buster and its check;
-# see the lint stage above. It is placed after USER so the drop to the
-# unprivileged user still happens before the checks run.
-ARG CHECK_EPOCH
-RUN if [ -z "${CHECK_EPOCH}" ]; then \
-        echo "CHECK_EPOCH is unset; build via script/cibuild or script/docker" >&2; \
-        exit 1; \
-    fi
-RUN echo "gate test, epoch ${CHECK_EPOCH}" && make test
+RUN go mod download
+COPY . .
 
 # The version stamped into the binary: the VERSION build argument when
 # one is given, otherwise `git describe --tags --always` of the .git in
-# the build context (git is installed by script/bootstrap above). A
-# context that carries .git and still yields no version fails the build;
-# with neither, as from a source tarball, it is "dev".
+# the build context. A context that carries .git and still yields no
+# version fails the build; with neither, as from a source tarball, it is
+# "dev". `make build` rather than `go build`, so the image and a host
+# build share one compile recipe, cgo disabled included.
 ARG VERSION
-RUN version="${VERSION:-$(git describe --tags --always || echo dev)}"; \
+RUN --mount=type=cache,target=/root/.cache/go-build \
+    version="${VERSION:-$(git describe --tags --always || echo dev)}"; \
     if [ -e .git ] && { [ -z "$version" ] || [ "$version" = dev ] || \
         [ "$version" = unknown ]; }; then \
         echo "no version could be derived although the build context carries .git" >&2; \
@@ -161,9 +82,11 @@ RUN version="${VERSION:-$(git describe --tags --always || echo dev)}"; \
     fi; \
     make build VERSION="$version"
 
-# Runtime stage
+# Runtime stage, and the last one: a plain `docker build .` builds this
+# stage's chain and nothing else.
 # alpine:3.22, 2026-07-23
 FROM alpine@sha256:14358309a308569c32bdc37e2e0e9694be33a9d99e68afb0f5ff33cc1f695dce
+ARG CACHEBUST
 
 COPY --from=builder /src/sfdupes /usr/local/bin/sfdupes
 

Dockerfile.lint

@@ -1,45 +0,0 @@
-# Lint-only image, built by script/lint: the repo is copied into the
-# pinned golangci-lint image and the linter runs as a build step, so a
-# successful build is a clean lint. No bind mount, so it works when the
-# docker daemon is remote.
-#
-# It is separate from the main Dockerfile's lint stage because
-# script/lint must not depend on the rest of that build; the two FROM
-# lines are kept identical by script/verify-lint-image-pin, run as a
-# gate below.
-# golangci/golangci-lint:v2.12.2, 2026-08-07
-FROM golangci/golangci-lint@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240
-
-WORKDIR /src
-
-# Dependency layers first, so they stay cached across lint runs.
-COPY go.mod go.sum ./
-RUN go mod download
-
-COPY . .
-
-# Cache-buster for the gate layers, and only for them; caching of the
-# lint run is waived by ruling. On an unchanged tree the gates below
-# would be served from cache and this build would exit 0 in under a
-# second having run no linter. script/lint passes a fresh value on every
-# invocation.
-#
-# Each gate RUN must reference the value: BuildKit hashes the expanded
-# command, so a declared but unreferenced ARG invalidates nothing. Keep
-# it below the dependency layers so they stay cached.
-ARG CHECK_EPOCH
-
-# Fails the build when the FROM above and the main Dockerfile's lint
-# stage pin different linter images.
-RUN echo "gate lint-image-pin, epoch ${CHECK_EPOCH}" && \
-    script/verify-lint-image-pin
-
-# Validates .golangci.yml against golangci-lint's JSON schema, which the
-# pinned binary embeds: measured under `--network none`, it passes a
-# valid config and rejects an invalid one. No gate step makes a network
-# call, but `go mod download` above needs the network on a cold cache.
-RUN echo "gate config verify, epoch ${CHECK_EPOCH}" && \
-    golangci-lint config verify --config .golangci.yml
-
-RUN echo "gate lint, epoch ${CHECK_EPOCH}" && \
-    golangci-lint run --config .golangci.yml ./...

Makefile

@@ -6,7 +6,7 @@ BINARY := sfdupes
 VERSION := $(shell git describe --tags --always --dirty 2>/dev/null || echo dev)
 LDFLAGS := -X main.Version=$(VERSION)
 
-.PHONY: sfdupes build bootstrap setup test test-race lint fmt fmt-check check docker hooks clean
+.PHONY: sfdupes build bootstrap setup test lint fmt fmt-check check docker hooks clean
 
 # Standard targets are thin shims; the implementations live in script/
 # per the scripts-to-rule-them-all pattern.
@@ -27,9 +27,6 @@ setup:
 test:
 	@script/test
 
-test-race:
-	@script/test-race
-
 lint:
 	@script/lint
 

README.md

@@ -96,10 +96,12 @@ As a file `/etc/cron.d/sfdupes`:
   the first scan. To keep it elsewhere, set
   `SFDUPES_DATABASE=/path/to/db.sqlite` before the command on the same line.
 - `scan` writes nothing to stdout. Its stderr, appended here to
-  `/var/log/sfdupes.log`, holds a plain progress line as each phase starts and
-  then at most every 5 seconds, a warning for each path it skips, and the
-  summary line (see "Progress" and "`scan` mode"). The log grows with every
-  scan; rotate it like any other.
+  `/var/log/sfdupes.log`, holds a first line naming the database (see
+  "Database"), plain progress lines naming each phase and its place among the
+  five, as `[2/5] walk` (one as the phase starts, one every 5 seconds while it
+  runs, and one as it ends), a warning for each path it skips, and the summary
+  line (see "Progress" and "`scan` mode"). The log grows with every scan; rotate
+  it like any other.
 - Skipped paths do not fail a scan: it still exits 0, and cron sends nothing. A
   scan that fails, or is stopped by `SIGINT` or `SIGTERM`, exits 1 with the
   reason among the last lines of the log; `tail` prints them, and cron mails
@@ -266,6 +268,26 @@ All three subcommands operate on a single SQLite database file:
   command-line flag. The path names the file exactly, whatever characters it
   holds (`?`, `#` and `%` included); a relative path is relative to the working
   directory.
+- Each subcommand first prints one line on stderr naming the database it uses,
+  before anything else it prints (progress displays included), whether or not
+  stderr is a terminal. The line gives the path with the working directory put
+  in front of it when it is relative, and otherwise as set (a `..` in it stays,
+  so the line names the same file), escaped like the paths in a report (see
+  "Report output format"), and says where the path came from:
+
+    ```
+    scan: new database /var/lib/sfdupes/db.sqlite (default)
+    trees: database /srv/tmp/sfdupes/db.db (from SFDUPES_DATABASE)
+    ```
+
+    The working directory put in front is the one `pwd -P` prints, with its
+    symlinks resolved. After a `cd` through a symlink to a directory, a path
+    starting `../` therefore names a file beside the directory the symlink leads
+    to, as it does for any other program. `scan` says `new database` when no
+    file is at that path as it starts. `report` and `trees` print the line
+    before they open the database, so the error for a missing database comes
+    after it.
+
 - `scan` creates the database (and its parent directory) on first use. `report`
   and `trees` require an existing database; a missing database file is a fatal
   error (exit 1) telling the user to run `scan` first.
@@ -304,6 +326,20 @@ All three subcommands operate on a single SQLite database file:
   in WAL mode until the next scan. `report` writes each row as it reads it, so
   it is still reading while its output is paused (a pager, a stalled pipe), and
   a `scan` started then fails after the busy timeout.
+- A `scan` writes to the database and the files beside it at these points (its
+  phases are described under "`scan` mode"):
+    - As it starts, before the walk: the directory, an empty database file and
+      the `.lock` file, each only if missing.
+    - Then, still before the walk: the schema, in a new database, and the `-wal`
+      and `-shm` files, which stay beside the database while the scan runs.
+    - While it loads the existing records (`load`) and walks: no records. A
+      first scan's database holds none, however long its walk has run.
+    - During the hash phase: the first records, committed 10,000 at a time.
+    - In the update phase: the rest of the hashed records, the records for
+      size-unique files, and the deletions.
+    - In the content phase: content hashes, again committed 10,000 at a time.
+    - At the end, as it closes the database: the `-wal` and `-shm` files go
+      away, unless a report still has the database open (see above).
 - `report` and `trees` open the database read-only and need only read access to
   the database file, and no write access to its directory. While the database is
   in WAL mode they also read the `-wal` and `-shm` files beside it, which SQLite
@@ -399,9 +435,10 @@ scan and are enumerated concurrently: every operand seeds the shared walk worker
 pool. Overlapping operands are harmless — an operand that duplicates another or
 lies under another is dropped before walking, so every file is reached exactly
 once and produces one database record. With `-x`, though, an operand under
-another one is kept and walked on its own when it is a directory on a different
-filesystem than the operand covering it, or a regular file in such a directory,
-because the walk of the covering operand does not reach it.
+another one is kept and walked on its own when any directory from it (from its
+directory, for a regular file) up to but not including the operand covering it
+is on a different filesystem than that operand, because that operand's walk does
+not enter such a directory and so does not reach it.
 
 An operand that is a symlink (never followed, not even as an operand), socket,
 FIFO, or device node, or a directory named `.zfs`, is not scanned. `scan` prints
@@ -410,9 +447,8 @@ drops it from the scanned operands before reading the database. Another operand
 beneath it is still scanned. The records stored beneath it are not deleted: they
 are treated like any other record outside the scanned operands, including the
 content-phase exception below. If it lies under another operand, they are under
-that operand instead, and are deleted like any other record there that this scan
-did not verify. This is not an error: a scan whose every operand is dropped
-walks nothing and exits 0.
+that operand instead, and are treated like any other record there. This is not
+an error: a scan whose every operand is dropped walks nothing and exits 0.
 
 `scan` synchronizes the database with the filesystem state under the scanned
 operands:
@@ -457,10 +493,15 @@ operands:
   schedule into the same database. Records below an operand at or inside such a
   directory are not kept this way, since that operand's own walk verifies them.
 
-`scan` runs **four sequential phases over the whole scan**. Parallelism lives
-inside each phase; batched database writes begin during the hash phase:
+`scan` runs **five sequential phases over the whole scan**. Parallelism lives
+inside the walk, hash and content phases; batched database writes begin during
+the hash phase:
 
-1.  **walk + stat** — enumerate the trees under all `PATH` operands concurrently
+1.  **load** — read the existing records. Each record under the operands is kept
+    in memory, by path, with its size, its mtime and whether it has hashes, for
+    the walk to compare each file with; the size of every other record joins the
+    size census.
+2.  **walk + stat** — enumerate the trees under all `PATH` operands concurrently
     with the walk worker pool: every operand seeds the shared queue, and each
     worker reads one directory at a time, handing discovered subdirectories back
     to the queue and running `lstat` on each regular file as it is discovered
@@ -470,7 +511,7 @@ inside each phase; batched database writes begin during the hash phase:
     or busy pools. The walk builds the size census and resolves unchanged
     already-hashed files on the fly; every other file is carried to the hash
     phase as a (path, size, mtime) record.
-2.  **hash** — with the census complete, each carried file's size decides its
+3.  **hash** — with the census complete, each carried file's size decides its
     fate. Size-unique files are never read: new or changed ones are recorded
     without hashes in the update phase, unchanged unhashed ones simply keep
     their records. Every file with a shared size is hashed by the worker pool as
@@ -486,10 +527,10 @@ inside each phase; batched database writes begin during the hash phase:
     **while hashing runs**, so a scan interrupted after hours keeps everything
     hashed so far and the next scan resumes cheaply, skipping records already
     written.
-3.  **update** — commit the final partial batch, the hash-less records for
+4.  **update** — commit the final partial batch, the hash-less records for
     size-unique new and changed files, and the deletions for records the scan
     did not verify (vanished files, plus paths that failed to stat or hash).
-4.  **content** — find every record of 10 MiB or more without a `content` hash
+5.  **content** — find every record of 10 MiB or more without a `content` hash
     whose size, `head`, and `tail` equal another record's, anywhere in the
     database: records from this scan and records stored by earlier scans, inside
     or outside the scanned operands. SQLite finds them, so only the records to
@@ -522,17 +563,19 @@ Rules for the walk:
 - Filesystem boundaries are crossed by default. With `-x` (long form
   `--one-file-system`, following the GNU `du`/`rsync` convention), never descend
   into a directory on a different filesystem than its `PATH` operand; each
-  operand is bounded by its own filesystem. The records below such a directory
-  count as outside the scanned operands, as described in "`scan` mode" above:
-  they are not deleted, and their sizes join the size census.
+  operand is bounded by its own filesystem. The records below such a directory,
+  unless they lie below an operand at or inside that directory, count as outside
+  the scanned operands, as described in "`scan` mode" above: they are not
+  deleted, and their sizes join the size census.
 - On any per-path error (permission denied, file vanished between passes,
   unreadable): print a one-line warning to stderr, skip the path, and continue.
   Per-file errors never abort the run; the final summary reports how many were
   skipped. As specified above, a skipped path that has a database record from an
   earlier scan loses that record, unless it failed only in the content phase, or
-  is an operand dropped before the database was read that lies under no other
-  operand; an unreadable directory subtree likewise loses its records (accepted:
-  the database mirrors what the latest scan could actually verify).
+  is an operand dropped before the database was read whose record counts as
+  outside the scanned operands; an unreadable directory subtree likewise loses
+  its records (accepted: the database mirrors what the latest scan could
+  actually verify).
 
 Concurrency: the walk phase (which also stats files), the hash phase, and the
 content phase each use a worker pool of `--workers` workers (default
@@ -541,8 +584,9 @@ files. `--workers` must be at least 1: a smaller value is a usage error,
 reported in one line on stderr with exit 2 before anything is scanned. All three
 phases are seek-bound on spinning disks, so raising `--workers` well past the
 core count can help on pools with many spindles. The main goroutine owns
-partitioning, database writes, and progress rendering; progress display must
-never block the workers.
+partitioning, database writes, and the progress counts, which each progress
+display draws from a goroutine of its own; progress display must never block the
+workers.
 
 `scan` writes nothing to stdout. The summary line on stderr reports the files
 seen this run broken down by disposition, plus skips:
@@ -674,40 +718,72 @@ units.
 Use the progress-bar library for all scan progress; rendering in the style of
 `pv` is the model. All progress goes to stderr.
 
-Each phase gets its own display, rendered the moment the phase starts — a scan
-must never look hung. Loading the existing-record index (`load`) and the walk
-have no known totals while running: show a live count, rate, and elapsed time
-(spinner-style, no percentage or ETA). The content phase's display (`content`)
-starts the same way, counting the records checked while SQLite finds the files
-to read and `lstat` checks them, then shows a bar once reading starts. The hash
-and update phases, and the content phase's reads, have exact totals — only files
-that actually need hashing appear in the hash and content totals, so their ETAs
-are meaningful. Required elements for the bars with known totals:
+A scan must always show that it is working and not hung. Each phase gets its own
+display from the moment it starts, naming the phase and its place among the five
+(`[1/5] load`, `[2/5] walk`, `[3/5] hash`, `[4/5] update`, `[5/5] content`) and
+showing its progress, its elapsed time and its estimated time remaining (ETA):
 
-- elapsed time
-- estimated time remaining
-- a `[m/n] x%` display (items processed / total items, percent)
+- `load` counts the records first, then reads them against that count. While the
+  count runs, the display says it is counting the records.
+- `walk` has no exact total. Its estimate is the number of records the last scan
+  left under the operands, known once `load` is done and shown with a `~`. Once
+  the walk passes the estimate, or when there are no such records, as on a first
+  scan, the ETA is unknown.
+- `hash` and `update` have exact totals. Only files that actually need hashing
+  appear in the hash total, so its ETA is meaningful.
+- `content` first counts the records whose files it checks with `lstat`, which
+  SQLite does by adding up the number of records with each matching size,
+  `head`, and `tail`, without fetching the records. It then says it is searching
+  the database until SQLite returns the first record; the checks, and their rate
+  and ETA, start there. The files to read then get a display of their own, with
+  their count as its total.
+
+Each display is one line holding:
+
+- the phase and its place among the phases
+- a `[m/n] x%` display (items processed / total items, percent); before a phase
+  has a total, the items processed, or what the phase is waiting for
 - current rate (items/s)
+- elapsed time
+- estimated time remaining, or `unknown`
 
 Example shape (exact layout is flexible, content is not):
 
 ```
-hash: [12345/98765] 12% |████      | 92 files/s elapsed 2:32 eta 17:54
+[3/5] hash: [12345/98765] 12% |████      | 92 files/s elapsed 2:32 eta 17:54
+[2/5] walk: [1234567/~1200000] 103%, 5120 files/s, elapsed 4m1s, eta unknown
 ```
 
 Additional requirements:
 
+- On a terminal, a phase with an exact total (every phase but `walk`, once it
+  has counted what it will do) is drawn as its line followed by the progress-bar
+  library's bar, 10 columns wide, which shows the percent in place of the line's
+  own. Any other phase, and a phase whose bar has no room, is drawn as the
+  library's spinner followed by its line. Each display is drawn again several
+  times a second, so its elapsed time keeps moving while a phase waits for its
+  next item.
+- On a terminal no line reaches the terminal's last column, however narrow the
+  terminal is. The phase and its place, the progress, the elapsed time and the
+  ETA are kept whole: a line too wide for the terminal leaves out its rate first
+  (or what the phase is waiting for), and a bar with no room beside those four
+  gives way to the spinner. Only when those four alone are too wide, as on a
+  terminal narrower than about 70 columns hours into a scan of millions of
+  files, is the line cut short at the terminal's edge, so the end of the ETA is
+  lost first. A terminal made narrower while a phase runs gets the same: the
+  next draw erases the line within the new width and fits the line to it, and
+  the display goes on redrawing in place.
 - When stderr is not a terminal (a pipe, a file, `/dev/null`), do not emit ANSI
-  redraws: print a plain one-line progress update the moment each phase starts,
-  then no more often than every 5 seconds.
-- Progress updates are driven from the main goroutine and must be non-blocking
-  with respect to the worker pool. On a terminal the spinner-style displays also
-  redraw on their own several times a second, so their count and elapsed time
-  stay current while a phase waits for its next item.
+  redraws: print the line the moment each phase starts, every 5 seconds while it
+  runs (whether or not an item has completed, and never more often), and once
+  more as the phase ends.
+- Progress must be non-blocking with respect to the worker pool: the main
+  goroutine counts the items, and each display draws them from a goroutine of
+  its own.
 - A warning printed during a phase always lands on a line of its own, never
   inside the progress display.
-- A bar whose phase stops short of its total, as an interrupted one does, is
-  left as last drawn rather than filled up.
+- A phase that stops short of its total, as an interrupted one does, is left
+  showing the count it stopped at rather than filled up.
 - `report` and `trees` modes need no progress display, only their stderr
   summaries.
 
@@ -762,104 +838,67 @@ entrypoints are:
 - `script/bootstrap` — install everything needed to build and develop this
   repository, idempotently, assuming nothing is present. `git`, `make`, and `go`
   come from the first of nix, apt, brew, or apk found on the host, and are
-  presence-checked only. `golangci-lint` and prettier are deliberately **not**
-  installed: they run in Docker (see `script/lint` and `script/fmt`) and never
-  from a host install, so there is no host copy to drift from the pin. A missing
-  `docker` is warned about rather than installed or treated as fatal —
-  everything except linting, formatting and `make test-race` works without it.
-  Ends with `go mod download`.
+  presence-checked only. An installed node is used when its major version is 22;
+  otherwise node 22.17.0 is installed through nvm, which comes from a release
+  archive whose sha256 the script checks, and yarn 1.22.22 is activated under it
+  through corepack. With an installed node 22, a yarn already on `PATH` is used
+  as it is; otherwise yarn 1.22.22 is activated through corepack, or installed
+  with `npm` when there is no corepack. `yarn install --frozen-lockfile` then
+  installs the prettier that `package.json` and `yarn.lock` pin. `golangci-lint`
+  is never installed: it runs in Docker (see `script/lint`). `docker` is not
+  installed either; testing, linting and the image build need it. Ends with
+  `go mod download`.
 - `script/setup` — make a fresh clone ready for development: runs
   `script/bootstrap`, then `script/install-precommit`.
 - `script/projectname` — print this project's name (`sfdupes`). Scripts that
   need the name call it, so they stay identical across repositories.
-- `script/test` — run the test suite with a 30-second timeout and coverage
-  enabled, rerunning verbosely on failure so the logs show which test failed.
-- `script/test-race` — run the test suite under the race detector with a
-  60-second timeout. The detector needs cgo and a C compiler, which the build
-  never uses, so the tests run in a digest-pinned Debian `golang` image that has
-  `gcc`, with the checkout mounted read-only; the container is removed when it
-  exits. They run as the calling user, or as `nobody` when that is root, because
-  several tests make a file unreadable and root reads it anyway; only then must
-  the checkout be readable by other users. Not part of `script/check`. Every run
-  starts with empty caches, so it needs the network and takes minutes, and the
-  mount needs a local docker daemon.
-- `script/lint` — run the linter. It builds `Dockerfile.lint`, which copies the
-  repository into the digest-pinned `golangci/golangci-lint` image and runs
-  `golangci-lint config verify` and `golangci-lint run` as build steps, so a
-  successful build is a clean lint. That exit status is all it produces, so it
-  runs with `--output=type=cacheonly` and writes no image; a run leaves only
-  build cache. The linter is never run on the host, which makes a working
-  `docker` the one prerequisite for linting — and therefore for `make check` and
-  the pre-commit hook. Offline machines: the gate steps themselves make no
-  network calls. `golangci-lint run` does not, and neither does
-  `golangci-lint config verify` — it validates against a schema the pinned
-  binary embeds, measured under `--network none` to both pass a valid config and
-  reject an invalid one. The build around them does. `Dockerfile.lint` runs
-  `go mod download` before the gates and this module has external dependencies,
-  so a first lint on a machine with a cold BuildKit cache reaches the network
-  there (as well as pulling the pinned image); under `--network none` it fails
-  at that step, before any gate. That layer sits above the gates and stays
-  cached, so once it is warm `script/lint` — and with it `make check` — runs
-  entirely offline, until `go.mod` or `go.sum` changes and the download layer
-  goes cold again. Because the daemon only ever sees a build context, this works
-  when the docker daemon is remote and bind mounts are impossible.
+- `script/test` — run the test suite under the race detector, with a 90-second
+  timeout and coverage enabled, rerunning verbosely on failure so the logs show
+  which test failed. It builds the `Dockerfile`'s `test` phase alone and writes
+  no image. The race detector needs cgo and a C compiler, which the build never
+  uses, so the phase starts from a digest-pinned Debian `golang` image, which
+  has `gcc`. The tests run as `nobody`, because several of them make a file
+  unreadable and root reads it anyway.
+- `script/lint` — run the linter. It builds the `Dockerfile`'s `lint` phase
+  alone and writes no image: in the digest-pinned `golangci/golangci-lint`
+  image, the gofmt check, `golangci-lint config verify` and `golangci-lint run`
+  run as build steps, so a successful build is a clean lint. The linter is never
+  run on the host, which makes a working `docker` the one prerequisite for
+  linting.
 - `script/fmt` — format in place: the Go sources with `gofmt -s -w`, and every
   Markdown file with prettier, at the settings in `.prettierrc` (4-space
-  indents, prose wrapped at 80 columns). prettier is pinned by hash through
-  `package.json` and `yarn.lock` and never installed on the host: this builds
-  the `Dockerfile`'s `prettier` stage, a digest-pinned node image into which
-  `yarn install --frozen-lockfile` installs it, tagged `sfdupes-prettier`, and
-  runs that with the repository mounted, as the calling user. Needs `docker`,
-  and because of the mount, unlike `script/lint`, a local docker daemon.
-- `script/fmt-check` — the read-only counterpart of `script/fmt`, with the
-  repository mounted read-only: prints any unformatted file and exits non-zero
-  instead of writing. gofmt and prettier both run every time, and each names
-  itself when it fails. The `Dockerfile` runs the same two checks as gates: the
-  gofmt check in its lint stage, prettier in its `markdown` stage.
+  indents, prose wrapped at 80 columns). Both run on the host, prettier through
+  yarn at the version `yarn.lock` pins. When the node on `PATH` is not node 22,
+  this loads the node 22.17.0 that `script/bootstrap` installed through nvm.
+- `script/fmt-check` — the read-only counterpart of `script/fmt`: prints any
+  unformatted file and exits non-zero instead of writing. gofmt and prettier
+  both run every time, and each names itself when it fails. The `Dockerfile`'s
+  `lint` phase runs the same gofmt check.
 - `script/check` — run `script/test`, `script/lint`, and `script/fmt-check`, in
-  that order. Modifies nothing. Needs `docker`, because `script/lint` and
-  `script/fmt-check` do.
+  that order. Modifies nothing. The first two need `docker`, the third what
+  `script/bootstrap` installs.
 - `script/docker` — build the Docker image, tagged with the name from
-  `script/projectname`. The `Dockerfile` runs the gates as build steps, so this
-  is also the check a developer or reviewer runs by hand.
-- `script/cibuild` — build the Docker image untagged. This is what the Gitea
-  workflow runs on push; because the gates run as build steps, a successful
-  build implies the repository is green.
+  `script/projectname`, passing the output of
+  `git describe --tags --always --dirty` (or `unknown` when that is empty) as
+  the `VERSION` build argument. The `Dockerfile`'s build stage depends on its
+  `lint` and `test` phases, so this also runs the tests and the linter.
+- `script/cibuild` — run `script/bootstrap`, then `script/check`, then build the
+  image as `script/docker` does. This is what the Gitea workflow runs on push; a
+  successful run means every check passed. The tests and the linter run twice:
+  once in `script/check`, and again as stages of the image build.
 - `script/precommit` — run by the git pre-commit hook: `go mod tidy` must be a
   no-op (a resulting change to `go.mod` or `go.sum` fails the commit), then
   `script/check`.
-- `script/install-precommit` — install the git pre-commit hook that runs
-  `script/precommit`. The hook is written to the common git directory, so the
-  main checkout and every worktree share it.
-- `script/verify-lint-image-pin` — fail unless the `golangci/golangci-lint`
-  reference in `Dockerfile.lint` and the one in the `Dockerfile` lint stage are
-  the same image at the same digest, naming both if not. The linter is pinned in
-  those two files and nothing else keeps them in sync, so a bump applied to one
-  alone would leave `make lint` and the `Dockerfile`'s fail-fast lint stage
-  checking the same tree against different rulesets, both green. The guard
-  restates neither pin — a third copy would be the same drift one file further
-  out — and runs as a gate in both files, so `make lint`, `make check` and
-  `make docker` all catch it.
+- `script/install-precommit` — install the git pre-commit hook, as
+  `.git/hooks/pre-commit`, that runs `script/precommit`.
 
-`script/verify-linter-pin` used to live here. It compared a linter binary
-against a version pin in `script/bootstrap`, and both of its subjects are gone:
-no linter binary is copied between build stages any more, and bootstrap pins no
-version because it installs no linter. The drift it existed to catch has moved
-from binary-versus-pin to pin-versus-pin, which is what
-`script/verify-lint-image-pin` above checks.
-
-`script/lint`, `script/docker` and `script/cibuild` all pass a freshly computed
-`CHECK_EPOCH` build argument, and the gate steps in `Dockerfile.lint` and
-`Dockerfile` reference it. Without that, an unchanged tree lets Docker serve the
-gate layers from cache and the build exits 0 having executed no tests and no
-lint — a green it never earned, and one this repository has produced twice.
-`CHECK_EPOCH` invalidates the gate layers on every run while leaving the pinned
-base images and the dependency layers cached. Each script's value carries the
-process id as well as the epoch, because two runs land inside the same second
-easily and a bare epoch would cache the second one. Each `Dockerfile` stage with
-gates fails when the value is empty, so a bare `docker build .` stops with
-`CHECK_EPOCH is unset; build via script/cibuild or script/docker` instead of
-serving the gates from cache.
+Every `docker build` in `script/` passes a new `CACHEBUST` build argument, which
+every stage of the `Dockerfile` declares first, so every `RUN` step runs again
+each time. On an unchanged tree Docker would otherwise serve the gate steps from
+its cache, and the build would pass having run no test and no linter. Go's build
+cache is kept between builds on the steps that compile, so only what changed is
+compiled again; the tests run with `-count=1`, so none reports a stored result.
+Every run downloads the Go modules again and needs the network.
 
 ## Build
 
@@ -871,17 +910,15 @@ compile recipe:
   the default target.
 - `make bootstrap` — install the build and development dependencies.
 - `make setup` — prepare a fresh clone: `bootstrap` plus the pre-commit hook.
-- `make test` — run the test suite (30-second timeout; reruns with `-v` on
-  failure).
-- `make test-race` — run the test suite under the race detector, in Docker (see
-  `script/test-race`); requires `docker`. Not part of `make check`.
-- `make lint` — run `golangci-lint` with the repo config, in Docker (see
-  `script/lint`); requires `docker`.
+- `make test` — run the test suite under the race detector, in Docker (90-second
+  timeout; reruns with `-v` on failure; see `script/test`); requires `docker`.
+- `make lint` — run `golangci-lint` with the repo config and the gofmt check, in
+  Docker (see `script/lint`); requires `docker`.
 - `make fmt` / `make fmt-check` — format the Go sources and the Markdown /
-  verify formatting without writing; requires `docker`, for prettier (see
-  `script/fmt`).
+  verify formatting without writing, on the host; requires `go` and what
+  `make bootstrap` installs (see `script/fmt`).
 - `make check` — `test`, `lint`, and `fmt-check`; modifies nothing. Requires
-  `docker`, via `lint` and `fmt-check`.
+  `docker` and what `make bootstrap` installs.
 - `make docker` — build the Docker image, which runs the gates as build stages.
 - `make hooks` — install the pre-commit hook.
 - `make clean` — remove the binary.

REPO_POLICIES.md

@@ -1,6 +1,6 @@
 ---
 title: Repository Policies
-last_modified: 2026-07-06
+last_modified: 2026-10-15
 ---
 
 This document covers repository structure, tooling, and workflow standards. Code
@@ -54,21 +54,37 @@ style conventions are in separate documents:
   `cibuild`. `script/bootstrap` installs all dependencies idempotently and
   assumes nothing is present: base tools come from nix, apt, brew, or apk
   (detected in that order; apt runs noninteractive). For node it uses the
-  installed node if present; otherwise it installs a PINNED node version via
-  nvm, first installing nvm itself if missing — from a hash-verified GitHub
-  release archive (never `curl | sh`), with bash installed as an explicit
-  prerequisite since nvm requires bash. yarn is then pinned via
-  `corepack prepare yarn@<version> --activate`. Never install "latest" or "lts";
-  always exact versions. `script/cibuild` runs the CI build: it changes to the
-  repo root and runs `docker build .`; the Gitea workflow calls it. Four further
-  scripts are our own extensions to the standard: `script/check` runs
-  `script/test`, `script/lint`, and `script/fmt-check`; `script/precommit` is
-  what the git pre-commit hook runs, and it calls `script/check`;
-  `script/install-precommit` installs the git pre-commit hook (the `make hooks`
-  target shims to it); and `script/projectname` (literally that filename) simply
-  outputs the project's name. Scripts that need the name call
-  `script/projectname` — e.g. `script/docker` assembles its image tag from it —
-  so those scripts stay byte-identical across all repos. Repo-type-specific
+  installed node only when its major version is the pinned one; otherwise (node
+  missing, or another major, such as the node 24 the CI runner image ships) it
+  installs the PINNED node version via nvm and installs yarn and the packages
+  under it. nvm itself is installed first if missing, from a hash-verified
+  GitHub release archive (never `curl | sh`), with bash installed as an explicit
+  prerequisite since nvm requires bash. Only the major version is compared
+  because the `Dockerfile` stages start from a node image whose exact version is
+  not the pin, and nvm cannot install a prebuilt node on alpine. yarn is pinned
+  via `corepack prepare yarn@<version> --activate`. Never install "latest" or
+  "lts"; always exact versions. `script/cibuild` runs the CI build: it changes
+  to the repo root, runs `script/bootstrap`, runs `script/check`, and builds the
+  image with the version; the Gitea workflow calls it. **`script/cibuild` runs
+  `script/bootstrap` first**, because the workflow checks out the repo and runs
+  nothing else, while `script/fmt-check` runs the formatter on the host: on a
+  pristine checkout with nothing installed the run dies there, after the
+  containerised gates have passed. **The bootstrap alone is not enough**: when
+  `script/bootstrap` installs node and yarn under nvm it leaves neither on the
+  `PATH` of the shell that called it, so a bare `yarn` either exits 127 or runs
+  under another node. The host entrypoints that need yarn — `script/fmt` and
+  `script/fmt-check` — therefore use the same test as `script/bootstrap`: when
+  the node on `PATH` has the pinned major version they run the `yarn` on `PATH`,
+  and otherwise they load nvm through `$HOME/.nvm/nvm.sh` and run yarn under the
+  pinned node. A runner carrying nothing but docker and git then gets through
+  `script/check`. Four further scripts are our own extensions to the standard:
+  `script/check` runs `script/test`, `script/lint` and `script/fmt-check`;
+  `script/precommit` is what the git pre-commit hook runs, and it calls
+  `script/check`; `script/install-precommit` installs the git pre-commit hook
+  (the `make hooks` target shims to it); and `script/projectname` (literally
+  that filename) simply outputs the project's name. Scripts that need the name
+  call `script/projectname` — e.g. `script/docker` assembles its image tag from
+  it — so those scripts stay byte-identical across all repos. Repo-type-specific
   pre-commit extras (e.g. `go mod tidy` verification in Go repos) belong in
   `script/precommit`, not in the hook itself. Model scripts are at
   `https://git.eeqj.de/sneak/prompts/raw/branch/main/script/<name>`. The README
@@ -89,87 +105,257 @@ style conventions are in separate documents:
   contributor should be able to understand the entire development workflow by
   reading the Makefile.
 
-- Every repo should have a `Dockerfile`. All Dockerfiles must run `make check`
-  as a build step so the build fails if the branch is not green. For non-server
-  repos, the Dockerfile should bring up a development environment and run
-  `make check`. For server repos, `make check` should run as an early build
-  stage before the final image is assembled. Dockerfiles install development
-  prerequisites by running `script/bootstrap` rather than duplicating installs
-  inline; COPY `script/` and the dependency manifests (`package.json` +
-  `yarn.lock`, `go.mod` + `go.sum`, etc.) before running it so the bootstrap
-  layer stays cached until dependencies change.
+- Every repo should have a `Dockerfile`, and it carries the repo's gates: a
+  `lint` phase and a `test` phase, with the final stage depending on both so the
+  image cannot be built unless they pass. For non-server repos the final stage
+  brings up a development environment; for server repos it is the runtime image.
+  The gate phases and the build stage start from their pinned base images and
+  install what those images lack either inline, as the canonical Go `Dockerfile`
+  below does for `git`, or by running `script/bootstrap`, as the `prompts`
+  repo's own `Dockerfile` does for its yarn packages. The development
+  environment stage installs development prerequisites by running
+  `script/bootstrap` rather than duplicating its installs inline. A stage that
+  runs `script/bootstrap` COPYs `script/` and the dependency manifests
+  (`package.json` + `yarn.lock`, `go.mod` + `go.sum`, etc.) before running it.
 
-- **Dockerfiles must use a separate lint stage for fail-fast feedback.** Go
-  repos use a multistage build where linting runs in an independent stage based
-  on the `golangci/golangci-lint` image (pinned by hash). This stage runs
-  `make fmt-check` and `make lint` before the full build begins. The build stage
-  then declares an explicit dependency on the lint stage via
-  `COPY --from=lint /src/go.sum /dev/null`, which forces BuildKit to complete
-  linting before proceeding to compilation and tests. This ensures lint failures
-  surface in seconds rather than minutes, without blocking on dependency
-  download or compilation in the build stage.
+- **Linting and testing run in Docker, as phases of the `Dockerfile`.** There is
+  no separate lint file. `script/lint` and `script/test` each build one phase
+  and nothing else:
 
-    The standard pattern for a Go repo Dockerfile is:
+    ```sh
+    docker build --build-arg CACHEBUST="$(date +%s)-$$" \
+        --target lint --output type=cacheonly .
+    docker build --build-arg CACHEBUST="$(date +%s)-$$" \
+        --target test --output type=cacheonly .
+    ```
+
+    **A stage that is not the last one in the file is built only when the final
+    stage's chain depends on it, or when `--target` names it.** That is why the
+    two gates are always invoked by name here, and why the final stage carries a
+    `COPY --from=` of a harmless file from each of them: without that edge a
+    plain `docker build .` builds the last stage alone and exits 0 having linted
+    and tested nothing.
+
+    **The gate builds write no image.** With `--output type=cacheonly` the phase
+    runs and a failing step fails the build, but the result is not exported.
+    Nothing uses those images, and writing one out is slow: a Go test phase's
+    image holds the toolchain. A build given neither `--output` nor `-t` writes
+    an untagged image and leaves it dangling, on every developer host and every
+    CI runner. `script/cibuild` and `script/docker` build the image that ships
+    and tag it, so each build replaces the previous image; each assigns the tag
+    on its own line before the build, so `set -e` stops it where
+    `script/projectname` fails.
+
+    Inside a phase the tool is invoked directly — `golangci-lint`, `go test`,
+    `eslint`, `prettier` — never through `make lint` or `script/test`, which are
+    themselves a `docker build` and would recurse into a daemon that does not
+    exist in a build step. Formatting is the exception and stays on the host:
+    `script/fmt` writes the working tree, and `script/fmt-check` is its
+    read-only twin.
+
+    **No lint verdict may come from a host invocation of the linter.** On a
+    shared host golangci-lint reads a result cache keyed on file content rather
+    than location, so a second checkout of the same content is served the first
+    one's findings, and a host-global lock in `$TMPDIR` makes concurrent runs
+    exit non-zero with `parallel golangci-lint is running` — a status a caller
+    cannot tell from real findings. Both have produced wrong verdicts in this
+    org, in both directions. A container has its own golangci-lint cache, its
+    own `TMPDIR` and a digest-pinned binary, so neither is reachable.
+
+- **Any build that runs checks is given a new `CACHEBUST` value.** Docker
+  invalidates a `COPY` layer only when the copied content changes, so on an
+  unchanged tree the check `RUN` is served from cache, nothing executes, and the
+  build still exits 0. Every `docker build` in `script/` therefore passes
+  `--build-arg CACHEBUST="$(date +%s)-$$"`, the time and the script's process
+  id, so no two builds share a value, not even the three in one
+  `script/cibuild`. `script/lint`, `script/test`, `script/cibuild` and
+  `script/docker` are the four, and there is no fifth — `script/check` runs the
+  two gate phases and `script/fmt-check`, and builds no image of its own. Every
+  stage of the `Dockerfile` declares `ARG CACHEBUST` as its first line after
+  `FROM`, and a new value reruns every `RUN` step after that line; `COPY` steps
+  are compared by content and need nothing. A stage without the `ARG` line is
+  served from cache on an unchanged tree, so a repository re-vendors the scripts
+  and adds the `ARG` lines in one commit. The scripts do not pass `--no-cache`:
+  it reruns every step too, but it also empties every cache mount, and Go's
+  build cache, which the canonical Go `Dockerfile` below mounts so that compiled
+  packages survive between check builds, would start empty every time. A bare
+  `docker build .` is not evidence that anything ran: a sub-second build
+  reporting success is a cache hit, not a result. Never invalidate by pruning —
+  `docker builder prune` and friends destroy a build cache shared with every
+  other build on the host. When a check is added or changed, prove it works by
+  planting a defect it must catch and watching the run fail on it, then revert
+  the defect. A green run alone shows neither that the check ran nor that it
+  covers what it should.
+
+- **The gate phases are separate stages, and the build stage depends on both.**
+  The lint phase is based on the `golangci/golangci-lint` image (pinned by
+  hash), so lint failures surface in seconds rather than after a full compile,
+  and the test phase is based on the Debian Go image. The canonical Go repo
+  `Dockerfile`:
 
     ```dockerfile
-    # Lint stage — fast feedback on formatting and lint issues
+    # Every stage declares ARG CACHEBUST first: script/ passes a new value
+    # on every build, which reruns every RUN step after it. The steps that
+    # compile mount Go's build cache, which survives from build to build.
+
+    # Lint phase
     # golangci/golangci-lint:v2.x.x, YYYY-MM-DD
     FROM golangci/golangci-lint@sha256:... AS lint
+    ARG CACHEBUST
     WORKDIR /src
     COPY go.mod go.sum ./
     RUN go mod download
     COPY . .
-    RUN make fmt-check
-    RUN make lint
+    RUN --mount=type=cache,target=/root/.cache/go-build \
+        golangci-lint run --config .golangci.yml ./...
 
-    # Build stage
+    # Test phase. -race needs cgo and so a C compiler, which the Debian Go
+    # image ships and the alpine one does not. -count=1 because the mounted
+    # cache also holds test results, which go test would otherwise replay.
+    # golang:1.x, YYYY-MM-DD
+    FROM golang@sha256:... AS test
+    ARG CACHEBUST
+    WORKDIR /src
+    COPY go.mod go.sum ./
+    RUN go mod download
+    COPY . .
+    RUN --mount=type=cache,target=/root/.cache/go-build \
+        go test -count=1 -timeout 90s -race -cover ./... || \
+        { echo "--- Rerunning with -v for details ---"; \
+          go test -count=1 -timeout 90s -race -v ./...; exit 1; }
+
+    # Build stage. Nothing is wanted from either phase above; the copies
+    # are what make BuildKit build them first, so this stage cannot run
+    # unless lint and test passed.
     # golang:1.x-alpine, YYYY-MM-DD
     FROM golang@sha256:... AS builder
-    WORKDIR /src
-
-    # Force BuildKit to run the lint stage before proceeding
+    ARG CACHEBUST
     COPY --from=lint /src/go.sum /dev/null
-
+    COPY --from=test /src/go.sum /dev/null
+    RUN apk add --no-cache git
+    # A tar-stream context keeps the sender's file owners, which git refuses.
+    RUN git config --system --add safe.directory /src
+    WORKDIR /src
     COPY go.mod go.sum ./
     RUN go mod download
     COPY . .
-    RUN make test
 
-    ARG VERSION=dev
-    RUN CGO_ENABLED=0 go build -trimpath \
-        -ldflags="-s -w -X main.Version=${VERSION}" \
-        -o /app ./cmd/app/
+    # The VERSION build arg when one is given, otherwise
+    # `git describe --tags --always` on the .git in the build context. With
+    # .git present, a version that is still empty, dev or unknown fails the
+    # build: git is missing or could not read the checkout.
+    ARG VERSION
+    RUN --mount=type=cache,target=/root/.cache/go-build \
+        VERSION="${VERSION:-$(git describe --tags --always)}"; \
+        if [ -e .git ]; then \
+            case "$VERSION" in ""|dev|unknown) \
+                echo "version is '$VERSION' although .git is present" >&2; \
+                exit 1 ;; \
+            esac; \
+        fi; \
+        CGO_ENABLED=0 go build -trimpath \
+            -ldflags="-s -w -X main.Version=${VERSION}" \
+            -o /app ./cmd/app/
 
-    # Runtime stage
+    # Runtime stage, and the last one
     FROM alpine@sha256:...
+    ARG CACHEBUST
     COPY --from=builder /app /usr/local/bin/app
     ENTRYPOINT ["app"]
     ```
 
     Key points:
-    - The lint stage uses the `golangci/golangci-lint` image directly (it
-      includes both Go and the linter), so there is no need to install the
-      linter separately.
-    - `COPY --from=lint /src/go.sum /dev/null` is a no-op file copy that creates
-      a stage dependency. BuildKit runs stages in parallel by default; without
-      this line, the build stage would not wait for lint to finish and a lint
-      failure might not fail the overall build.
+    - The lint phase uses the `golangci/golangci-lint` image directly (it has
+      both Go and the linter), so nothing needs installing.
+    - `COPY --from=<phase> /src/go.sum /dev/null` is a no-op copy whose only
+      purpose is the ordering edge. BuildKit runs stages in parallel by default,
+      and a stage nothing depends on is not built at all, so without these two
+      lines a red gate would not fail the build.
+    - Keep the runtime stage last, and if you add a stage after it, give it the
+      same two copies. A plain `docker build .` builds the last stage's chain
+      and nothing else.
+    - Only Go's build cache is mounted (`/root/.cache/go-build`, where Go keeps
+      it for root), and only on the steps that compile: `golangci-lint run`,
+      both `go test` runs and `go build`. It keeps compiled packages between
+      check builds, and Go reuses one only when all its inputs are unchanged, so
+      it saves the compile without skipping a check. Nothing else is kept:
+      golangci-lint's own cache would replay stored findings in place of a lint
+      run, and Go builds from whatever files a kept module cache holds without
+      checking them again (only `go mod verify` does), so a file changed there
+      would go unnoticed. Go's build cache also holds test results, which is why
+      both `go test` runs carry `-count=1`.
     - If the project uses `//go:embed` directives that reference build artifacts
-      (e.g. a web frontend compiled in a separate stage), the lint stage must
+      (e.g. a web frontend compiled in a separate stage), the lint phase must
       create placeholder files so the embed directives resolve. Example:
       `RUN mkdir -p web/dist && touch web/dist/index.html web/dist/style.css`.
-      The lint stage should not depend on the actual build output — it exists to
-      fail fast.
-    - If the project requires CGO or system libraries for linting (e.g.
-      `vips-dev`), install them in the lint stage with `apk add`.
-    - The build stage runs `make test` after compilation setup. Tests run in the
-      build stage, not the lint stage, because they may require compiled
-      artifacts or heavier dependencies.
+    - If the project requires CGO or system libraries for linting, install them
+      in the lint phase. The `golangci/golangci-lint` image is Debian-based and
+      has no `apk`, so install with `apt-get` under the Debian package name
+      (`libvips-dev`, where alpine says `vips-dev`), and delete the package
+      lists in the same `RUN`, so the layer does not keep them:
+
+        ```dockerfile
+        RUN apt-get update \
+            && apt-get install -y --no-install-recommends libvips-dev \
+            && rm -rf /var/lib/apt/lists/*
+        ```
+
+    - `.dockerignore` lets `.git` into the build context. It keeps out every git
+      `config` at any depth (`**/.git/config`, `**/.git/modules/**/config`): the
+      repository's own, each submodule's under `.git/modules/`, and that of a
+      submodule keeping its own `.git` directory. `git describe` does not need
+      them, and each can hold a credential: a password in a remote URL, or the
+      token the CI checkout step stores there. A submodule whose name has a
+      `config` segment (`config`, `deploy/config`, `config/lib`) loses its whole
+      git directory to `**/.git/modules/**/config`, and Go's version stamping
+      then fails the build: give it a name without that segment
+      (`git submodule add --name`). The stage that compiles has `git` (the
+      Debian Go image has it; an alpine one needs `apk add --no-cache git`) and
+      takes the version from the `VERSION` build argument when one is given,
+      otherwise from `git describe --tags --always`. That gives the tag on a
+      tagged commit; on a later commit, the tag, the number of commits since it
+      and the short commit (`v1.2.3-4-gabc1234`); and the short commit when no
+      tag is reachable. The stage that compiles also marks its working directory
+      safe for git (`git config --system --add safe.directory /src`): a context
+      sent as a tar stream keeps the sender's file owners, and git refuses a
+      checkout owned by another user, so the version would come out empty.
+      `ARG VERSION` has no default, and the build fails if the context carries
+      `.git` and the version still comes out empty, `dev` or `unknown`. A plain
+      `docker build .` with no build arguments must succeed; a Dockerfile that
+      refuses an empty build argument drops that refusal and keeps the argument.
+      A checkout whose `.git` is a file (a linked worktree, or a repository
+      checked out as a submodule) is the exception: that file points to a git
+      directory outside the build context, so the build cannot read the version
+      and a plain `docker build .` fails; pass the version with
+      `--build-arg VERSION=...`, as `script/docker` and `script/cibuild` already
+      do.
 
 - Every repo should have a Gitea Actions workflow (`.gitea/workflows/`) that
-  runs `script/cibuild` (which runs `docker build .`) on push. Since the
-  Dockerfile already runs `make check`, a successful build implies all checks
-  pass.
+  runs `script/cibuild` on push, and checks out the repo as its only other step,
+  with `persist-credentials: false`: `script/cibuild` needs no token, and
+  without it the checkout leaves the job's token in `.git/config` for every
+  later step. The checkout step also sets `fetch-depth: 0`, which fetches the
+  tags `git describe` needs: by default it clones shallow with no tags, and a
+  tagged repository's CI build would stamp a bare short commit id. The
+  workflow's `concurrency` block groups runs by workflow and branch
+  (`${{ github.workflow }}-${{ github.ref }}`) with `cancel-in-progress: true`,
+  so a new push cancels the older run on the same branch, queued or running, and
+  no other: runs for replaced commits do not hold up the shared runner.
+  `script/cibuild` bootstraps, runs the gate phases, and then builds the image,
+  so a successful run means every check passed; a bare `docker build .` does not
+  carry the same guarantee, because its gate phases may come from the cache. The
+  image build gets a `CACHEBUST` value of its own and so runs the gate phases a
+  second time. That is the price of the rule above, and it is worth paying: the
+  image that ships is built from a run of its own gates rather than from a cache
+  entry. The `check` job sets `timeout-minutes: 20`, so a hung build frees the
+  shared runner after 20 minutes. That allows for the three Docker builds
+  described above (the test phase, the lint phase, then the image), each held to
+  the 5-minute Docker build limit below, plus the bootstrap. A separate workflow
+  limited to `main` by a `branches` list under `on: push` cannot be checked by
+  review: to try a change to it, add the feature branch to that list and push,
+  then remove the branch from the list again before merging. Keep any job in it
+  that publishes behind `if: github.ref_name == 'main'`, so the run from the
+  feature branch publishes nothing.
 
 - Use platform-standard formatters: `black` for Python, `prettier` for
   JS/CSS/Markdown/HTML, `go fmt` for Go. Always use default configuration with
@@ -189,14 +375,21 @@ style conventions are in separate documents:
   module under test to verify it compiles/parses. There is no excuse for
   `make test` to be a no-op.
 
-- `make test` must complete in under 20 seconds. Add a 30-second timeout in the
-  Makefile.
+- `make test` must complete in under 60 seconds. That is the hard cap, and a
+  suite that exceeds it fails. Under 20 seconds is the target. A suite between
+  20 and 60 seconds is still green, but the overage must be filed as an
+  improvement bug against that repo. Add a 90-second timeout to the test
+  invocation (`go test -timeout 90s`). The backstop deliberately sits above the
+  hard cap so that it catches a genuinely hung test rather than a merely slow
+  one.
 
-- **`make test` should use the conditional verbose rerun pattern.** Run tests
-  without `-v` (verbose) first. If tests fail, automatically rerun with `-v` to
-  show full output. This keeps CI logs and `docker build` output clean on
-  success (just package/suite summaries) while providing full diagnostic detail
-  on failure (every test case, every assertion). The general shell pattern:
+- **The test command should use the conditional verbose rerun pattern.** Run
+  tests without `-v` (verbose) first. If tests fail, automatically rerun with
+  `-v` to show full output. This keeps CI logs and `docker build` output clean
+  on success (just package/suite summaries) while providing full diagnostic
+  detail on failure (every test case, every assertion). The command lives in the
+  `test` phase of the `Dockerfile`, since `script/test` builds that phase; the
+  Makefile form below is the same pattern for any repo-local invocation:
 
     ```makefile
     test:
@@ -209,11 +402,25 @@ style conventions are in separate documents:
 
     ```makefile
     test:
-    	@go test -timeout 30s -race -cover ./... || \
+    	@go test -count=1 -timeout 90s -race -cover ./... || \
     		{ echo "--- Rerunning with -v for details ---"; \
-    		  go test -timeout 30s -race -v ./...; exit 1; }
+    		  go test -count=1 -timeout 90s -race -v ./...; exit 1; }
     ```
 
+    `-count=1` is required on both invocations: it defeats Go's test _result_
+    cache, so neither run can report a stored pass in place of running the
+    tests. It leaves the build cache alone, so it costs the runtime of the suite
+    and no recompilation.
+
+    That cache is Go's own, separate from Docker's layer cache. Go stores a
+    passing result in its cache directory (`GOCACHE`), and when the same tests
+    run again on unchanged code it prints that result, marked `(cached)`,
+    without running them. The directory lasts from one run to the next on a
+    developer's machine, where this target runs, and in the `test` phase of the
+    `Dockerfile`, which mounts it to keep compiled packages between check
+    builds, so the phase's `go test` runs carry `-count=1` too. A new
+    `CACHEBUST` value (above) is what makes that step run on an unchanged tree.
+
     Python example:
 
     ```makefile
@@ -239,10 +446,89 @@ style conventions are in separate documents:
   must be in `.gitignore`. No exceptions.
 
 - `.gitignore` should be comprehensive from the start: OS files (`.DS_Store`),
-  editor files (`.swp`, `*~`), language build artifacts, and `node_modules/`.
-  Fetch the standard `.gitignore` from
+  editor files (`.swp`, `*~`), in-repo agent scratch directories (`.claude/`),
+  `node_modules/`, and the repo's own build outputs. Fetch the standard
+  `.gitignore` from
   `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitignore` when setting up
-  a new repo.
+  a new repo. A repo's `.gitignore` is the standard file followed by the repo's
+  own entries, such as its binaries; a re-vendor replaces the standard part and
+  keeps those entries. These patterns are written to `.gitignore`'s own
+  semantics, in which an unanchored pattern already matches at every depth; they
+  are not a `.dockerignore` and must not be transplanted into one unmodified.
+
+- **`.dockerignore` does not use `.gitignore` semantics, and copying patterns
+  across unmodified leaves secrets in the build context.** Docker matches with
+  `moby/patternmatcher`: `filepath.Match` semantics plus a `**` extension, so
+  `*` does not cross `/` and a pattern without a leading `**/` is anchored at
+  the build-context root. A `.dockerignore` listing `.env`, `*.pem` and `*.key`
+  therefore excludes only the copies at the repository root, while `config/.env`
+  and `certs/server.key` still reach the context and can land in an image layer
+  — which is more dangerous than a short file with no secret patterns at all,
+  because it reads as solved and stops anyone looking. Give every
+  depth-independent pattern the `**/` prefix and leave only genuinely
+  root-anchored entries unprefixed: `.claude`, and the repo's own host-built
+  binary, written `/myapp` and never `**/myapp`, which would also match
+  `cmd/myapp/` and delete the package directory from the context. Matching is
+  case-sensitive, and an ALL-CAPS twin per pattern still misses `Server.Key`, so
+  secret names use character ranges — `**/*.[kK][eE][yY]`, `**/*.[pP][eE][mM]`,
+  and likewise for `.envrc` and the extensionless SSH keys. Where such a pattern
+  also catches something the build needs, re-include it with a negation
+  (`!docs/example.env`); deleting the pattern reopens the exposure for every
+  other file it covers. Fetch the standard `.dockerignore` from
+  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.dockerignore` and extend
+  it with the repo's own artifacts.
+
+- **In-repo agent scratch belongs in both files, written to each file's own
+  semantics.** `.claude/` holds one worktree per in-flight agent — an entire
+  additional checkout of the repo — so under `COPY . .` the build context
+  inflates by a multiple of the repo and another session's unreviewed work can
+  be copied into an image layer. In `.gitignore` the entry is `.claude/`,
+  unanchored. In `.dockerignore` it is `.claude`, anchored and with **no** `**/`
+  prefix, because the prefixed form would also delete any nested directory of
+  that name from the build. Anchoring carries a known gap that the canonical
+  `.dockerignore` states in its own comment, since consuming repos receive the
+  file and not the tracker: the directory is created in the agent's working
+  directory, so a repo running agents in subdirectories still ships
+  `services/api/.claude/` and must add its own anchored entry there.
+
+- **A plain `docker build .` of a clone stamps the version that
+  `git describe --tags --always` gives**, derived from the `.git` in the build
+  context as the canonical `Dockerfile` above shows. Without its failure check,
+  a missing `git` or an unreadable checkout would leave `-X main.Version=` empty
+  and the build would still exit 0. `script/docker` and `script/cibuild` pass
+  the version they compute on the host; it takes precedence. They do this
+  byte-identically across repos:
+
+    ```sh
+    # The version and the tag each get their own line: a failing command
+    # substitution inside an argument does not trip `set -e`, so the inline
+    # form degrades to an empty constant.
+    version="$(git describe --tags --always --dirty 2>/dev/null || true)"
+    [ -n "$version" ] || version="unknown"
+    tag="$(script/projectname)"
+    docker build --build-arg CACHEBUST="$(date +%s)-$$" \
+        --build-arg VERSION="$version" \
+        -t "$tag" .
+    ```
+
+    `--always` makes an untagged repo yield an abbreviated commit hash rather
+    than failing, and the `[ -n "$version" ]` line is the single place the
+    fallback is applied — a live check that fires on a build from an export with
+    no `.git` and on a repository with no commits yet. Do not fold it into the
+    substitution as `|| echo unknown`, which makes the guard unreachable. The
+    Dockerfile's side is `ARG VERSION` in the stage that compiles, declared
+    there because `ARG` is stage-scoped; passing `VERSION` to a repo whose
+    Dockerfile declares no such `ARG` is ignored and costs nothing, which is why
+    the scripts stay byte-identical. One consequence for CI: the standard
+    checkout action clones shallow and fetches no tags, so the canonical
+    `.gitea/workflows/check.yml` sets `fetch-depth: 0` on its checkout step.
+
+- **Verify `.dockerignore` by enumerating the image, not by reading the
+  patterns.** Plant files at the root _and_ at least two directories deep, build
+  a probe image that does `COPY . .`, and list what actually landed
+  (`docker run --rm --entrypoint find IMAGE /app`). The `transferring context`
+  size is not a substitute: a nested secret is a few bytes, and BuildKit
+  transfers only the delta from the previous build.
 
 - **No build artifacts in version control.** Code-derived data (compiled
   bundles, minified output, generated assets) must never be committed to the
@@ -258,9 +544,61 @@ style conventions are in separate documents:
 - Make all changes on a feature branch. You can do whatever you want on a
   feature branch.
 
-- `.golangci.yml` is standardized and must _NEVER_ be modified by an agent, only
-  manually by the user. Fetch from
-  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml`.
+- `.golangci.yml` is standardized. The vendored copy in a consuming repo must
+  _NEVER_ be modified by an agent: fetch it from
+  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml` and keep it
+  byte-identical, so that no repo can quietly loosen its own linting. Linter
+  configuration changes are made to the canonical copy in the `prompts` repo and
+  reach consuming repos by re-vendoring; an agent may open a PR against
+  canonical, which only the user merges. One list is exempt from byte-identity,
+  because it cannot be written once for every repo: the `deny` list of the
+  `test-support` depguard rule, where a repo names its own test-support packages
+  by full import path. A repo adds entries there and changes nothing else, and a
+  re-vendor carries its entries forward. The canonical golangci-lint version is
+  v2.14.0 (released 2026-09-24), pinned as the digest of the lint phase's base
+  image
+  (`golangci/golangci-lint@sha256:ad862ba6b3798cbe0fd9fd7408d498fd74fbd2623a92406b2fd3898faf0bf98f`,
+  which reports `2.14.0 built with go1.27.0 from 114493f9`). A module's `go`
+  directive must not name a newer Go minor version than the one golangci-lint
+  was built with, or golangci-lint refuses to lint it: this release lints
+  `go 1.27.1` but not `go 1.28`. That digest is the only pin, since no repo
+  installs golangci-lint on the host. A repo sets the lint phase digest to the
+  one named here and re-vendors `.golangci.yml` in the same commit, whichever of
+  the two prompted the change: the canonical copy can name linters that an older
+  golangci-lint rejects, and a newer golangci-lint can add linters that
+  `default: all` switches on until the canonical copy disables them.
+
+- **`script/bootstrap` installs a pinned tool by comparing versions, never by
+  testing presence.** An `if ! command -v <tool>; then install; fi` guard tests
+  `PATH` only, so on an already-provisioned machine the pin is inert and a
+  version bump is a silent no-op — while the Dockerfile, installing into a clean
+  image, gets the pinned version, so a local `make check` and `make docker` can
+  disagree about what the tool even is. The canonical form:
+    - compares the installed version against the pin over the **whole** version
+      token; a parser that stops at the first `-` reports `2.12.2` for a host
+      running `2.12.2-rc1` and skips the install;
+    - treats absent, non-zero, empty or unrecognised `--version` output as a
+      mismatch, so the failure direction is a redundant install and never a
+      skipped one;
+    - after installing, re-resolves the binary the way callers do — `hash -r`,
+      then through `PATH`, not through the directory the installer wrote to —
+      and fails naming the resolved path, since an install that a shadowing
+      binary hides succeeds while changing nothing any caller sees;
+    - is actually called, and prints the version on both success paths: a
+      function defined and never invoked has the same exit status and the same
+      empty output as one that worked.
+
+    Node is the exception to the whole-token comparison: the canonical
+    `script/bootstrap` compares only its major version, because the node 22
+    alpine image the `Dockerfile` stages start from is not the exact pin, and
+    nvm cannot install a prebuilt node on alpine.
+
+    Keep it POSIX sh: no arrays, no `[[`, no `grep -P`.
+
+    A Go tool a repo needs on the host is installed with `go install` pinned to
+    a commit hash (`go install <package>@<commit hash>`). It is never tracked as
+    a `go.mod` tool dependency or through a `tools.go` file, either of which
+    pulls the tool's own dependencies into the repo's `go.mod` and `go.sum`.
 
 - When pinning images or packages by hash, add a comment above the reference
   with the version and date (YYYY-MM-DD).
@@ -371,15 +709,21 @@ style conventions are in separate documents:
       Never edit existing migrations after release.
 
 - All repos should have an `.editorconfig` enforcing the project's indentation
-  settings.
+  settings: the standard file from
+  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.editorconfig`, which sets
+  tabs for `Makefile` and Go files, followed by the repo's own sections, such as
+  one for another language it uses. A re-vendor replaces the standard part and
+  keeps those sections.
 
 - Avoid putting files in the repo root unless necessary. Root should contain
-  only project-level config files (`README.md`, `Makefile`, `Dockerfile`,
-  `LICENSE`, `.gitignore`, `.editorconfig`, `REPO_POLICIES.md`, and
-  language-specific config). Everything else goes in a subdirectory. Canonical
-  subdirectory names:
+  only project-level config files (`README.md`, `AGENTS.md`, `Makefile`,
+  `Dockerfile`, `LICENSE`, `.gitignore`, `.editorconfig`, `REPO_POLICIES.md`,
+  and language-specific config). Everything else goes in a subdirectory.
+  Canonical subdirectory names:
     - `bin/` — executable scripts and tools
-    - `cmd/` — Go command entrypoints
+    - `cmd/` — Go command entrypoints; thin only: one `main.go` per binary whose
+      body is a single call into `internal/` or `pkg/`, no project logic in
+      `cmd/`
     - `configs/` — configuration templates and examples
     - `deploy/` — deployment manifests (k8s, compose, terraform)
     - `docs/` — documentation and markdown (README.md stays in root)
@@ -406,3 +750,7 @@ style conventions are in separate documents:
     - Go: `go.mod`, `go.sum`, `.golangci.yml`
     - JS: `package.json`, `yarn.lock`, `.prettierrc`, `.prettierignore`
     - Python: `pyproject.toml`
+
+- Guidance for coding agents lives in one `AGENTS.md` at the repository root. It
+  is never committed under a file or directory named after one agent tool, such
+  as `CLAUDE.md` or `.claude/`, and never split into separate memory files.

TODO.md

@@ -29,9 +29,45 @@
 
 # Completed Steps
 
+- each `scan` phase's progress display names the phase and its place among the
+  five, as `[2/5] walk`, from the moment it starts, with its progress, elapsed
+  time and ETA: `load` counts the records first, the walk's total is estimated
+  from the records under the operands, and the content phase counts the records
+  it checks from SQLite's grouping alone, then says it is searching the database
+  until the first one is returned. On a terminal a phase with an exact total
+  draws its line followed by the library's bar, and any other a spinner followed
+  by the line; every display is drawn again several times a second. No line
+  reaches the terminal's last column, however narrow, also after the terminal is
+  made narrower during a phase: a line too wide leaves out its rate, then its
+  bar, keeping the phase, progress, elapsed time and ETA whole, and is cut short
+  only when those alone do not fit, as below about 70 columns late in a large
+  scan. In plain mode the line is printed every 5 seconds whether or not an item
+  completed (2026-10-16, https://git.eeqj.de/sneak/sfdupes/issues/112)
+
+- `scan`, `report` and `trees` first print a line on stderr naming the database
+  they use, as an absolute path, and whether that path is the default or comes
+  from `SFDUPES_DATABASE`; `scan` says when the database is new. README
+  "Database" says when `scan` writes each file (2026-10-16,
+  https://git.eeqj.de/sneak/sfdupes/issues/111)
+
+- re-vendor the canonical files and model scripts from `sneak/prompts` `next` at
+  `e3f79c4`: golangci-lint v2.14.0; lint and test are phases of the `Dockerfile`
+  that write no image, and `make test` runs the suite under the race detector,
+  so `Dockerfile.lint`, `script/verify-lint-image-pin` and `make test-race` are
+  gone; every `docker build` in `script/` passes a new `CACHEBUST` value, which
+  every stage of the `Dockerfile` declares first, so every `RUN` step runs on
+  every build, while the steps that compile keep Go's build cache and the tests
+  run with `-count=1`; prettier runs on the host, from the node and yarn
+  `script/bootstrap` installs, so the `prettier` and `markdown` stages are gone
+  and the build stage installs `git` and `make` itself; a new push cancels the
+  workflow's older run on the same branch, and a run stops after 20 minutes;
+  `.claude/settings.json` is deleted (2026-10-15,
+  https://git.eeqj.de/sneak/sfdupes/issues/95)
+
 - with `-x`, an operand under another operand is walked on its own instead of
-  being dropped when it is a directory on a different filesystem than that
-  operand, or a regular file in such a directory, and the records of files gone
+  being dropped when a directory from it (from its directory, for a regular
+  file) up to but not including that operand is on a different filesystem than
+  that operand, whose walk then cannot reach it, and the records of files gone
   from below it are deleted (2026-10-14,
   https://git.eeqj.de/sneak/sfdupes/issues/106)
 
@@ -59,19 +95,26 @@
   https://git.eeqj.de/sneak/sfdupes/issues/12)
 
 - cut the narration from `TODO.md` Completed Steps and from the comments in
-  `script/` and both Dockerfiles; §Workflow now branches from and merges to
-  `next` (2026-10-04, https://git.eeqj.de/sneak/sfdupes/issues/49)
+  `script/`, `Dockerfile` and `Dockerfile.lint` (gone since
+  https://git.eeqj.de/sneak/sfdupes/issues/95); §Workflow now branches from and
+  merges to `next` (2026-10-04, https://git.eeqj.de/sneak/sfdupes/issues/49)
 
-- `make test-race` runs the test suite under the race detector in a cgo-enabled
+- `make test-race` ran the test suite under the race detector in a cgo-enabled
   container, outside `make check` (2026-10-04,
-  https://git.eeqj.de/sneak/sfdupes/issues/18)
+  https://git.eeqj.de/sneak/sfdupes/issues/18). Since
+  https://git.eeqj.de/sneak/sfdupes/issues/95 `make test` itself runs the suite
+  under the race detector, in the `Dockerfile`'s Debian-based `test` phase, and
+  `make test-race` is gone
 
-- a bare `docker build .` fails with a message naming `script/cibuild` and
-  `script/docker` instead of serving the gates from cache (2026-10-04,
-  https://git.eeqj.de/sneak/sfdupes/issues/39)
+- a bare `docker build .` failed, naming `script/cibuild` and `script/docker`,
+  rather than serve the gates from cache (2026-10-04,
+  https://git.eeqj.de/sneak/sfdupes/issues/39). Since
+  https://git.eeqj.de/sneak/sfdupes/issues/95 a bare build succeeds, as
+  `REPO_POLICIES.md` requires, and may serve the gates from cache; the builds in
+  `script/` pass a new `CACHEBUST` value, so theirs always run
 
-- `make fmt` and `make fmt-check` run prettier over all Markdown, in Docker, and
-  CI checks it; all Markdown reformatted (2026-10-04,
+- `make fmt` and `make fmt-check` run prettier over all Markdown, and CI checks
+  it; all Markdown reformatted (2026-10-04,
   https://git.eeqj.de/sneak/sfdupes/issues/19)
 
 - `script/lint` writes no image, so a run no longer leaves an untagged one
@@ -114,9 +157,12 @@
 - README documents install, Docker, a daily cron scan and how to read and check
   the reports (2026-10-04, https://git.eeqj.de/sneak/sfdupes/issues/54)
 
-- the `Dockerfile` build stage keeps the Go module cache out of `builder`'s home
-  and copies the sources with `--chown`, so no `chown -R` walks them
-  (2026-10-04, https://git.eeqj.de/sneak/sfdupes/issues/43)
+- the `Dockerfile` build stage kept the Go module cache out of `builder`'s home
+  and copied the sources with `--chown`, so no `chown -R` walked them
+  (2026-10-04, https://git.eeqj.de/sneak/sfdupes/issues/43). Since
+  https://git.eeqj.de/sneak/sfdupes/issues/95 there is no `builder` user and
+  nothing changes owner: the build stage only compiles, as root, and the tests
+  run as `nobody` in the `test` phase
 
 - `--version` prints `sfdupes VERSION` to stdout; README documents it and
   `--help` (2026-10-04, https://git.eeqj.de/sneak/sfdupes/issues/15)
@@ -180,97 +226,46 @@
 
 - fix the lint-image pin comments and `FROM` form in `Dockerfile` and
   `Dockerfile.lint` (2026-08-10, branch `next`, closes
-  https://git.eeqj.de/sneak/sfdupes/issues/25): both pins are now the policy
+  https://git.eeqj.de/sneak/sfdupes/issues/25): both pins became the policy
   `# image:vX.Y.Z, YYYY-MM-DD` comment over a bare `FROM image@sha256:...`,
-  without the false `(Debian-based)` note or the tag; digest unchanged.
-  `script/verify-lint-image-pin` still matches the tagless form, and a tag on
-  one side only is caught as a plain mismatch.
+  without the false `(Debian-based)` note or the tag. Since
+  https://git.eeqj.de/sneak/sfdupes/issues/95 the `Dockerfile`'s `lint` phase
+  holds the only golangci-lint pin, in that form, so `Dockerfile.lint` and
+  `script/verify-lint-image-pin`, which compared the two pins, are gone.
 
 - run all linting in Docker via `Dockerfile.lint` and `script/lint` (2026-08-10,
   branch `next`, closes https://git.eeqj.de/sneak/sfdupes/issues/46): per the
-  owner ruling the linter is never installed on a host. `Dockerfile.lint` copies
-  the repo into the digest-pinned `golangci/golangci-lint:v2.12.2` image and
-  runs `golangci-lint config verify` and `golangci-lint run` as build steps;
-  `script/lint` builds it. `script/bootstrap` no longer installs or pins the
-  linter, and warns rather than fails when `docker` is absent;
-  `ENV PATH=/home/builder/go/bin:$PATH` went with its `go install`.
-  `script/verify-linter-pin` is retired; `script/verify-lint-image-pin`, a gate
-  in both files, compares their two `FROM` lines and restates neither pin.
-  Traps: an unchanged tree lets a lint build pass in under a second having run
-  no linter, so every gate `RUN` references `ARG CHECK_EPOCH` (BuildKit hashes
-  the expanded command) and `script/lint` passes `"$(date +%s)-$$"`, the PID
-  because two runs land in the same second easily. Nothing inside an image build
-  may shell out to docker, so the `Dockerfile` lint stage calls `golangci-lint`
-  directly and the build stage runs `make test` and `make fmt-check` instead of
-  `make check`, through `make` because the Makefile's `export CGO_ENABLED = 0`
-  only reaches what it invokes. `COPY --from=lint /src/go.sum /dev/null`
-  replaces the copied linter binary as the only edge making the build stage wait
-  for lint; dropping it would end fail-fast linting under a still-green build.
-  `golangci-lint config verify`, included per the ruling, validates from an
-  embedded schema with no network call, but `go mod download` above the gates
-  still needs the network on a cold cache. Verified: `make lint` green with no
-  `golangci-lint` on `PATH`; two back-to-back `script/lint` runs on an untouched
-  tree both ran the linter (27.7s and 28.7s in the lint step, `COPY . .`
-  `CACHED` above); a planted unused variable failed `script/lint`, and failed
-  `make docker` at `[lint 9/9]` with the build stage stopped at
-  `[builder 3/12]`; the drift guard fails on a tag-only, a digest-only and an
-  unreadable reference, naming both sides; under `--network none` config verify
-  passes a valid config and rejects an invalid one; `make docker` green in 5m35s
-  with all six gates run under one epoch (lint 37.6s, test 25.2s reporting
-  `ok sneak.berlin/go/sfdupes 1.938s coverage: 88.5%`, not `(cached)`); in the
-  builder image with the Go test cache off, `--user 0:0` still fails
-  `TestScanHardlinkRunFailsTogether` where the unprivileged user passes. Noted
-  for follow-up, not fixed here: `golangci-lint` warns that `gomodguard` is
-  deprecated since v2.12.0 in favour of `gomodguard_v2`.
+  owner ruling the linter is never installed on a host, and
+  `golangci-lint config verify` runs before `golangci-lint run`.
+  `script/bootstrap` stopped installing or pinning the linter, and
+  `script/verify-linter-pin` was retired. Since
+  https://git.eeqj.de/sneak/sfdupes/issues/95 both commands run in the
+  `Dockerfile`'s `lint` phase, which `script/lint` builds alone and the build
+  stage depends on through `COPY --from=lint /src/go.sum /dev/null`;
+  `Dockerfile.lint` and `script/verify-lint-image-pin` are gone. Nothing inside
+  an image build may run docker, so the phase calls `golangci-lint` directly.
 
 - install the Docker build stage's prerequisites by running `script/bootstrap`
   instead of `apk add --no-cache make` inline (2026-08-09, branch
-  `dockerfile-bootstrap`, closes https://git.eeqj.de/sneak/sfdupes/issues/42):
-  the stage copies `script/` plus `go.mod`/`go.sum` and runs `script/bootstrap`,
-  which ends in `go mod download`, so the separate call to it is gone.
-  `COPY --from=lint /usr/bin/golangci-lint` stays and moves above the bootstrap
-  layer: it is the only edge making this stage depend on the lint stage, so
-  deleting it would end fail-fast linting silently. A new
-  `script/verify-linter-pin`, run in the build stage before bootstrap, fails the
-  build naming both versions unless that copied binary is the version
-  `script/bootstrap` pins; a pin it cannot read is a hard failure, not a skip.
-  `$GOPATH/bin` joins `PATH`, where bootstrap's `go install` lands. Everything
-  added sits above `ARG CHECK_EPOCH`, and the `chown` and `USER builder` still
-  precede `make check`. Verified: the guard fails the build with both versions
-  named when the lint stage's linter is faked to another version, and passes an
-  unmodified build; bootstrap runs clean under Alpine's `sh` and `apk`, finding
-  the copied linter already at the pin; a second build served the bootstrap and
-  dependency layers `CACHED` while both gates ran with a fresh epoch; a planted
-  `unused` finding failed the build at the lint gate in 48.9s with the build
-  stage's `make check` never starting; and the suite run in the image as
-  `--user 0:0` fails `TestScanHardlinkRunFailsTogether`, so the drop to the
-  unprivileged user is still needed. That last check needs the Go test cache
-  off: as root it first reported `ok ... (cached)`, reusing the build-time
-  result. Build times on a noisy shared host: 2m13s on an unchanged tree, 2m17s
-  and 4m29s after a source change, 5m14s cold, which breaches the policy
-  ceiling; `chown -R builder:builder /src /home/builder` walks the module cache
-  and alone varied from 77s to 210s across those builds, and `main` measured
-  5m03s cold with a 209s `chown`. Filed as
-  https://git.eeqj.de/sneak/sfdupes/issues/43
+  `dockerfile-bootstrap`, closes https://git.eeqj.de/sneak/sfdupes/issues/42),
+  with `script/verify-linter-pin` failing the build unless the linter copied
+  from the lint stage was the version `script/bootstrap` pinned. Builds then
+  took up to 5m14s cold, mostly in a `chown -R` of the module cache, filed as
+  https://git.eeqj.de/sneak/sfdupes/issues/43. Since
+  https://git.eeqj.de/sneak/sfdupes/issues/95 the build stage installs `git` and
+  `make` with `apk add --no-cache` and only compiles; the `lint` and `test`
+  phases are the gates
 - bust the Docker layer cache for the gate steps, so `script/cibuild` and
   `script/docker` cannot report a green they did not earn (2026-08-09, branch
   `cibuild-cache-bust`, closes https://git.eeqj.de/sneak/sfdupes/issues/32): the
   `Dockerfile` copies the tree before its gates, so on an unchanged tree Docker
-  served them from cache and the build exited 0 having run nothing. Both scripts
-  now pass `--build-arg CHECK_EPOCH="$(date +%s)"`. `ARG` is per stage and the
-  gates span two stages, so it is declared in both; BuildKit hashes the expanded
-  command, so each gate `RUN` echoes the epoch, which also logs it as evidence
-  the layer ran. It sits below the dependency layers so they stay cached.
-  Verified under `BUILDKIT_PROGRESS=plain`, each script run twice back to back
-  on an unchanged tree: all three gates ran on all four runs with a fresh epoch
-  (`script/cibuild` 78.8s then 61.1s; `script/docker` 61.1s then 53.4s), and
-  thirteen steps were still served `CACHED`. With a planted `unused` finding the
-  build failed at `make lint` in 36.1s and the build-stage `make check` never
-  started. Run as root, the same image fails `TestScanHardlinkRunFailsTogether`,
-  because root reads through the `chmod(0)` the test relies on, so the build
-  stage must drop to the unprivileged `builder` user. Local fix only;
-  propagating it to the canonical templates is
-  https://git.eeqj.de/sneak/prompts/issues/26
+  served them from cache and the build exited 0 having run nothing. The fix was
+  a `CHECK_EPOCH` build argument; since
+  https://git.eeqj.de/sneak/sfdupes/issues/95 every `docker build` in `script/`
+  passes a new `CACHEBUST` value instead, which every stage of the `Dockerfile`
+  declares first. Run as root, the tests fail
+  `TestScanHardlinkRunFailsTogether`, because root reads through the `chmod(0)`
+  the test relies on, so the `test` phase runs them as `nobody`
 - check the installed golangci-lint version in `script/bootstrap` instead of
   only its presence (2026-08-09, branch `bootstrap-version-check`, closes
   https://git.eeqj.de/sneak/sfdupes/issues/24): the version lives only in
@@ -426,6 +421,3 @@ Accepted divergences (no action):
 
 - flat single-package layout with `.go` files in the repo root — fine for a
   small single-binary tool per the Go styleguide; the tracker audit agrees
-- `make test` runs without `-race` — the repo mandates `CGO_ENABLED=0` (pure-Go
-  builds) and the race detector requires cgo, so the detector runs in a separate
-  cgo-enabled container, `make test-race`, which is not part of `make check`

cancel_test.go

@@ -344,9 +344,10 @@ func storedPaths(t *testing.T, path string) []string {
 
 // TestRunScanInterrupted calls the scan entrypoint with a context that
 // is already cancelled, as when a signal arrives at once. It must return
-// errInterrupted promptly with its one line on stderr and nothing on
-// stdout, leave the database valid and as it was, and leave nothing in
-// the way of the next scan, which must bring the database up to date.
+// errInterrupted promptly, with its line on stderr after the one naming
+// the database and nothing on stdout, leave the database valid and as
+// it was, and leave nothing in the way of the next scan, which must
+// bring the database up to date.
 func TestRunScanInterrupted(t *testing.T) {
 	path := testDBPath(t)
 	t.Setenv(databaseEnv, path)
@@ -389,7 +390,8 @@ func TestRunScanInterrupted(t *testing.T) {
 			err, errInterrupted)
 	}
 
-	want := "scan: interrupted after 0 files\n"
+	want := "scan: database " + path + " (from " + databaseEnv + ")\n" +
+		"scan: interrupted after 0 files\n"
 	if got := stderr()[shown:]; got != want {
 		t.Errorf("stderr = %q, want %q", got, want)
 	}

db.go

@@ -11,6 +11,7 @@ import (
 	"path/filepath"
 	"slices"
 	"strconv"
+	"strings"
 	"time"
 
 	"golang.org/x/sys/unix"
@@ -91,13 +92,36 @@ var errSchemaVersion = errors.New("unsupported database schema version")
 var errScanRunning = errors.New("another scan is running")
 
 // databasePath resolves the database location: SFDUPES_DATABASE when
-// set and non-empty, the compiled-in default otherwise.
-func databasePath() string {
+// set and non-empty, the compiled-in default otherwise. It returns the
+// path, with the working directory, its symlinks resolved, put in front
+// of it when it is relative, and where the path came from, "default" or
+// "from SFDUPES_DATABASE", for the line each subcommand prints first on
+// stderr.
+func databasePath() (string, string, error) {
+	path, source := defaultDatabasePath, "default"
 	if p := os.Getenv(databaseEnv); p != "" {
-		return p
+		path, source = p, "from "+databaseEnv
 	}
 
-	return defaultDatabasePath
+	if filepath.IsAbs(path) {
+		return path, source, nil
+	}
+
+	// The working directory as the kernel reports it, with no symlink
+	// in it. os.Getwd may return PWD instead, which can name it through
+	// a symlink; a ".." after that symlink then leads somewhere else
+	// once the path is cleaned, as scan cleans it to create the
+	// database's directory.
+	wd, err := unix.Getwd()
+	if err != nil {
+		return "", "", fmt.Errorf("resolve database path %s: %w", path, err)
+	}
+
+	// Not filepath.Abs or filepath.Join: they clean the path, which
+	// drops each ".." together with the directory name before it. When
+	// that directory is a symlink, the cleaned path names another file.
+	// The working directory ends in "/" only when it is the root.
+	return strings.TrimSuffix(wd, "/") + "/" + path, source, nil
 }
 
 // scanParams are the connection parameters for scan: read-write, with
@@ -490,6 +514,18 @@ func loadDupeRows(ctx context.Context, db *sql.DB,
 	return records, nil
 }
 
+// countRecords returns the number of records in the database.
+func countRecords(ctx context.Context, db *sql.DB) (int64, error) {
+	var n int64
+
+	err := db.QueryRowContext(ctx, "SELECT COUNT(*) FROM files").Scan(&n)
+	if err != nil {
+		return 0, fmt.Errorf("count records: %w", err)
+	}
+
+	return n, nil
+}
+
 // loadFileMeta streams every record's path, size, mtime, and whether
 // it carries hashes to fn. Scan change detection needs no hash
 // values, and skipping the hash columns keeps the scan's in-memory
@@ -528,26 +564,46 @@ func loadFileMeta(ctx context.Context, db *sql.DB,
 	return nil
 }
 
-// contentCandidatesSQL selects every record of at least headTailMin
-// bytes whose size, head, and tail equal another record's, in each
-// group (the records sharing a size, head, and tail) where at least one
-// record has no content hash, with whether each record has one. SQLite
-// does the grouping, so no other record's hashes are loaded into
-// memory; the rows come ordered by size, head, and tail, so each
-// group's rows arrive together.
+// contentGroupsSQL selects each group (the records sharing a size,
+// head, and tail) of records of at least headTailMin bytes that has more
+// than one record and at least one record without a content hash, with
+// the number of its records.
+const contentGroupsSQL = `
+SELECT size, head, tail, COUNT(*) AS records
+FROM files
+WHERE size >= ? AND head <> ''
+GROUP BY size, head, tail
+HAVING COUNT(*) > 1 AND SUM(content = '') > 0
+`
+
+// contentCandidatesSQL selects every record of the groups
+// contentGroupsSQL selects, with whether each record has a content
+// hash. SQLite does the grouping, so no other record's hashes are
+// loaded into memory; the rows come ordered by size, head, and tail, so
+// each group's rows arrive together.
 const contentCandidatesSQL = `
 SELECT f.path, f.size, f.mtime, f.mtime_nsec, f.head, f.tail, f.content <> ''
 FROM files AS f
-JOIN (
-    SELECT size, head, tail
-    FROM files
-    WHERE size >= ? AND head <> ''
-    GROUP BY size, head, tail
-    HAVING COUNT(*) > 1 AND SUM(content = '') > 0
-) AS g USING (size, head, tail)
+JOIN (` + contentGroupsSQL + `) AS g USING (size, head, tail)
 ORDER BY size, head, tail
 `
 
+// countContentCandidates returns the number of rows of
+// contentCandidatesSQL, adding up the records of the groups
+// contentGroupsSQL selects, so it neither joins nor sorts.
+func countContentCandidates(ctx context.Context, db *sql.DB) (int64, error) {
+	var n int64
+
+	err := db.QueryRowContext(ctx,
+		"SELECT COALESCE(SUM(records), 0) FROM ("+contentGroupsSQL+")",
+		headTailMin).Scan(&n)
+	if err != nil {
+		return 0, fmt.Errorf("count content candidates: %w", err)
+	}
+
+	return n, nil
+}
+
 // loadContentCandidates streams the rows of contentCandidatesSQL to fn:
 // each record, without its content hash, and whether it has one.
 func loadContentCandidates(ctx context.Context, db *sql.DB,

db_test.go

@@ -43,16 +43,47 @@ func openTestDB(t *testing.T) *sql.DB {
 }
 
 func TestDatabasePath(t *testing.T) {
-	t.Setenv(databaseEnv, "")
-
-	if got := databasePath(); got != defaultDatabasePath {
-		t.Errorf("databasePath() = %q, want %q", got, defaultDatabasePath)
+	// README §Database: SFDUPES_DATABASE when set and non-empty, the
+	// default otherwise, with the working directory, its symlinks
+	// resolved, put in front of a relative path. Nothing is cleaned, so
+	// a ".." stays.
+	dir, err := filepath.EvalSymlinks(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
 	}
 
-	t.Setenv(databaseEnv, "/custom/place.sqlite")
+	t.Chdir(dir)
 
-	if got := databasePath(); got != "/custom/place.sqlite" {
-		t.Errorf("databasePath() = %q, want the env override", got)
+	fromEnv := "from " + databaseEnv
+	cases := []struct {
+		env, path, source string
+	}{
+		{"", defaultDatabasePath, "default"},
+		{"/custom/place.sqlite", "/custom/place.sqlite", fromEnv},
+		{"/custom/link/../place.sqlite", "/custom/link/../place.sqlite",
+			fromEnv},
+		{"sub/place.sqlite", dir + "/sub/place.sqlite", fromEnv},
+		{"link/../place.sqlite", dir + "/link/../place.sqlite", fromEnv},
+	}
+
+	for _, tc := range cases {
+		t.Setenv(databaseEnv, tc.env)
+
+		path, source, err := databasePath()
+		if err != nil || path != tc.path || source != tc.source {
+			t.Errorf("databasePath() with %s=%q = %q, %q, %v; want %q, %q",
+				databaseEnv, tc.env, path, source, err, tc.path, tc.source)
+		}
+	}
+
+	// In the root directory the path gets one slash in front, not two.
+	t.Chdir("/")
+	t.Setenv(databaseEnv, "place.sqlite")
+
+	path, _, err := databasePath()
+	if err != nil || path != "/place.sqlite" {
+		t.Errorf("databasePath() in / = %q, %v; want %q",
+			path, err, "/place.sqlite")
 	}
 }
 
@@ -278,8 +309,10 @@ func TestApplyChangesRoundTrip(t *testing.T) {
 		},
 	}
 
-	err := applyChanges(t.Context(), db, recs, nil,
-		newProgress("update", 2))
+	prog := newProgress(progressParams{label: "update", total: 4})
+	defer prog.finish()
+
+	err := applyChanges(t.Context(), db, recs, nil, prog)
 	if err != nil {
 		t.Fatalf("applyChanges: %v", err)
 	}
@@ -298,7 +331,7 @@ func TestApplyChangesRoundTrip(t *testing.T) {
 	}
 
 	err = applyChanges(t.Context(), db, []scanRec{upd},
-		[]string{"/a/tab\tnew\nline"}, newProgress("update", 2))
+		[]string{"/a/tab\tnew\nline"}, prog)
 	if err != nil {
 		t.Fatalf("applyChanges: %v", err)
 	}
@@ -326,8 +359,10 @@ func TestApplyChangesBatching(t *testing.T) {
 		})
 	}
 
-	err := applyChanges(t.Context(), db, recs, nil,
-		newProgress("update", int64(n)))
+	prog := newProgress(progressParams{label: "update", total: int64(2 * n)})
+	defer prog.finish()
+
+	err := applyChanges(t.Context(), db, recs, nil, prog)
 	if err != nil {
 		t.Fatalf("applyChanges: %v", err)
 	}
@@ -341,8 +376,7 @@ func TestApplyChangesBatching(t *testing.T) {
 		deletes = append(deletes, r.path)
 	}
 
-	err = applyChanges(t.Context(), db, nil, deletes,
-		newProgress("update", int64(n)))
+	err = applyChanges(t.Context(), db, nil, deletes, prog)
 	if err != nil {
 		t.Fatalf("applyChanges deletes: %v", err)
 	}
@@ -351,3 +385,62 @@ func TestApplyChangesBatching(t *testing.T) {
 		t.Fatalf("records = %d, want 0", len(got))
 	}
 }
+
+// TestCountContentCandidates checks that countContentCandidates counts
+// the records the content phase's search returns: those of each group
+// of two or more records of headTailMin or more with a head, where at
+// least one has no content hash.
+func TestCountContentCandidates(t *testing.T) {
+	t.Parallel()
+
+	db := openTestDB(t)
+
+	// Each group's records: size, head, and content, one per record.
+	groups := []struct {
+		size     int64
+		head     string
+		contents []string
+	}{
+		{headTailMin, "h", []string{"", "c", "c"}}, // returned
+		{headTailMin + 1, "h", []string{"", ""}},   // returned
+		{headTailMin + 2, "h", []string{"c", "c"}}, // all hashed
+		{headTailMin + 3, "h", []string{""}},       // one record
+		{headTailMin - 1, "h", []string{"", ""}},   // too small
+		{headTailMin + 4, "", []string{"", ""}},    // no head
+	}
+
+	var recs []scanRec
+
+	for _, g := range groups {
+		for _, content := range g.contents {
+			recs = append(recs, scanRec{
+				size: g.size, mtime: time.Unix(1, 0), head: g.head,
+				tail: "t", content: content,
+				path: fmt.Sprintf("/r/%d", len(recs)),
+			})
+		}
+	}
+
+	err := applyChanges(t.Context(), db, recs, nil, nil)
+	if err != nil {
+		t.Fatalf("applyChanges: %v", err)
+	}
+
+	got, err := countContentCandidates(t.Context(), db)
+	if err != nil {
+		t.Fatalf("countContentCandidates: %v", err)
+	}
+
+	var returned int64
+
+	err = loadContentCandidates(t.Context(), db,
+		func(scanRec, bool) { returned++ })
+	if err != nil {
+		t.Fatalf("loadContentCandidates: %v", err)
+	}
+
+	if got != 5 || returned != 5 {
+		t.Errorf("count = %d, records returned = %d, want 5 and 5",
+			got, returned)
+	}
+}

main_test.go

@@ -285,22 +285,29 @@ func assertFatalOutput(t *testing.T, stderr, stdout string) {
 
 func TestRunMissingDatabaseIsFatal(t *testing.T) {
 	// README §Database: report and trees need an existing database; a
-	// missing one exits 1 with a message telling the user to run scan.
+	// missing one exits 1 with a message telling the user to run scan,
+	// after the line naming the database.
 	for _, name := range []string{cmdReport, cmdTrees} {
 		t.Run(name, func(t *testing.T) {
 			path := testDBPath(t)
 			t.Setenv(databaseEnv, path)
 
-			var stdout, stderr bytes.Buffer
+			var stdout bytes.Buffer
 
-			code := run([]string{name}, &stdout, &stderr)
+			// run gets os.Stderr, where the subcommand prints its line,
+			// so the capture shows the two in the order printed.
+			stderr := captureStderr(t)
+
+			code := run([]string{name}, &stdout, os.Stderr)
 			if code != exitFatal {
 				t.Errorf("run(%s) = %d, want %d", name, code, exitFatal)
 			}
 
-			want := "sfdupes: " + path + ": no database (run \"sfdupes " +
+			want := name + ": database " + path + " (from " + databaseEnv +
+				")\n" +
+				"sfdupes: " + path + ": no database (run \"sfdupes " +
 				"scan\" first, or set " + databaseEnv + ")\n"
-			if got := stderr.String(); got != want {
+			if got := stderr(); got != want {
 				t.Errorf("stderr = %q, want %q", got, want)
 			}
 
@@ -311,6 +318,246 @@ func TestRunMissingDatabaseIsFatal(t *testing.T) {
 	}
 }
 
+func TestRunNamesRelativeDatabase(t *testing.T) {
+	// README §Database: each subcommand's first line on stderr names the
+	// database, a relative SFDUPES_DATABASE made absolute against the
+	// working directory. scan calls it new until a scan has created it.
+	path := testDBPath(t)
+	t.Chdir(filepath.Dir(path))
+	t.Setenv(databaseEnv, filepath.Base(path))
+
+	dir := t.TempDir()
+	from := " (from " + databaseEnv + ")\n"
+
+	want := "scan: new database " + path + from
+	if got := scanOK(t, dir); !strings.HasPrefix(got, want) {
+		t.Errorf("first scan stderr = %q, want it to start %q", got, want)
+	}
+
+	want = "scan: database " + path + from
+	if got := scanOK(t, dir); !strings.HasPrefix(got, want) {
+		t.Errorf("second scan stderr = %q, want it to start %q", got, want)
+	}
+
+	for _, name := range []string{cmdReport, cmdTrees} {
+		stderr := captureStderr(t)
+
+		code := run([]string{name}, io.Discard, os.Stderr)
+
+		want = name + ": database " + path + from
+		if got := stderr(); code != exitOK || !strings.HasPrefix(got, want) {
+			t.Errorf("run(%s) = %d with stderr %q, want %d and it to "+
+				"start %q", name, code, got, exitOK, want)
+		}
+	}
+}
+
+func TestRunUsesDatabaseThroughSymlinkedDirectory(t *testing.T) {
+	// README §Database: the path names the file exactly. With link a
+	// symlink to the directory real/sub, link/../db.sqlite names
+	// real/db.sqlite, not db.sqlite beside link. Every subcommand must
+	// use that file, relative or absolute, and its first line must name
+	// the path as set, with the working directory put in front of a
+	// relative one.
+	dir, err := filepath.EvalSymlinks(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	t.Chdir(dir)
+
+	err = os.MkdirAll(filepath.Join(dir, "real", "sub"), 0o750)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	err = os.Symlink(filepath.Join(dir, "real", "sub"),
+		filepath.Join(dir, "link"))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	named := dir + "/link/../db.sqlite"
+	from := " (from " + databaseEnv + ")\n"
+	tree := t.TempDir()
+
+	t.Setenv(databaseEnv, "link/../db.sqlite")
+
+	want := "scan: new database " + named + from
+	if got := scanOK(t, tree); !strings.HasPrefix(got, want) {
+		t.Errorf("relative scan stderr = %q, want it to start %q", got, want)
+	}
+
+	// The absolute path names the database the relative one created.
+	t.Setenv(databaseEnv, named)
+
+	want = "scan: database " + named + from
+	if got := scanOK(t, tree); !strings.HasPrefix(got, want) {
+		t.Errorf("absolute scan stderr = %q, want it to start %q", got, want)
+	}
+
+	for _, name := range []string{cmdReport, cmdTrees} {
+		stderr := captureStderr(t)
+
+		code := run([]string{name}, io.Discard, os.Stderr)
+
+		want = name + ": database " + named + from
+		if got := stderr(); code != exitOK || !strings.HasPrefix(got, want) {
+			t.Errorf("run(%s) = %d with stderr %q, want %d and it to "+
+				"start %q", name, code, got, exitOK, want)
+		}
+	}
+
+	_, err = os.Stat(filepath.Join(dir, "real", "db.sqlite"))
+	if err != nil {
+		t.Errorf("database the path names: %v", err)
+	}
+
+	// With no file at the cleaned path, report and trees succeeded on
+	// the database in real.
+	_, err = os.Stat(filepath.Join(dir, "db.sqlite"))
+	if !errors.Is(err, fs.ErrNotExist) {
+		t.Errorf("database at the cleaned path: stat error %v, want it "+
+			"missing", err)
+	}
+}
+
+func TestRunScanFromSymlinkedWorkingDirectory(t *testing.T) {
+	// README §Database: a relative path gets the working directory, its
+	// symlinks resolved, put in front of it. With home/proj a symlink
+	// to data/proj, entered as the working directory through the
+	// symlink, ../new/db.sqlite names data/new/db.sqlite. scan must
+	// create that directory and file, and nothing beside home/proj.
+	dir, err := filepath.EvalSymlinks(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	err = os.MkdirAll(filepath.Join(dir, "data", "proj"), 0o750)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	err = os.Mkdir(filepath.Join(dir, "home"), 0o750)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	err = os.Symlink(filepath.Join(dir, "data", "proj"),
+		filepath.Join(dir, "home", "proj"))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// t.Chdir also sets PWD to the path through the symlink, as a
+	// shell does after cd.
+	t.Chdir(filepath.Join(dir, "home", "proj"))
+	t.Setenv(databaseEnv, "../new/db.sqlite")
+
+	want := "scan: new database " + dir + "/data/proj/../new/db.sqlite" +
+		" (from " + databaseEnv + ")\n"
+	if got := scanOK(t, t.TempDir()); !strings.HasPrefix(got, want) {
+		t.Errorf("scan stderr = %q, want it to start %q", got, want)
+	}
+
+	_, err = os.Stat(filepath.Join(dir, "data", "new", "db.sqlite"))
+	if err != nil {
+		t.Errorf("database the path names: %v", err)
+	}
+
+	_, err = os.Lstat(filepath.Join(dir, "home", "new"))
+	if !errors.Is(err, fs.ErrNotExist) {
+		t.Errorf("home/new: stat error %v, want it missing", err)
+	}
+}
+
+func TestRunEscapesDatabasePath(t *testing.T) {
+	// README §Database: each subcommand's first line escapes the
+	// database path like the paths in a report, so a tab, newline or
+	// backslash in it keeps the line one line.
+	dir := t.TempDir()
+	t.Setenv(databaseEnv, dir+"/a\tb\nc\\d.sqlite")
+
+	escaped := dir + `/a\tb\nc\\d.sqlite`
+	from := " (from " + databaseEnv + ")\n"
+
+	want := "scan: new database " + escaped + from
+	if got := scanOK(t, t.TempDir()); !strings.HasPrefix(got, want) {
+		t.Errorf("scan stderr = %q, want it to start %q", got, want)
+	}
+
+	for _, name := range []string{cmdReport, cmdTrees} {
+		stderr := captureStderr(t)
+
+		code := run([]string{name}, io.Discard, os.Stderr)
+
+		want = name + ": database " + escaped + from
+		if got := stderr(); code != exitOK || !strings.HasPrefix(got, want) {
+			t.Errorf("run(%s) = %d with stderr %q, want %d and it to "+
+				"start %q", name, code, got, exitOK, want)
+		}
+	}
+}
+
+func TestRunNamesDefaultDatabase(t *testing.T) {
+	// README §Database: with SFDUPES_DATABASE empty, each subcommand's
+	// first line on stderr names the default database. A database may
+	// exist at the default path on the machine running the test, so
+	// nothing here may create or read one: scan gets an operand that
+	// does not exist, which stops it before it takes the lock, and
+	// report and trees a cancelled context, which stops them before
+	// they read anything.
+	t.Setenv(databaseEnv, "")
+
+	// Whether scan calls the database new depends on that machine too.
+	scanWant := "scan: database " + defaultDatabasePath + " (default)\n"
+
+	_, err := os.Stat(defaultDatabasePath)
+	if errors.Is(err, fs.ErrNotExist) {
+		scanWant = "scan: new database " + defaultDatabasePath +
+			" (default)\n"
+	}
+
+	missing := filepath.Join(t.TempDir(), "nope")
+
+	cases := map[string]struct {
+		run  func() error
+		want string
+	}{
+		cmdScan: {
+			run: func() error {
+				return runScan(t.Context(), []string{missing}, 1, false)
+			},
+			want: scanWant,
+		},
+		cmdReport: {
+			run: func() error {
+				return runReport(cancelledContext(t), io.Discard)
+			},
+			want: "report: database " + defaultDatabasePath + " (default)\n",
+		},
+		cmdTrees: {
+			run: func() error {
+				return runTrees(cancelledContext(t), io.Discard)
+			},
+			want: "trees: database " + defaultDatabasePath + " (default)\n",
+		},
+	}
+
+	for name, tc := range cases {
+		stderr := captureStderr(t)
+
+		err = tc.run()
+		if err == nil {
+			t.Errorf("%s: error = nil, want it stopped", name)
+		}
+
+		if got := stderr(); got != tc.want {
+			t.Errorf("%s stderr = %q, want %q", name, got, tc.want)
+		}
+	}
+}
+
 func TestRunUsageErrors(t *testing.T) {
 	// Usage errors keep exiting 2 with cobra's own report on stderr.
 	cases := map[string]struct {
@@ -661,7 +908,8 @@ func TestRunReportSucceeds(t *testing.T) {
 		t.Errorf("stdout = %q, want %q", got, want)
 	}
 
-	want = "report: 2 records read, 1 duplicate groups, 1 dupe files, " +
+	want = "report: database " + path + " (from " + databaseEnv + ")\n" +
+		"report: 2 records read, 1 duplicate groups, 1 dupe files, " +
 		"300 B reclaimable\n"
 	if got := stderr(); got != want {
 		t.Errorf("stderr = %q, want %q", got, want)
@@ -694,7 +942,8 @@ func TestRunTreesSucceeds(t *testing.T) {
 		t.Errorf("stdout = %q, want %q", got, want)
 	}
 
-	want = "trees: 2 records read, 1 duplicate tree groups, 1 dupe trees, " +
+	want = "trees: database " + path + " (from " + databaseEnv + ")\n" +
+		"trees: 2 records read, 1 duplicate tree groups, 1 dupe trees, " +
 		"300 B reclaimable\n"
 	if got := stderr(); got != want {
 		t.Errorf("stderr = %q, want %q", got, want)

progress.go

@@ -2,122 +2,272 @@ package main
 
 import (
 	"fmt"
+	"math"
 	"os"
+	"slices"
+	"strings"
+	"sync"
 	"time"
 
 	"github.com/schollz/progressbar/v3"
 	"golang.org/x/term"
 )
 
-// plainInterval is the minimum time between progress lines when stderr
-// is not a TTY.
+// plainInterval is the time between progress lines while a phase runs,
+// when stderr is not a TTY.
 const plainInterval = 5 * time.Second
 
-// barThrottle caps how often the TTY progress bar redraws.
-const barThrottle = 100 * time.Millisecond
+// redrawInterval is the time between redraws of the progress display on
+// a TTY.
+const redrawInterval = 100 * time.Millisecond
 
-// walkSpinnerType selects the progressbar library's spinner style used
-// for the walk pass, which has no known total.
-const walkSpinnerType = 14
+// spinnerType selects the progressbar library's spinner style.
+const spinnerType = 14
+
+// barWidth is the width of the progressbar library's bar between its
+// two ends, as in the example line in README "Progress".
+const barWidth = 10
 
 // percentScale converts a fraction to a percentage.
 const percentScale = 100
 
+// fallbackWidth is the width taken for a terminal whose width cannot be
+// read, as the progressbar library takes it.
+const fallbackWidth = 80
+
+// spinnerMargin is the columns of a spinner's line besides its text:
+// the spinner and the three spaces the library draws around the text,
+// and the terminal's last column, which every line stays clear of so
+// that no terminal wraps it.
+const spinnerMargin = 5
+
+// barMargin is the columns of a bar's line besides its text: the
+// percent and the bar the library draws after the text, the spaces
+// around them, and the terminal's last column.
+const barMargin = barWidth + 11
+
 // stderrIsTTY reports whether stderr is attached to a terminal.
 func stderrIsTTY() bool {
 	return term.IsTerminal(int(os.Stderr.Fd()))
 }
 
-// progress renders one scan pass's progress on stderr. On a TTY it
-// delegates to the progressbar library (spinner style when the total is
-// unknown, full bar with count/percent/rate/elapsed/ETA otherwise). When
-// stderr is not a TTY it emits no ANSI redraws: it prints a plain
-// one-line update as the pass starts, then no more often than every
-// plainInterval.
-//
-// All methods must be called from the main goroutine only. On a TTY
-// the library also redraws a spinner from its own goroutine, several
-// times a second, so its count and elapsed time stay current while a
-// pass waits for its next item. A nil *progress is a valid
-// no-display receiver: every method is a no-op, so batched database
-// flushes during the streaming pass can reuse the update-pass helpers
-// without rendering anything.
-type progress struct {
-	label string
-	total int64 // -1 when unknown (walk pass)
-	bar   *progressbar.ProgressBar
-	count int64
-	start time.Time
-	last  time.Time
-}
-
-func newProgress(label string, total int64) *progress {
-	p := &progress{label: label, total: total, start: time.Now()}
-	if stderrIsTTY() {
-		p.bar = newBar(label, total)
-
-		return p
+// terminalWidth returns the width of the terminal on stderr, or
+// fallbackWidth, as the progressbar library does, when it cannot read
+// one.
+func terminalWidth() int {
+	width, _, err := term.GetSize(int(os.Stderr.Fd()))
+	if err != nil || width <= 0 {
+		return fallbackWidth
 	}
 
-	// Print the zero state at once: the first item may take minutes,
-	// and a pass must never look hung.
-	p.last = p.start
-	fmt.Fprintln(os.Stderr, p.plainLine())
+	return width
+}
+
+// phaseLabel names phase with its place among phases, as "[2/5] walk".
+func phaseLabel(phases []string, phase string) string {
+	return fmt.Sprintf("[%d/%d] %s",
+		slices.Index(phases, phase)+1, len(phases), phase)
+}
+
+// progressParams describe one phase's progress display as it starts.
+type progressParams struct {
+	label      string // the phase and its place, from phaseLabel
+	total      int64  // the items the phase will complete; -1 when not known
+	estimate   bool   // total is an estimate, which the count may pass
+	waitingFor string // what the phase waits for until setTotal is called
+}
+
+// progress renders one phase's progress on stderr. On a TTY the
+// progressbar library draws line, fitted to the terminal's width: after
+// the library's spinner, or, for a phase with an exact total, before the
+// library's bar when the terminal has room for the bar beside it. It is
+// drawn again every redrawInterval, so its elapsed time keeps moving
+// while the phase waits for its next item. When stderr is not a TTY it
+// emits no ANSI redraws: it prints line as the phase starts, every
+// plainInterval while it runs, and as it ends.
+//
+// The draws come from a goroutine of their own, so mu guards the fields
+// below it. Every method must be called from the main goroutine. A nil
+// *progress is a valid no-display receiver: every method is a no-op, so
+// batched database flushes during the hash phase can reuse the update
+// phase's helpers without rendering anything.
+type progress struct {
+	width func() int    // reads the terminal's width; nil when not a TTY
+	stop  chan struct{} // closed by finish to end the draws
+	done  chan struct{} // closed once the draws have ended
+
+	mu         sync.Mutex
+	bar        *progressbar.ProgressBar // what the library draws; nil until then
+	withBar    bool                     // bar is the library's bar, not its spinner
+	widest     int                      // the widest line bar has drawn, in columns
+	label      string
+	total      int64
+	estimate   bool
+	waitingFor string
+	count      int64
+	start      time.Time // when the phase started, for the elapsed time
+	rateStart  time.Time // when the count started, for the rate
+}
+
+// newProgress starts the display of one phase on stderr.
+func newProgress(params progressParams) *progress {
+	if stderrIsTTY() {
+		return startProgress(params, terminalWidth, redrawInterval)
+	}
+
+	return startProgress(params, nil, plainInterval)
+}
+
+// startProgress shows the phase params describes at once, and again
+// every interval until finish: with the progressbar library on a
+// terminal, whose width each draw reads by calling width, or as a plain
+// line when width is nil.
+func startProgress(params progressParams, width func() int,
+	interval time.Duration,
+) *progress {
+	now := time.Now()
+	p := &progress{
+		width: width, stop: make(chan struct{}), done: make(chan struct{}),
+		label: params.label, total: params.total, estimate: params.estimate,
+		waitingFor: params.waitingFor, start: now, rateStart: now,
+	}
+
+	// Show the zero state at once: the first item may take minutes,
+	// and a phase must never look hung.
+	p.draw()
+
+	go func() {
+		defer close(p.done)
+
+		ticker := time.NewTicker(interval)
+		defer ticker.Stop()
+
+		for {
+			select {
+			case <-p.stop:
+				return
+			case <-ticker.C:
+				p.draw()
+			}
+		}
+	}()
 
 	return p
 }
 
-// newBar builds the TTY display for newProgress.
-func newBar(label string, total int64) *progressbar.ProgressBar {
-	opts := []progressbar.Option{
-		progressbar.OptionSetWriter(os.Stderr),
-		progressbar.OptionSetDescription(label),
-		progressbar.OptionShowCount(),
-		progressbar.OptionShowIts(),
-		progressbar.OptionSetItsString("files"),
-		progressbar.OptionSetElapsedTime(true),
-		progressbar.OptionThrottle(barThrottle),
-		// Render at zero immediately: a phase must be visible the
-		// moment it starts, even before its first item completes.
-		progressbar.OptionSetRenderBlankState(true),
-	}
-	if total >= 0 {
-		opts = append(opts,
-			progressbar.OptionSetPredictTime(true),
-			progressbar.OptionShowElapsedTimeOnFinish(),
-		)
-	} else {
-		opts = append(opts,
-			progressbar.OptionSetPredictTime(false),
-			progressbar.OptionSpinnerType(walkSpinnerType),
-		)
+// draw shows the phase's progress: on a TTY in place of the line
+// before, and otherwise as a plain line.
+func (p *progress) draw() {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+
+	if p.width == nil {
+		text, _ := p.line(math.MaxInt, true)
+		fmt.Fprintln(os.Stderr, text)
+
+		return
 	}
 
-	return progressbar.NewOptions64(total, opts...)
+	width := p.width()
+
+	// A phase with an exact total gets the library's bar when its line,
+	// without the percent the bar shows, fits whole beside the bar. A
+	// total of 0 leaves the bar nothing to fill.
+	text, withBar := "", false
+	if p.total > 0 && !p.estimate {
+		text, withBar = p.line(width-barMargin, false)
+	}
+
+	margin := barMargin
+	if !withBar {
+		margin = spinnerMargin
+		text, _ = p.line(width-margin, true)
+	}
+
+	// The library makes a bar or a spinner, and before each draw erases
+	// its line with as many spaces as the widest line it has drawn. A
+	// display gets a new one when it turns from one to the other, as its
+	// line grows or the terminal is resized, and when the terminal has
+	// been made too narrow for that erase, which would wrap and leave a
+	// line behind at every draw.
+	if p.bar == nil || p.withBar != withBar || p.widest >= width {
+		p.newBar(withBar, width)
+	}
+
+	if withBar {
+		_ = p.bar.Set64(p.count)
+	}
+
+	p.bar.Describe(text)
+
+	// The library drew the text and its margin, less the terminal's last
+	// column, which the margin keeps clear.
+	p.widest = max(p.widest, len(text)+margin-1)
 }
 
-// increment records one completed item and refreshes the display.
+// newBar has the library make what draw draws: a bar for the phase's
+// total when withBar is set, and a spinner when not. Either shows the
+// text draw gives it, and nothing of its own besides the spinner, or
+// the bar and its percent. p.mu must be held.
+func (p *progress) newBar(withBar bool, width int) {
+	if p.bar != nil {
+		// Erase what was drawn before, short of the last column of a
+		// terminal that may have been made narrower since: the library's
+		// own erase is as wide as the widest line it drew.
+		blank := strings.Repeat(" ", min(p.widest, width-1))
+		fmt.Fprint(os.Stderr, "\r"+blank+"\r")
+	}
+
+	total := int64(-1) // the library's spinner
+	if withBar {
+		total = p.total
+	}
+
+	p.bar = progressbar.NewOptions64(total,
+		progressbar.OptionSetWriter(os.Stderr),
+		progressbar.OptionSetWidth(barWidth),
+		progressbar.OptionSpinnerType(spinnerType),
+		// The spinner turns at each draw, not on a timer of the
+		// library's own.
+		progressbar.OptionSetSpinnerChangeInterval(0),
+		// The text carries the elapsed time and the ETA.
+		progressbar.OptionSetElapsedTime(false),
+		progressbar.OptionSetPredictTime(false),
+	)
+	p.withBar, p.widest = withBar, 0
+}
+
+// setTotal gives a phase that started without a total its total, once
+// it is known. The rate, and so the ETA, count from then on: the time
+// spent waiting for the total says nothing about how fast items go.
+func (p *progress) setTotal(total int64) {
+	if p == nil {
+		return
+	}
+
+	p.mu.Lock()
+	defer p.mu.Unlock()
+
+	p.total = total
+	p.rateStart = time.Now()
+}
+
+// increment records one completed item, which the display shows at its
+// next draw.
 func (p *progress) increment() {
 	if p == nil {
 		return
 	}
 
+	p.mu.Lock()
+	defer p.mu.Unlock()
+
 	p.count++
-	if p.bar != nil {
-		_ = p.bar.Add(1)
-
-		return
-	}
-
-	if time.Since(p.last) >= plainInterval {
-		p.last = time.Now()
-		fmt.Fprintln(os.Stderr, p.plainLine())
-	}
 }
 
-// warnf prints a one-line warning to stderr without corrupting the bar.
-// The whole message is escaped like a report's path columns, so a path
-// holding a newline cannot split the warning.
+// warnf prints a one-line warning to stderr without corrupting the
+// display. The whole message is escaped like a report's path columns,
+// so a path holding a newline cannot split the warning.
 func (p *progress) warnf(format string, args ...any) {
 	if p == nil {
 		return
@@ -125,58 +275,101 @@ func (p *progress) warnf(format string, args ...any) {
 
 	msg := escapePath(fmt.Sprintf(format, args...))
 
-	if p.bar != nil && p.total < 0 {
-		// The library also redraws a spinner from its own goroutine, so
-		// a direct write could land inside a redraw. The bar prints the
-		// warning itself, just before its next redraw.
-		_, _ = progressbar.Bprintln(p.bar, msg)
-
-		return
-	}
+	p.mu.Lock()
+	defer p.mu.Unlock()
 
 	if p.bar != nil {
+		// The warning takes the display's line; the next draw shows
+		// the display again, on the line below.
 		_ = p.bar.Clear()
 	}
 
 	fmt.Fprintln(os.Stderr, msg)
-
-	// The library never draws a finished bar again, so the warning for
-	// a pass's last item would erase it for good: draw its last frame
-	// again below the warning.
-	if p.bar != nil && p.bar.IsFinished() {
-		fmt.Fprint(os.Stderr, p.bar.String())
-	}
 }
 
-// finish terminates the pass's display. A bar whose pass stopped short
-// of its total, as an interrupted one does, is left as last drawn; the
-// library's Finish would fill it up.
+// finish ends the phase's display, drawn once more as the phase ends.
+// A phase stopped short of its total, as an interrupted one is, shows
+// the count it stopped at rather than a full bar.
 func (p *progress) finish() {
 	if p == nil {
 		return
 	}
 
-	if p.bar != nil {
-		if p.total >= 0 && p.count < p.total {
-			_ = p.bar.Exit()
-		} else {
-			_ = p.bar.Finish()
-		}
+	close(p.stop)
+	<-p.done
 
+	p.draw()
+
+	if p.width != nil {
+		// The display stays on the TTY as drawn; what follows starts
+		// on a line of its own.
 		fmt.Fprintln(os.Stderr)
-
-		return
 	}
-
-	fmt.Fprintln(os.Stderr, p.plainLine())
 }
 
-// plainLine formats a non-TTY progress line.
-func (p *progress) plainLine() string {
-	elapsed := time.Since(p.start)
+// line formats the phase's progress in at most room columns, as
+//
+//	[3/5] hash: [1234/5000] 25%, 300 files/s, elapsed 4s, eta 13s
+//
+// without the percent when percent is false, as before the library's
+// bar, which shows its own. A phase with no total shows the items done
+// instead, or what it waits for.
+//
+// The phase and its place, the progress, the elapsed time and the ETA
+// are kept whole. A line wider than room leaves out the rate, or what
+// the phase waits for; only if it is still wider is it cut at room, and
+// line reports that it does not fit. Every part is ASCII, so its length
+// is its width in columns. p.mu must be held.
+func (p *progress) line(room int, percent bool) (string, bool) {
+	elapsed := time.Since(p.start).Round(time.Second)
+
+	// head and tail hold the parts kept whole; extra, between them, is
+	// the part left out.
+	var head, extra, tail string
+
+	if p.total < 0 && p.waitingFor != "" {
+		head, extra = p.label+": ", p.waitingFor
+		tail = fmt.Sprintf("elapsed %s, eta unknown", elapsed)
+	} else {
+		rate := 0.0
+		if s := time.Since(p.rateStart).Seconds(); s > 0 {
+			rate = float64(p.count) / s
+		}
+
+		head = p.label + ": " + p.itemsDone(percent) + ", "
+		extra = fmt.Sprintf("%.0f files/s", rate)
+		tail = fmt.Sprintf("elapsed %s, eta %s", elapsed, p.eta(rate))
+	}
+
+	full, kept := head+extra+", "+tail, head+tail
+
+	switch {
+	case len(full) <= room:
+		return full, true
+	case len(kept) <= room:
+		return kept, true
+	}
+
+	return kept[:max(room, 0)], false
+}
+
+// itemsDone formats the items done, as "[1234/5000] 25%", with "~"
+// before a total that is an estimate and without the percent when
+// percent is false, or as "1234 files" when the phase has no total.
+// p.mu must be held.
+func (p *progress) itemsDone(percent bool) string {
 	if p.total < 0 {
-		return fmt.Sprintf("%s: %d files, elapsed %s",
-			p.label, p.count, elapsed.Round(time.Second))
+		return fmt.Sprintf("%d files", p.count)
+	}
+
+	approx := ""
+	if p.estimate {
+		approx = "~"
+	}
+
+	done := fmt.Sprintf("[%d/%s%d]", p.count, approx, p.total)
+	if !percent {
+		return done
 	}
 
 	pct := float64(percentScale)
@@ -184,19 +377,24 @@ func (p *progress) plainLine() string {
 		pct = percentScale * float64(p.count) / float64(p.total)
 	}
 
-	rate := 0.0
-	if s := elapsed.Seconds(); s > 0 {
-		rate = float64(p.count) / s
+	return fmt.Sprintf("%s %.0f%%", done, pct)
+}
+
+// eta returns the time the phase has left at rate items a second, or
+// "unknown": with no total, before the first item, and once the count
+// passes an estimate. p.mu must be held.
+func (p *progress) eta(rate float64) string {
+	switch {
+	case p.total < 0, p.estimate && p.count > p.total:
+		return "unknown"
+	case p.count >= p.total:
+		return "0s"
+	case rate <= 0:
+		return "unknown"
 	}
-
-	eta := "?"
 
-	if rate > 0 && p.count <= p.total {
-		remaining := time.Duration(float64(p.total-p.count) / rate * float64(time.Second))
-		eta = remaining.Round(time.Second).String()
-	}
+	remaining := time.Duration(
+		float64(p.total-p.count) / rate * float64(time.Second))
 
-	return fmt.Sprintf("%s: [%d/%d] %.0f%% %.0f files/s elapsed %s eta %s",
-		p.label, p.count, p.total, pct, rate,
-		elapsed.Round(time.Second), eta)
+	return remaining.Round(time.Second).String()
 }

progress_test.go

@@ -1,16 +1,22 @@
 package main
 
 import (
+	"math"
 	"os"
 	"path/filepath"
 	"strings"
 	"testing"
 	"time"
+	"unicode/utf8"
 )
 
-// spinnerIdle comfortably outlasts the 100ms interval at which the
-// progressbar library redraws a spinner from its own goroutine.
-const spinnerIdle = 500 * time.Millisecond
+// testRedraw is the redraw interval the tests give a display, so that
+// many redraws fit in a few milliseconds.
+const testRedraw = time.Millisecond
+
+// testDeadline bounds how long a test waits for a display to draw what
+// it expects.
+const testDeadline = 5 * time.Second
 
 //nolint:paralleltest // replaces the process-wide os.Stderr
 func TestStderrIsTTYFalseForNonTerminals(t *testing.T) {
@@ -54,59 +60,437 @@ func TestStderrIsTTYFalseForNonTerminals(t *testing.T) {
 	}
 }
 
-// TestNewProgressPrintsBeforeFirstItem checks that each pass shows its
-// zero state the moment it starts when stderr is not a terminal, and
-// that the next line still waits for plainInterval.
-//
-//nolint:paralleltest // captureStderr replaces the process-wide os.Stderr
-func TestNewProgressPrintsBeforeFirstItem(t *testing.T) {
-	stderr := captureStderr(t)
+func TestPhaseLabel(t *testing.T) {
+	t.Parallel()
 
-	newProgress("walk", -1).increment()
-	newProgress("hash", 10).increment()
-
-	want := "walk: 0 files, elapsed 0s\n" +
-		"hash: [0/10] 0% 0 files/s elapsed 0s eta ?\n"
-	if got := stderr(); got != want {
-		t.Errorf("stderr = %q, want %q", got, want)
+	phases := []string{"load", "walk", "hash"}
+	if got := phaseLabel(phases, "walk"); got != "[2/3] walk" {
+		t.Errorf("phaseLabel = %q, want %q", got, "[2/3] walk")
 	}
 }
 
-// newWalkSpinner returns the walk pass's terminal display, writing to
-// os.Stderr whether or not it is a terminal, and stops the library's
-// redraws when the test ends.
-func newWalkSpinner(t *testing.T) *progress {
+// TestProgressLine checks the line a display shows in each state, ten
+// seconds into the phase.
+func TestProgressLine(t *testing.T) {
+	t.Parallel()
+
+	ago := time.Now().Add(-10 * time.Second)
+
+	cases := []struct {
+		p    *progress
+		want string
+	}{{
+		p: &progress{
+			label: scanPhase("load"), total: -1,
+			waitingFor: "counting the records",
+		},
+		want: "[1/5] load: counting the records, elapsed 10s, eta unknown",
+	}, {
+		p:    &progress{label: scanPhase("hash"), total: 100, count: 20},
+		want: "[3/5] hash: [20/100] 20%, 2 files/s, elapsed 10s, eta 40s",
+	}, {
+		p:    &progress{label: scanPhase("hash"), total: 100},
+		want: "[3/5] hash: [0/100] 0%, 0 files/s, elapsed 10s, eta unknown",
+	}, {
+		p:    &progress{label: scanPhase("update"), total: 0},
+		want: "[4/5] update: [0/0] 100%, 0 files/s, elapsed 10s, eta 0s",
+	}, {
+		p: &progress{
+			label: scanPhase("walk"), total: 100, estimate: true, count: 20,
+		},
+		want: "[2/5] walk: [20/~100] 20%, 2 files/s, elapsed 10s, eta 40s",
+	}, {
+		// Past the estimate the walk cannot tell how long it has left.
+		p: &progress{
+			label: scanPhase("walk"), total: 100, estimate: true, count: 120,
+		},
+		want: "[2/5] walk: [120/~100] 120%, 12 files/s, elapsed 10s, " +
+			"eta unknown",
+	}, {
+		// A first scan's walk has no estimate.
+		p:    &progress{label: scanPhase("walk"), total: -1, count: 20},
+		want: "[2/5] walk: 20 files, 2 files/s, elapsed 10s, eta unknown",
+	}}
+
+	for _, tc := range cases {
+		tc.p.start, tc.p.rateStart = ago, ago
+
+		if got, _ := tc.p.line(math.MaxInt, true); got != tc.want {
+			t.Errorf("line = %q, want %q", got, tc.want)
+		}
+	}
+}
+
+// TestLineFitsRoom checks how a line is fitted to the room it has, ten
+// seconds into the phase: it leaves out the rate, or what the phase
+// waits for, and is cut only when what is left is still too wide.
+func TestLineFitsRoom(t *testing.T) {
+	t.Parallel()
+
+	ago := time.Now().Add(-10 * time.Second)
+	hash := &progress{
+		label: scanPhase("hash"), total: 100, count: 20,
+		start: ago, rateStart: ago,
+	}
+	content := &progress{
+		label: scanPhase("content"), total: -1,
+		waitingFor: "searching the database", start: ago, rateStart: ago,
+	}
+
+	cases := []struct {
+		p       *progress
+		room    int
+		percent bool
+		want    string
+		fits    bool
+	}{{
+		p: hash, room: 57, percent: true,
+		want: "[3/5] hash: [20/100] 20%, 2 files/s, elapsed 10s, eta 40s",
+		fits: true,
+	}, {
+		p: hash, room: 56, percent: true,
+		want: "[3/5] hash: [20/100] 20%, elapsed 10s, eta 40s",
+		fits: true,
+	}, {
+		p: hash, room: 45, percent: true,
+		want: "[3/5] hash: [20/100] 20%, elapsed 10s, eta 40",
+		fits: false,
+	}, {
+		// Before the library's bar, which shows the percent.
+		p: hash, room: 57, percent: false,
+		want: "[3/5] hash: [20/100], 2 files/s, elapsed 10s, eta 40s",
+		fits: true,
+	}, {
+		p: content, room: 40, percent: true,
+		want: "[5/5] content: elapsed 10s, eta unknown",
+		fits: true,
+	}}
+
+	for _, tc := range cases {
+		got, fits := tc.p.line(tc.room, tc.percent)
+		if got != tc.want || fits != tc.fits {
+			t.Errorf("line(%d, %t) = %q, %t, want %q, %t",
+				tc.room, tc.percent, got, fits, tc.want, tc.fits)
+		}
+	}
+}
+
+// TestSetTotalStartsRate checks that setTotal starts a phase's rate,
+// and so its ETA, from when the total becomes known, not from when the
+// phase started waiting for it.
+func TestSetTotalStartsRate(t *testing.T) {
+	t.Parallel()
+
+	waited := time.Now().Add(-20 * time.Second)
+	p := &progress{
+		label: scanPhase("load"), total: -1, start: waited, rateStart: waited,
+	}
+
+	p.setTotal(100)
+
+	// Ten seconds after the total came, without waiting ten seconds,
+	// 20 records are read.
+	p.start = p.start.Add(-10 * time.Second)
+	p.rateStart = p.rateStart.Add(-10 * time.Second)
+	p.count = 20
+
+	want := "[1/5] load: [20/100] 20%, 2 files/s, elapsed 30s, eta 40s"
+	if got, _ := p.line(math.MaxInt, true); got != want {
+		t.Errorf("line = %q, want %q", got, want)
+	}
+}
+
+// awaitOutput waits until stderr holds want at least times times, and
+// fails the test if it never does.
+func awaitOutput(t *testing.T, stderr func() string, want string,
+	times int,
+) {
 	t.Helper()
 
-	p := &progress{
-		label: "walk", total: -1, start: time.Now(),
-		bar: newBar("walk", -1),
-	}
-	t.Cleanup(p.finish)
+	deadline := time.Now().Add(testDeadline)
+	for strings.Count(stderr(), want) < times {
+		if time.Now().After(deadline) {
+			t.Fatalf("stderr = %q, want %q at least %d times",
+				stderr(), want, times)
+		}
 
-	return p
+		time.Sleep(testRedraw)
+	}
 }
 
-// TestProgressWarningsOnOwnLines drives the terminal display of the walk
-// pass through a run of warnings with no items between them, as when the
-// walk meets many unreadable paths, for several of the spinner's
-// redraws: every warning must land on a line of its own, never inside a
-// redraw.
+// TestPlainProgressPrintsAtStartAndEnd checks that when stderr is not a
+// terminal a phase prints its line the moment it starts, before its
+// first item, nothing for the items it completes before plainInterval
+// has passed, and its line again as it ends.
+//
+//nolint:paralleltest // captureStderr replaces the process-wide os.Stderr
+func TestPlainProgressPrintsAtStartAndEnd(t *testing.T) {
+	stderr := captureStderr(t)
+	p := newProgress(progressParams{label: scanPhase("hash"), total: 1000})
+
+	for range 1000 {
+		p.increment()
+	}
+
+	p.finish()
+
+	lines := strings.Split(strings.TrimSuffix(stderr(), "\n"), "\n")
+
+	want := "[3/5] hash: [0/1000] 0%, 0 files/s, elapsed 0s, eta unknown"
+	if len(lines) != 2 || lines[0] != want ||
+		!strings.HasPrefix(lines[1], "[3/5] hash: [1000/1000] 100%, ") {
+		t.Errorf("stderr lines = %q, want %q, then the line at 1000",
+			lines, want)
+	}
+}
+
+// TestPlainProgressPrintsWhileWaiting checks that a phase waiting with
+// no completed items still prints a line every interval.
+//
+//nolint:paralleltest // captureStderr replaces the process-wide os.Stderr
+func TestPlainProgressPrintsWhileWaiting(t *testing.T) {
+	stderr := captureStderr(t)
+	p := startProgress(progressParams{
+		label: scanPhase("load"), total: -1,
+		waitingFor: "counting the records",
+	}, nil, testRedraw)
+
+	awaitOutput(t, stderr,
+		"[1/5] load: counting the records, elapsed 0s, eta unknown\n", 3)
+	p.finish()
+}
+
+// lastFrame returns what a terminal shows of the frames a display drew:
+// the last one. The library starts each frame with a carriage return
+// and erases the previous one with spaces first.
+func lastFrame(out string) string {
+	var shown string
+
+	for frame := range strings.SplitSeq(out, "\r") {
+		if strings.TrimSpace(frame) != "" {
+			shown = frame
+		}
+	}
+
+	return shown
+}
+
+// TestTerminalRedrawsWhileWaiting checks that the terminal display of a
+// phase, spinner or bar, keeps being drawn while the phase waits for its
+// next item, with the elapsed time as of now, and shows every item
+// completed before the wait. stderr is not a terminal here, so the
+// displays take it to be fallbackWidth wide.
+//
+//nolint:paralleltest // captureStderr replaces the process-wide os.Stderr
+func TestTerminalRedrawsWhileWaiting(t *testing.T) {
+	stderr := captureStderr(t)
+
+	cases := []struct {
+		params progressParams
+		want   string // how the line shows a count of 50
+	}{
+		{progressParams{label: scanPhase("walk"), total: -1}, "50 files,"},
+		{progressParams{label: scanPhase("hash"), total: 100}, "[50/100],"},
+	}
+
+	for _, tc := range cases {
+		before := len(stderr())
+		since := func() string { return stderr()[before:] }
+		p := startProgress(tc.params, terminalWidth, testRedraw)
+
+		for range 50 {
+			p.increment()
+		}
+
+		// An hour into the phase, without waiting an hour.
+		p.mu.Lock()
+		p.start = p.start.Add(-time.Hour)
+		p.mu.Unlock()
+
+		awaitOutput(t, since, "elapsed 1h0m0s", 1)
+		p.finish()
+
+		if shown := lastFrame(since()); !strings.Contains(shown, tc.want) {
+			t.Errorf("terminal shows %q, want %q", shown, tc.want)
+		}
+	}
+}
+
+// drawLate draws the display params describes on a terminal width
+// columns wide as it starts and once more as it ends, with count items
+// done two and a half hours into the phase, and returns what it wrote
+// to stderr.
+func drawLate(stderr func() string, params progressParams, width int,
+	count int64,
+) string {
+	before := len(stderr())
+
+	// No timed draws come between the two.
+	p := startProgress(params, func() int { return width }, time.Hour)
+
+	// Without counting the items one by one or waiting the hours.
+	p.mu.Lock()
+	p.count = count
+	p.start = p.start.Add(-150 * time.Minute)
+	p.rateStart = p.start
+	p.mu.Unlock()
+
+	p.finish()
+
+	return stderr()[before:]
+}
+
+// TestTerminalLinesKeepETA checks the line each display shows on an
+// 80-column terminal at a large scan's counts and times: the rate is
+// left out, so that the elapsed time and the ETA stay whole.
+//
+//nolint:paralleltest // captureStderr replaces the process-wide os.Stderr
+func TestTerminalLinesKeepETA(t *testing.T) {
+	stderr := captureStderr(t)
+
+	cases := []struct {
+		params progressParams
+		want   string
+	}{{
+		// Past its estimate, the walk cannot tell how long it has left.
+		params: progressParams{
+			label: scanPhase("walk"), total: 1200000, estimate: true,
+		},
+		want: "[2/5] walk: [1234567/~1200000] 103%, elapsed 2h30m0s, " +
+			"eta unknown",
+	}, {
+		params: progressParams{label: scanPhase("hash"), total: 9876543},
+		want: "[3/5] hash: [1234567/9876543] 12%, elapsed 2h30m0s, " +
+			"eta 17h30m0s",
+	}, {
+		params: progressParams{label: scanPhase("content"), total: 9876543},
+		want: "[5/5] content: [1234567/9876543] 12%, elapsed 2h30m0s, " +
+			"eta 17h30m0s",
+	}}
+
+	for _, tc := range cases {
+		out := drawLate(stderr, tc.params, 80, 1234567)
+		if shown := lastFrame(out); !strings.Contains(shown, tc.want) {
+			t.Errorf("terminal shows %q, want %q", shown, tc.want)
+		}
+	}
+}
+
+// TestTerminalLinesFitWidth draws a large scan's bar display and a small
+// scan's, two and a half hours into the phase, on terminals from 120
+// columns down to 40, and checks that every line stays clear of the
+// terminal's last column. A line that reaches it wraps, and every
+// redraw then leaves a line behind. The bar is drawn where it has room,
+// as at 120 columns, and left out where it has none.
+//
+//nolint:paralleltest // captureStderr replaces the process-wide os.Stderr
+func TestTerminalLinesFitWidth(t *testing.T) {
+	stderr := captureStderr(t)
+
+	for _, width := range []int{120, 100, 80, 72, 60, 50, 40} {
+		for _, total := range []int64{9876543, 20000} {
+			params := progressParams{label: scanPhase("content"), total: total}
+			out := drawLate(stderr, params, width, total/8)
+
+			if width == 120 && !strings.Contains(out, "% |") {
+				t.Errorf("no bar on a terminal %d wide: %q", width, out)
+			}
+
+			lines := strings.FieldsFuncSeq(out, func(r rune) bool {
+				return r == '\r' || r == '\n'
+			})
+
+			for line := range lines {
+				if n := utf8.RuneCountInString(line); n >= width {
+					t.Errorf("a line of %d columns on a terminal %d wide: %q",
+						n, width, line)
+				}
+			}
+		}
+	}
+}
+
+// TestTerminalNarrowedRedrawsInPlace draws a large scan's display, two
+// and a half hours into the phase, on a terminal 120 columns wide, then
+// makes the terminal narrower than that line and draws it again a few
+// times. Nothing written after that, the erase before each redraw
+// included, may reach the narrower terminal's last column: it would
+// wrap, and every redraw would leave a line behind. At these widths the
+// spinner stays a spinner and the bar stays a bar.
+//
+//nolint:paralleltest // captureStderr replaces the process-wide os.Stderr
+func TestTerminalNarrowedRedrawsInPlace(t *testing.T) {
+	stderr := captureStderr(t)
+
+	cases := []struct {
+		params progressParams
+		narrow int
+	}{
+		{progressParams{label: scanPhase("walk"), total: -1}, 60},
+		{progressParams{label: scanPhase("hash"), total: 9876543}, 90},
+	}
+
+	for _, tc := range cases {
+		width := 120
+
+		// No timed draws: the test draws.
+		p := startProgress(tc.params, func() int { return width }, time.Hour)
+
+		p.mu.Lock()
+		p.count = 1234567
+		p.start = p.start.Add(-150 * time.Minute)
+		p.rateStart = p.start
+		p.mu.Unlock()
+
+		p.draw()
+
+		width = tc.narrow
+		before := len(stderr())
+
+		p.draw()
+		p.draw()
+		p.finish()
+
+		lines := strings.FieldsFuncSeq(stderr()[before:], func(r rune) bool {
+			return r == '\r' || r == '\n'
+		})
+
+		for line := range lines {
+			if n := utf8.RuneCountInString(line); n >= width {
+				t.Errorf("%d columns written on a terminal made %d wide: %q",
+					n, width, line)
+			}
+		}
+	}
+}
+
+// TestProgressWarningsOnOwnLines drives the terminal displays, spinner
+// and bar, through a run of warnings with no items between them, as when
+// the walk meets many unreadable paths, for many redraws: every warning
+// must land on a line of its own, never inside a redraw.
 //
 //nolint:paralleltest // captureStderr replaces the process-wide os.Stderr
 func TestProgressWarningsOnOwnLines(t *testing.T) {
 	stderr := captureStderr(t)
-	p := newWalkSpinner(t)
 
-	// No pause between warnings: one written straight to stderr is
-	// garbled only if a redraw lands while it is being written.
-	issued := 0
-	for start := time.Now(); time.Since(start) < spinnerIdle; issued++ {
-		p.warnf("warning")
+	cases := []progressParams{
+		{label: scanPhase("walk"), total: -1},
+		{label: scanPhase("hash"), total: 10},
 	}
 
-	// The spinner prints the warnings at its next redraw.
-	time.Sleep(spinnerIdle)
+	issued := 0
+
+	for _, params := range cases {
+		p := startProgress(params, terminalWidth, testRedraw)
+
+		// No pause between warnings: one written straight to stderr is
+		// garbled only if a redraw lands while it is being written.
+		for start := time.Now(); time.Since(start) < 50*testRedraw; issued++ {
+			p.warnf("warning")
+		}
+
+		p.finish()
+	}
 
 	// A terminal shows each line as the text after its last carriage
 	// return.
@@ -129,83 +513,43 @@ func TestProgressWarningsOnOwnLines(t *testing.T) {
 	}
 }
 
-// TestSpinnerShowsCountAfterBurst checks that once a burst of items
-// faster than the redraw limit is over, the walk display shows every
-// item completed while it waits for the next one.
+// TestTerminalStoppedShortKeepsCount checks that the terminal display
+// of a phase that stops before its total, as an interrupted one does,
+// is left showing the count it stopped at rather than a full bar.
 //
 //nolint:paralleltest // captureStderr replaces the process-wide os.Stderr
-func TestSpinnerShowsCountAfterBurst(t *testing.T) {
+func TestTerminalStoppedShortKeepsCount(t *testing.T) {
 	stderr := captureStderr(t)
-	p := newWalkSpinner(t)
-
-	for range 50 {
-		p.increment()
-	}
-
-	time.Sleep(spinnerIdle)
-
-	if shown := lastFrame(stderr()); !strings.Contains(shown, "(50/-,") {
-		t.Errorf("terminal shows %q, want a count of 50", shown)
-	}
-}
-
-// lastFrame returns what a terminal shows of the frames a bar drew: the
-// last one. The library starts each frame with a carriage return and
-// erases the previous one with spaces first.
-func lastFrame(out string) string {
-	var shown string
-
-	for frame := range strings.SplitSeq(out, "\r") {
-		if strings.TrimSpace(frame) != "" {
-			shown = frame
-		}
-	}
-
-	return shown
-}
-
-// TestBarStoppedShortKeepsCount checks that the terminal display of a
-// pass that stops before its total, as an interrupted one does, is left
-// as last drawn instead of being filled up.
-//
-//nolint:paralleltest // captureStderr replaces the process-wide os.Stderr
-func TestBarStoppedShortKeepsCount(t *testing.T) {
-	stderr := captureStderr(t)
-	p := &progress{
-		label: "hash", total: 10, start: time.Now(),
-		bar: newBar("hash", 10),
-	}
+	p := startProgress(progressParams{label: scanPhase("hash"), total: 10},
+		terminalWidth, redrawInterval)
 
 	p.increment()
-
-	// Past the redraw limit, so the bar draws the next count.
-	time.Sleep(2 * barThrottle)
 	p.increment()
 	p.finish()
 
-	if shown := lastFrame(stderr()); !strings.Contains(shown, "(2/10,") {
+	if shown := lastFrame(stderr()); !strings.Contains(shown, "[2/10],") {
 		t.Errorf("terminal shows %q, want a count of 2 of 10", shown)
 	}
 }
 
 // TestWarningAfterLastItemKeepsBar checks that a warning printed after
-// a pass's last item, as for a failed read of the last file, leaves the
-// pass's finished bar on the terminal below the warning.
+// a phase's last item, as for a failed read of the last file, leaves the
+// phase's full bar on the terminal below the warning.
 //
 //nolint:paralleltest // captureStderr replaces the process-wide os.Stderr
 func TestWarningAfterLastItemKeepsBar(t *testing.T) {
 	stderr := captureStderr(t)
-	p := &progress{
-		label: "hash", total: 2, start: time.Now(),
-		bar: newBar("hash", 2),
-	}
+	p := startProgress(progressParams{label: scanPhase("hash"), total: 2},
+		terminalWidth, testRedraw)
 
 	p.increment()
 	p.increment()
+
+	awaitOutput(t, stderr, "[2/2],", 1)
 	p.warnf("warning")
 	p.finish()
 
-	if shown := lastFrame(stderr()); !strings.Contains(shown, "(2/2,") {
+	if shown := lastFrame(stderr()); !strings.Contains(shown, "[2/2],") {
 		t.Errorf("terminal shows %q, want a count of 2 of 2", shown)
 	}
 }

report.go

@@ -34,9 +34,16 @@ type scanRec struct {
 // records, and each row is written as it is read, so no group is held
 // in memory. It never touches the scanned filesystem; its only I/O is
 // the database (with SQLite's temporary sort file), stdout, and stderr.
-// Any database problem, including a missing database, is fatal.
+// It names the database on stderr before it opens it. Any database
+// problem, including a missing database, is fatal.
 func runReport(ctx context.Context, stdout io.Writer) error {
-	dbPath := databasePath()
+	dbPath, source, err := databasePath()
+	if err != nil {
+		return err
+	}
+
+	fmt.Fprintf(os.Stderr, "report: database %s (%s)\n",
+		escapePath(dbPath), source)
 
 	db, err := openReportDatabase(ctx, dbPath)
 	if err != nil {

scan.go

@@ -84,14 +84,24 @@ type fileMeta struct {
 	hashed bool
 }
 
-// runScan implements the scan subcommand: four sequential phases —
-// walk (which stats each file as it is discovered), hash, update,
-// content — that synchronize the persistent database with the
-// filesystem state under the PATH operands. Only files whose size at
-// least one other file shares are ever hashed: a size-unique file
-// cannot be a duplicate. A file of headTailMin or more gets its content
-// hash only when its size, head, and tail match another file's. Flag
-// parsing and the at-least-one-operand check are done by cobra. The
+// scanPhase names one phase of a scan with its place among all of them,
+// as "[2/5] walk", for the phase's progress display. The list here is
+// the one place the phases are counted.
+func scanPhase(name string) string {
+	return phaseLabel(
+		[]string{"load", "walk", "hash", "update", "content"}, name)
+}
+
+// runScan implements the scan subcommand: five sequential phases —
+// load (which reads the existing records), walk (which stats each file
+// as it is discovered), hash, update, content — that synchronize the
+// persistent database with the filesystem state under the PATH
+// operands. Only files whose size at least one other file shares are
+// ever hashed: a size-unique file cannot be a duplicate. A file of
+// headTailMin or more gets its content hash only when its size, head,
+// and tail match another file's. Flag parsing and the
+// at-least-one-operand check are done by cobra. Before anything else,
+// the scan names the database on stderr, saying whether it is new. The
 // scan holds the lock on the database for its whole run, so a second
 // scan fails before it walks the filesystem or opens the database.
 // Errors are returned rather than exiting, so that the deferred close —
@@ -104,12 +114,26 @@ type fileMeta struct {
 func runScan(ctx context.Context, roots []string, workers int,
 	oneFS bool,
 ) error {
-	roots, err := resolveRoots(roots)
+	dbPath, source, err := databasePath()
 	if err != nil {
 		return err
 	}
 
-	dbPath := databasePath()
+	// A database file missing now is created by lockScanDatabase below.
+	what := "database"
+
+	_, err = os.Stat(dbPath)
+	if errors.Is(err, fs.ErrNotExist) {
+		what = "new database"
+	}
+
+	fmt.Fprintf(os.Stderr, "scan: %s %s (%s)\n", what, escapePath(dbPath),
+		source)
+
+	roots, err = resolveRoots(roots)
+	if err != nil {
+		return err
+	}
 
 	lock, err := lockScanDatabase(dbPath)
 	if err != nil {
@@ -204,12 +228,12 @@ func resolveRoots(roots []string) ([]string, error) {
 
 // pruneRoots drops operands already covered by another operand:
 // duplicates and any operand lying under another one. With -x, an
-// operand under another one is kept when device puts it, or for a
-// regular file its directory, on a different filesystem than the
-// deepest kept operand above it, because that operand's walk then does
-// not reach it. Every remaining file is then reachable through exactly
-// one root, so walked paths are unique without keeping a scan-wide set
-// of every path seen.
+// operand under another one is kept when the walk of the deepest kept
+// operand above it cannot reach it: when device puts any directory from
+// it (from its directory, for a regular file) up to but not including
+// that operand on a different filesystem than that operand. Every
+// remaining file is then reachable through exactly one root, so walked
+// paths are unique without keeping a scan-wide set of every path seen.
 func pruneRoots(roots []string, oneFS bool,
 	device func(path string) (uint64, bool),
 ) []string {
@@ -239,10 +263,15 @@ func pruneRoots(roots []string, oneFS bool,
 			continue
 		}
 
+		aboveDev, aboveOK := device(above)
+		if !aboveOK {
+			continue
+		}
+
 		// The walk of above enters a directory only when it is on
 		// above's filesystem, and then reaches every regular file in it
 		// whatever device the file reports, so for a regular-file
-		// operand its directory decides.
+		// operand the directories checked start at its directory.
 		dir := r
 
 		fi, err := os.Lstat(r)
@@ -250,11 +279,13 @@ func pruneRoots(roots []string, oneFS bool,
 			dir = filepath.Dir(r)
 		}
 
-		dev, ok := device(dir)
-		aboveDev, aboveOK := device(above)
+		for ; dir != above; dir = filepath.Dir(dir) {
+			dev, ok := device(dir)
+			if ok && dev != aboveDev {
+				kept = append(kept, r)
 
-		if ok && aboveOK && dev != aboveDev {
-			kept = append(kept, r)
+				break
+			}
 		}
 	}
 
@@ -321,18 +352,18 @@ func syncScan(ctx context.Context, db *sql.DB, roots []string,
 }
 
 // runPhases synchronizes the database with the filesystem under roots
-// in four sequential phases: walk (enumerate and stat every file,
-// building a complete size census), hash (read only the new or
-// changed — or previously unhashed — files whose size at least one
-// other file shares, committing results in batches as they arrive),
-// update (record the size-unique files without reading them, and
-// delete the records the scan no longer verifies), and content (fill
-// in the content hash of every record of headTailMin or more whose
-// size, head, and tail match another record's). Records outside the
-// roots are never touched, except that the content phase fills in
-// their content hash. Operands the walk cannot start from are dropped
-// first, so the records beneath them count as outside the roots unless
-// they lie under another root.
+// in five sequential phases: load (read the existing records), walk
+// (enumerate and stat every file, building a complete size census),
+// hash (read only the new or changed — or previously unhashed — files
+// whose size at least one other file shares, committing results in
+// batches as they arrive), update (record the size-unique files without
+// reading them, and delete the records the scan no longer verifies),
+// and content (fill in the content hash of every record of headTailMin
+// or more whose size, head, and tail match another record's). Records
+// outside the roots are never touched, except that the content phase
+// fills in their content hash. Operands the walk cannot start from are
+// dropped first, so the records beneath them are treated as if those
+// operands had not been given.
 func (s *scanState) runPhases(ctx context.Context, roots []string,
 	workers int, oneFS bool,
 ) error {
@@ -374,10 +405,10 @@ func (s *scanState) runPhases(ctx context.Context, roots []string,
 // walkableRoots returns the operands the walk can start from: regular
 // files, and directories not named .zfs. Every other operand is warned
 // about, counted as skipped, and dropped. A dropped operand is no
-// longer a root, so the records stored beneath it count as outside the
-// roots and are not deleted as unverified, unless it lies under another
-// root. An operand that fails lstat here is kept, and the walk warns
-// about it.
+// longer a root, so the records stored beneath it are treated as if it
+// had not been given: those under no other root count as outside the
+// roots and are not deleted as unverified. An operand that fails lstat
+// here is kept, and the walk warns about it.
 func (s *scanState) walkableRoots(roots []string) []string {
 	kept := make([]string, 0, len(roots))
 
@@ -407,10 +438,21 @@ func (s *scanState) walkableRoots(roots []string) []string {
 // separately into the same database.
 func (s *scanState) loadIndex(ctx context.Context, roots []string) error {
 	// Indexing tens of millions of records takes real time; without a
-	// display the scan looks hung before the walk begins.
-	prog := newProgress("load", -1)
+	// display the scan looks hung before the walk begins. Counting them
+	// first gives the display its total.
+	prog := newProgress(progressParams{
+		label: scanPhase("load"), total: -1,
+		waitingFor: "counting the records",
+	})
 	defer prog.finish()
 
+	total, err := countRecords(ctx, s.db)
+	if err != nil {
+		return err
+	}
+
+	prog.setTotal(total)
+
 	s.existing = make(map[string]fileMeta)
 
 	return loadFileMeta(ctx, s.db,
@@ -442,7 +484,16 @@ func (s *scanState) loadIndex(ctx context.Context, roots []string) error {
 func (s *scanState) walkPhase(
 	events <-chan walkEvent, roots []string,
 ) ([]fileRec, []fileRec) {
-	prog := newProgress("walk", -1)
+	// The records the last scan left under the roots estimate how many
+	// files the walk will find. A first scan has none, and no estimate.
+	estimate := int64(len(s.existing))
+	if estimate == 0 {
+		estimate = -1
+	}
+
+	prog := newProgress(progressParams{
+		label: scanPhase("walk"), total: estimate, estimate: true,
+	})
 
 	var (
 		changed, unhashed []fileRec
@@ -613,10 +664,11 @@ func (s *scanState) hashPhase(ctx context.Context, workers int) error {
 }
 
 // readRuns reads runs with the worker pool, one read per inode run, in
-// the order given, under a progress display named label. The workers
-// compute each run's hashes with hash, and each result goes to record;
-// a run that fails to read is warned about and counted as skipped
-// instead. The total counts actual reads, so the bar shows a real ETA.
+// the order given, under the progress display of the phase named label.
+// The workers compute each run's hashes with hash, and each result goes
+// to record; a run that fails to read is warned about and counted as
+// skipped instead. The total counts actual reads, so the display shows
+// a real ETA.
 //
 // Returning early — a failed database write, or a cancelled scan — must
 // not strand the pool: the feeder would park forever on a full jobs
@@ -630,7 +682,9 @@ func (s *scanState) readRuns(ctx context.Context, workers int,
 	pool := startHashPool(ctx, runs, workers, hash)
 	defer pool.stop()
 
-	prog := newProgress(label, int64(len(runs)))
+	prog := newProgress(progressParams{
+		label: scanPhase(label), total: int64(len(runs)),
+	})
 	defer prog.finish()
 
 	for range runs {
@@ -717,7 +771,9 @@ func (s *scanState) updatePhase(ctx context.Context) error {
 	s.st.removed = len(deletes)
 
 	total := len(s.batch) + len(s.sentinels) + len(deletes)
-	prog := newProgress("update", int64(total))
+	prog := newProgress(progressParams{
+		label: scanPhase("update"), total: int64(total),
+	})
 
 	defer prog.finish()
 
@@ -798,16 +854,28 @@ func (s *scanState) contentPhase(ctx context.Context, workers int) error {
 func (s *scanState) contentCandidates(
 	ctx context.Context,
 ) ([]fileRec, map[string]scanRec, error) {
-	// The query and the checks take real time on a large database;
+	// The search and the checks take real time on a large database;
 	// without a display the scan looks hung before the reads begin.
-	prog := newProgress("content", -1)
+	// The display says it is searching until SQLite returns the first
+	// record. The checks start there, against a count of the records
+	// the search returns, and so do their rate and ETA.
+	prog := newProgress(progressParams{
+		label: scanPhase("content"), total: -1,
+		waitingFor: "searching the database",
+	})
 	defer prog.finish()
 
+	total, err := countContentCandidates(ctx, s.db)
+	if err != nil {
+		return nil, nil, err
+	}
+
 	var (
-		toRead []fileRec
-		first  scanRec   // the current group's first record
-		passed int       // the current group's files that passed the check
-		unread []fileRec // those of them without a content hash
+		searching = true // no record has been returned yet
+		toRead    []fileRec
+		first     scanRec   // the current group's first record
+		passed    int       // the current group's files that passed the check
+		unread    []fileRec // those of them without a content hash
 	)
 
 	recs := make(map[string]scanRec)
@@ -826,7 +894,13 @@ func (s *scanState) contentCandidates(
 		passed, unread = 0, nil
 	}
 
-	err := loadContentCandidates(ctx, s.db, func(r scanRec, hashed bool) {
+	err = loadContentCandidates(ctx, s.db, func(r scanRec, hashed bool) {
+		if searching {
+			searching = false
+
+			prog.setTotal(total)
+		}
+
 		prog.increment()
 
 		if r.size != first.size || r.head != first.head || r.tail != first.tail {
@@ -857,6 +931,11 @@ func (s *scanState) contentCandidates(
 		return nil, nil, err
 	}
 
+	// A search that returned no record still ends showing its count.
+	if searching {
+		prog.setTotal(total)
+	}
+
 	endGroup()
 
 	return toRead, recs, nil
@@ -1032,7 +1111,8 @@ func operandWarning(root string, fi fs.FileInfo) string {
 // operand becomes an initial job. walkableRoots has already dropped
 // every other operand. One that has changed into something else since
 // is warned about and skipped here; it is still a root, so the records
-// stored beneath it are deleted as unverified.
+// stored beneath it, other than those under another root, are deleted
+// as unverified.
 func seedRoot(ctx context.Context, root string,
 	events chan<- walkEvent,
 ) []dirJob {
@@ -1232,7 +1312,8 @@ func emitFile(ctx context.Context, p string, e fs.DirEntry,
 // .zfs (ZFS snapshot pseudo-dirs would list every file once per
 // snapshot), and with -x never enter a directory on a different
 // filesystem than its operand, sending an event that names it so the
-// scan keeps the records below it.
+// scan keeps the records below it, except those below an operand at or
+// inside it.
 func subdirJob(ctx context.Context, p string, e fs.DirEntry,
 	parent dirJob, oneFS bool, events chan<- walkEvent,
 ) (dirJob, bool) {

scan_test.go

@@ -1136,10 +1136,11 @@ func TestSubdirJobStatError(t *testing.T) {
 }
 
 // syncOneFilesystem scans roots into db with -x and returns the scan
-// stats, taking the device of each operand, and of a regular-file
-// operand's directory, from devices instead of from lstat, so a test
-// can put an operand on a filesystem that no directory here is on. It
-// runs the steps of runPhases except the content phase.
+// stats. Every device pruneRoots looks up, and the device each
+// operand's walk compares its subdirectories with, comes from devices
+// instead of from lstat, so a test can put a path on a filesystem that
+// no directory here is on. Unlike runPhases, it skips walkableRoots,
+// the check for a cancelled walk, and the content phase.
 func syncOneFilesystem(t *testing.T, db *sql.DB, roots []string,
 	devices map[string]uint64,
 ) scanStats {
@@ -1302,6 +1303,64 @@ func TestScanOneFilesystemWalksNestedOperand(t *testing.T) {
 	}
 }
 
+// TestScanOneFilesystemWalksOperandBelowOtherFilesystem checks that
+// with -x an operand on the same filesystem as the operand covering it
+// is walked on its own when a directory between them is on another
+// filesystem, since the walk of the covering operand does not enter
+// that directory: a file added below the nested operand is recorded,
+// and the record of a file gone from below it is deleted. A record
+// below that directory but outside the nested operand is still kept.
+// Both operands are given one device that no directory here is on,
+// while mnt keeps its own.
+func TestScanOneFilesystemWalksOperandBelowOtherFilesystem(t *testing.T) {
+	t.Parallel()
+
+	dir := t.TempDir()
+	db := openTestDB(t)
+
+	// A scan without -x records both files below mnt.
+	gone := writeFile(t, dir, "mnt/back/gone", pattern(1, 10))
+	kept := writeFile(t, dir, "mnt/kept", pattern(2, 20))
+	syncTree(t, db, dir)
+
+	err := os.Remove(gone)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	added := writeFile(t, dir, "mnt/back/added", pattern(3, 30))
+
+	info, err := os.Lstat(dir)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	dev, ok := deviceOfInfo(info)
+	if !ok {
+		t.Skip("platform exposes no device id")
+	}
+
+	mnt := filepath.Join(dir, "mnt")
+	back := filepath.Join(mnt, "back")
+	syncOneFilesystem(t, db, []string{dir, back},
+		map[string]uint64{dir: dev + 1, mnt: dev, back: dev + 1})
+
+	paths := recordPaths(dbRecords(t, db))
+
+	if !slices.Contains(paths, added) {
+		t.Errorf("no record for %s: the walk did not reach %s", added, back)
+	}
+
+	if slices.Contains(paths, gone) {
+		t.Errorf("record for %s kept: the file is gone", gone)
+	}
+
+	if !slices.Contains(paths, kept) {
+		t.Errorf("record for %s deleted: the walk of %s did not enter %s",
+			kept, dir, mnt)
+	}
+}
+
 // TestScanOneFilesystemRecordsNestedFileOnce checks that with -x a
 // regular-file operand under another operand is dropped when the file
 // reports a different device than that operand but its directory does
@@ -1334,6 +1393,38 @@ func TestScanOneFilesystemRecordsNestedFileOnce(t *testing.T) {
 	}
 }
 
+// TestScanOneFilesystemWalksNestedFileOperand checks that with -x a
+// regular-file operand under another operand is kept when its directory
+// is on a different filesystem than that operand: the walk of the other
+// operand does not enter the directory, so the file is recorded once,
+// as its own operand. The other operand is given a device that no
+// directory here is on.
+func TestScanOneFilesystemWalksNestedFileOperand(t *testing.T) {
+	t.Parallel()
+
+	dir := t.TempDir()
+	db := openTestDB(t)
+	file := writeFile(t, dir, "sub/f", pattern(1, 10))
+
+	info, err := os.Lstat(dir)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	dev, ok := deviceOfInfo(info)
+	if !ok {
+		t.Skip("platform exposes no device id")
+	}
+
+	st := syncOneFilesystem(t, db, []string{dir, file}, map[string]uint64{
+		dir: dev + 1, filepath.Dir(file): dev,
+	})
+
+	if st.added != 1 {
+		t.Errorf("%s recorded %d times, want once", file, st.added)
+	}
+}
+
 // buildSmokeTree recreates the README smoke-test filesystem layout
 // with deterministic content and returns the tree root.
 func buildSmokeTree(t *testing.T) string {
@@ -1495,6 +1586,69 @@ func TestScanPipeline(t *testing.T) {
 	assertSmokeTreeGroups(t, dir, db)
 }
 
+// TestScanProgressNamesEachPhase checks the plain progress lines of a
+// first scan, and of a rescan of one operand holding two of the
+// database's records. Each phase's first line names it with its place
+// among the five: load counts the records before reading them, the
+// content phase searches the database, and the walk estimates its total
+// from the records under its operand, or says its ETA is unknown when
+// there are none.
+//
+//nolint:paralleltest // captureStderr replaces the process-wide os.Stderr
+func TestScanProgressNamesEachPhase(t *testing.T) {
+	stderr := captureStderr(t)
+	dir := buildSmokeTree(t)
+	db := openTestDB(t)
+
+	syncTree(t, db, dir)
+
+	first := stderr()
+
+	syncTree(t, db, filepath.Join(dir, "a"))
+
+	rescan := stderr()[len(first):]
+	load := "[1/5] load: counting the records, elapsed 0s, eta unknown"
+	content := "[5/5] content: searching the database, elapsed 0s, eta unknown"
+	cases := map[string][]string{
+		first: {
+			load, "[2/5] walk: 0 files, 0 files/s, elapsed 0s, eta unknown",
+			"[3/5] hash: [0/", "[4/5] update: [0/", content,
+		},
+		rescan: {
+			load, "[2/5] walk: [0/~2] 0%, 0 files/s, elapsed 0s, eta unknown",
+			"[3/5] hash: [0/", "[4/5] update: [0/", content,
+		},
+	}
+
+	for out, want := range cases {
+		var got []string
+
+		for line := range strings.Lines(out) {
+			label, _, _ := strings.Cut(line, ":")
+			if len(got) == 0 || !strings.HasPrefix(got[len(got)-1], label) {
+				got = append(got, line)
+			}
+		}
+
+		if len(got) != len(want) {
+			t.Fatalf("first lines of the phases = %q, want %q", got, want)
+		}
+
+		for i := range want {
+			if !strings.HasPrefix(got[i], want[i]) {
+				t.Errorf("phase %d starts %q, want %q", i+1, got[i], want[i])
+			}
+		}
+	}
+
+	// The load phase's total is the count of the records.
+	loaded := fmt.Sprintf("\n[1/5] load: [%d/%d] 100%%, ",
+		smokeTreeFiles, smokeTreeFiles)
+	if !strings.Contains(rescan, loaded) {
+		t.Errorf("rescan stderr = %q, want %q", rescan, loaded)
+	}
+}
+
 func TestSyncScanUnchangedReuse(t *testing.T) {
 	t.Parallel()
 

script/bootstrap

@@ -1,13 +1,24 @@
 #!/bin/sh
 # script/bootstrap: install all dependencies needed to build and develop
-# this repo. Idempotent; assumes nothing is present (not git, make, or
-# go). Base tooling comes from nix, apt, brew, or apk (detected in that
-# order). golangci-lint and prettier are never installed: they run via
-# docker only (script/lint, script/fmt, script/fmt-check).
+# this repo. Idempotent: every install is guarded by a check so already
+# installed tools are skipped. Base tooling comes from nix, apt, brew,
+# or apk (detected in that order); assumes nothing is present. The
+# installed node is used only when its major version is the pinned one;
+# otherwise (node missing, or another major) the pinned version is
+# installed via nvm (installing nvm itself first, from a hash-verified
+# release archive, never curl | sh), and yarn and the packages are
+# installed under it.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
+# Pinned versions, 2026-07-06
+NODE_VERSION="22.17.0"
+NVM_VERSION="0.40.3"
+# sha256 of https://github.com/nvm-sh/nvm/archive/refs/tags/v0.40.3.tar.gz
+NVM_SHA256="5f4d6aaa04a177dc93c985e31dbc411ab6b8c6e1e21d8015dbc1372625fcd1d0"
+YARN_VERSION="1.22.22"
+
 PKGMGR=""
 SUDO=""
 APT_UPDATED=""
@@ -40,6 +51,7 @@ pkg_install() {
     case "$PKGMGR" in
         nix) nix-env -iA "nixpkgs.$1" ;;
         apt)
+            # Package lists may be empty (fresh images); refresh once per run.
             if [ -z "$APT_UPDATED" ]; then
                 $SUDO env DEBIAN_FRONTEND=noninteractive apt-get update
                 APT_UPDATED=1
@@ -55,24 +67,103 @@ missing() {
     ! command -v "$1" >/dev/null 2>&1
 }
 
+# verify_sha256 <file> <expected-hash>
+verify_sha256() {
+    if command -v sha256sum >/dev/null 2>&1; then
+        actual="$(sha256sum "$1" | cut -d' ' -f1)"
+    else
+        actual="$(shasum -a 256 "$1" | cut -d' ' -f1)"
+    fi
+    if [ "$actual" != "$2" ]; then
+        echo "bootstrap: sha256 mismatch for $1" >&2
+        echo "  expected: $2" >&2
+        echo "  actual:   $actual" >&2
+        exit 1
+    fi
+}
+
+# nvm is a bash script; run a command in a bash with nvm loaded
+nvm_sh() {
+    bash -c ". \"\$HOME/.nvm/nvm.sh\" && $*"
+}
+
+ensure_nvm() {
+    [ -s "$HOME/.nvm/nvm.sh" ] && return 0
+    # nvm prerequisites; nvm itself requires bash
+    if missing bash; then pkg_install bash bash bash bash; fi
+    if missing curl; then pkg_install curl curl curl curl; fi
+    if missing git; then pkg_install git git git git; fi
+    tmp="$(mktemp -d)"
+    curl -fsSL -o "$tmp/nvm.tar.gz" \
+        "https://github.com/nvm-sh/nvm/archive/refs/tags/v${NVM_VERSION}.tar.gz"
+    verify_sha256 "$tmp/nvm.tar.gz" "$NVM_SHA256"
+    mkdir -p "$HOME/.nvm"
+    tar -xzf "$tmp/nvm.tar.gz" -C "$HOME/.nvm" --strip-components=1
+    rm -rf "$tmp"
+}
+
+# True when the node on PATH has the pinned major version. Only the
+# major is compared: the Dockerfile stages start from a node 22 alpine
+# image whose exact version is not the pin, and nvm cannot install a
+# prebuilt node on alpine. Another major is not used: the pinned yarn 1
+# prints a deprecation warning under node 24. script/fmt and
+# script/fmt-check carry this function unchanged, to run the yarn
+# installed here.
+node_is_pinned_major() {
+    if ! command -v node >/dev/null 2>&1; then return 1; fi
+    installed="$(node --version)"
+    installed="${installed#v}"
+    [ "${installed%%.*}" = "${NODE_VERSION%%.*}" ]
+}
+
+ensure_node() {
+    if node_is_pinned_major; then
+        echo "bootstrap: using node $(node --version)"
+        return 0
+    fi
+    ensure_nvm
+    nvm_sh "nvm install $NODE_VERSION"
+    nvm_sh "nvm use $NODE_VERSION >/dev/null && \
+        echo \"bootstrap: using node \$(node --version)\""
+}
+
+ensure_yarn() {
+    if ! node_is_pinned_major; then
+        nvm_sh "nvm use $NODE_VERSION >/dev/null && corepack enable && \
+            corepack prepare yarn@$YARN_VERSION --activate"
+        return 0
+    fi
+    if ! missing yarn; then return 0; fi
+    if ! missing corepack; then
+        corepack enable
+        corepack prepare "yarn@$YARN_VERSION" --activate
+    else
+        npm install -g "yarn@$YARN_VERSION"
+    fi
+}
+
+install_js_deps() {
+    if node_is_pinned_major; then
+        yarn install --frozen-lockfile
+    else
+        nvm_sh "nvm use $NODE_VERSION >/dev/null && cd \"$ROOT\" && \
+            yarn install --frozen-lockfile"
+    fi
+}
+
 main() {
     cd "$ROOT"
 
-    # Deliberately unpinned, so presence is the whole check: go.mod
-    # governs the Go version, and reproducible builds run in the
-    # digest-pinned Docker images.
-    if missing git; then pkg_install git git git git; fi
     if missing make; then pkg_install gnumake make make make; fi
+    if missing git; then pkg_install git git git git; fi
+    # Go builds the binary and runs gofmt. Presence is the whole check:
+    # go.mod names the Go version, and the tests and the linter run in
+    # digest-pinned images.
     if missing go; then pkg_install go golang go go; fi
 
-    # Warn, do not fail: only the targets named below, and the
-    # pre-commit hook, need docker.
-    if missing docker; then
-        echo "bootstrap: WARNING: docker not found; make lint, make fmt," >&2
-        echo "bootstrap: make fmt-check, make check, make docker and" >&2
-        echo "bootstrap: make test-race require it." >&2
-    fi
-
+    ensure_node
+    ensure_yarn
+    install_js_deps
     go mod download
 
     echo "bootstrap complete"

script/check

@@ -1,6 +1,8 @@
 #!/bin/sh
 # script/check: run all checks (test, lint, fmt-check). Our own
-# extension to scripts-to-rule-them-all. Must not modify any files.
+# extension to scripts-to-rule-them-all. test and lint are Docker
+# phases; fmt-check is native, because a formatter writes the working
+# tree. Must not modify any files.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"

script/cibuild

@@ -1,19 +1,32 @@
 #!/bin/sh
-# script/cibuild: run the CI build. The Gitea workflow runs this on
-# push. The Dockerfile runs every gate make check runs, as build steps,
-# so a successful build means the repo is green.
-#
-# Without a fresh CHECK_EPOCH, a rebuild of an unchanged checkout serves
-# the gate layers from cache and passes having run none of them. The
-# process id goes in with the epoch so two runs started in the same
-# second still differ.
+# script/cibuild: run the CI build. It bootstraps first: a CI runner
+# checks out and runs this and nothing else, and script/fmt-check runs
+# the formatter on the host, which a pristine checkout cannot do.
+# A new CACHEBUST value reruns every RUN step, since a cached gate phase
+# is a check that did not run; unlike --no-cache, it keeps Go's build cache.
+# This relies on every stage of the Dockerfile declaring ARG CACHEBUST
+# first; a stage without that line is served from cache on an unchanged
+# tree, with no warning.
 set -eu
 
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    docker build --build-arg CHECK_EPOCH="$(date +%s)-$$" .
+    "$SCRIPT_DIR/bootstrap"
+    "$SCRIPT_DIR/check"
+    # The version and the tag each get their own line: a failing
+    # command substitution inside an argument does not trip `set -e`,
+    # so the inline form degrades silently to an empty constant. The
+    # VERSION build argument takes precedence over the version a build
+    # stage derives from the .git in the context.
+    version="$(git describe --tags --always --dirty 2>/dev/null || true)"
+    [ -n "$version" ] || version="unknown"
+    tag="$("$SCRIPT_DIR/projectname")"
+    docker build --build-arg CACHEBUST="$(date +%s)-$$" \
+        --build-arg VERSION="$version" \
+        -t "$tag" .
 }
 
 main "$@"

script/docker

@@ -1,9 +1,11 @@
 #!/bin/sh
 # script/docker: build the Docker image tagged with the project name.
-# The tag comes from script/projectname. CHECK_EPOCH is passed for the
-# same reason script/cibuild passes it: without a fresh value an
-# unchanged tree is served from cache and this exits 0 having run no
-# gate.
+# Identical in all repos; the tag comes from script/projectname.
+# A new CACHEBUST value reruns every RUN step, since a cached gate phase
+# is a check that did not run; unlike --no-cache, it keeps Go's build cache.
+# This relies on every stage of the Dockerfile declaring ARG CACHEBUST
+# first; a stage without that line is served from cache on an unchanged
+# tree, with no warning.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
@@ -11,10 +13,17 @@ ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    docker build \
-        --build-arg CHECK_EPOCH="$(date +%s)-$$" \
-        -t "$("$SCRIPT_DIR/projectname")" \
-        .
+    # The version and the tag each get their own line: a failing
+    # command substitution inside an argument does not trip `set -e`,
+    # so the inline form degrades silently to an empty constant. The
+    # VERSION build argument takes precedence over the version a build
+    # stage derives from the .git in the context.
+    version="$(git describe --tags --always --dirty 2>/dev/null || true)"
+    [ -n "$version" ] || version="unknown"
+    tag="$("$SCRIPT_DIR/projectname")"
+    docker build --build-arg CACHEBUST="$(date +%s)-$$" \
+        --build-arg VERSION="$version" \
+        -t "$tag" .
 }
 
 main "$@"

script/fmt

@@ -1,22 +1,42 @@
 #!/bin/sh
-# script/fmt: format all files (writes): the Go sources with gofmt, the
-# Markdown with prettier. prettier is never installed on the host: it
-# runs from the Dockerfile's prettier stage with the repository mounted,
-# as the calling user so the files it rewrites keep their owner. The tag
-# makes each build replace the previous image instead of leaving another
-# one behind.
+# script/fmt: format all files (writes).
 set -eu
 
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
-ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+# Must match the pin in script/bootstrap.
+NODE_VERSION="22.17.0"
+
+# True when the node on PATH has the pinned major version: the same
+# function as in script/bootstrap, which uses it to decide where it
+# installs yarn.
+node_is_pinned_major() {
+    if ! command -v node >/dev/null 2>&1; then return 1; fi
+    installed="$(node --version)"
+    installed="${installed#v}"
+    [ "${installed%%.*}" = "${NODE_VERSION%%.*}" ]
+}
+
+# Run the yarn script/bootstrap installed: the yarn on PATH when the
+# node on PATH has the pinned major version, and otherwise yarn under
+# the pinned node in nvm, which bootstrap leaves off the PATH of the
+# shell that called it. nvm is a bash script, hence the subshell.
+run_yarn() {
+    if node_is_pinned_major && command -v yarn >/dev/null 2>&1; then
+        exec yarn "$@"
+    fi
+    if node_is_pinned_major || [ ! -s "$HOME/.nvm/nvm.sh" ]; then
+        echo "fmt: no yarn; run script/bootstrap first" >&2
+        exit 1
+    fi
+    exec bash -c '. "$HOME/.nvm/nvm.sh" && nvm use "$1" >/dev/null &&
+        shift && exec yarn "$@"' bash "$NODE_VERSION" "$@"
+}
 
 main() {
     cd "$ROOT"
     gofmt -s -w .
-    image="$("$SCRIPT_DIR/projectname")-prettier"
-    docker build -q --target prettier -t "$image" . >/dev/null
-    docker run --rm --user "$(id -u):$(id -g)" -v "$ROOT:/src" "$image" \
-        prettier --write '**/*.md' --tab-width 4 --prose-wrap always
+    run_yarn run prettier --write '**/*.md' --tab-width 4 --prose-wrap always
 }
 
 main "$@"

script/fmt-check

@@ -1,19 +1,45 @@
 #!/bin/sh
-# script/fmt-check: check formatting (read-only). Same scope as
-# script/fmt, but fails instead of writing. gofmt and prettier both run
-# every time and each reports its own failure, so the output says which
-# one failed.
+# script/fmt-check: check formatting (read-only).
 set -eu
 
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
-ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+# Must match the pin in script/bootstrap.
+NODE_VERSION="22.17.0"
+
+# True when the node on PATH has the pinned major version: the same
+# function as in script/bootstrap, which uses it to decide where it
+# installs yarn.
+node_is_pinned_major() {
+    if ! command -v node >/dev/null 2>&1; then return 1; fi
+    installed="$(node --version)"
+    installed="${installed#v}"
+    [ "${installed%%.*}" = "${NODE_VERSION%%.*}" ]
+}
+
+# Run the yarn script/bootstrap installed: the yarn on PATH when the
+# node on PATH has the pinned major version, and otherwise yarn under
+# the pinned node in nvm, which bootstrap leaves off the PATH of the
+# shell that called it. nvm is a bash script, hence the subshell.
+run_yarn() {
+    if node_is_pinned_major && command -v yarn >/dev/null 2>&1; then
+        exec yarn "$@"
+    fi
+    if node_is_pinned_major || [ ! -s "$HOME/.nvm/nvm.sh" ]; then
+        echo "fmt-check: no yarn; run script/bootstrap first" >&2
+        exit 1
+    fi
+    exec bash -c '. "$HOME/.nvm/nvm.sh" && nvm use "$1" >/dev/null &&
+        shift && exec yarn "$@"' bash "$NODE_VERSION" "$@"
+}
 
 main() {
     cd "$ROOT"
     status=0
 
-    # Under set -e a bare assignment would end the script when gofmt
-    # fails (a Go file it cannot parse), and prettier would never run.
+    # gofmt and prettier both run every time, so the output names each
+    # one that fails. Under set -e a bare assignment would end the
+    # script when gofmt fails (a Go file it cannot parse).
     if ! files="$(gofmt -s -l .)"; then
         echo "gofmt: failed; see its errors above" >&2
         status=1
@@ -24,14 +50,9 @@ main() {
         status=1
     fi
 
-    # Same image as script/fmt; see there.
-    image="$("$SCRIPT_DIR/projectname")-prettier"
-    docker build -q --target prettier -t "$image" . >/dev/null
-    if ! docker run --rm -v "$ROOT:/src:ro" "$image" \
-        prettier --check '**/*.md' --tab-width 4 --prose-wrap always; then
-        echo "prettier: Markdown not formatted; run make fmt" >&2
+    # run_yarn ends in exec; the subshell returns here afterwards.
+    (run_yarn run prettier --check '**/*.md' --tab-width 4 --prose-wrap always) ||
         status=1
-    fi
 
     exit "$status"
 }

script/install-precommit

@@ -1,19 +1,15 @@
 #!/bin/sh
 # script/install-precommit: install the git pre-commit hook that runs
 # script/precommit. Our own extension to scripts-to-rule-them-all.
-# Hooks are shared between the main checkout and all worktrees, so
-# resolve the common git dir instead of assuming .git is a directory.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    hooks_dir="$(git rev-parse --git-common-dir)/hooks"
-    mkdir -p "$hooks_dir"
-    hook="$hooks_dir/pre-commit"
-    printf '#!/bin/sh\nset -e\nscript/precommit\n' > "$hook"
-    chmod +x "$hook"
+    hook=".git/hooks/pre-commit"
+    printf '#!/bin/sh\nset -e\nscript/precommit\n' > .git/hooks/pre-commit
+    chmod +x .git/hooks/pre-commit
     echo "pre-commit hook installed: runs script/precommit"
 }
 

script/lint

@@ -1,28 +1,26 @@
 #!/bin/sh
-# script/lint: run the linter. golangci-lint is never installed on a
-# host: this builds Dockerfile.lint, which copies the repo into the
-# digest-pinned golangci-lint image and lints as a build step, so a
-# successful build is a clean lint. A cold cache needs the network to
-# pull the image and for `go mod download`; once warm this runs offline
-# until go.mod or go.sum changes.
+# script/lint: run the linter. Linting is a phase of the Dockerfile and
+# this builds that phase alone; the linter is never installed or run on
+# a developer host, where a shared result cache and a host-global lock
+# make its answer untrustworthy.
 #
-# Without a fresh CHECK_EPOCH docker serves the gate layers from cache
-# on an unchanged tree and this exits 0 having run no linter. The PID is
-# in the value because two lint runs land inside the same second easily.
-#
-# The image is never used, so --output=type=cacheonly writes none;
-# without it every run leaves an untagged image behind.
+# The phase is not the last stage in the file, so it is built only when
+# --target names it. A new CACHEBUST value reruns every RUN step, since
+# a cached lint layer is a lint that did not run; unlike --no-cache, it
+# keeps Go's build cache. This relies on every stage of the Dockerfile
+# declaring ARG CACHEBUST first; a stage without that line is served
+# from cache on an unchanged tree, with no warning.
+# --output type=cacheonly writes no image, since nothing uses one.
 set -eu
 
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    docker build \
-        --build-arg CHECK_EPOCH="$(date +%s)-$$" \
-        --output=type=cacheonly \
-        -f Dockerfile.lint \
-        .
+    docker build --build-arg CACHEBUST="$(date +%s)-$$" \
+        --target lint \
+        --output type=cacheonly .
 }
 
 main "$@"

script/precommit

@@ -1,13 +1,13 @@
 #!/bin/sh
 # script/precommit: run by the git pre-commit hook; fails the commit if
-# checks fail. Our own extension to scripts-to-rule-them-all. Go extra:
-# go mod tidy must be a no-op before the checks run.
+# checks fail. Our own extension to scripts-to-rule-them-all.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
 ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
 main() {
+    # Go extra: go mod tidy must be a no-op before the checks run.
     cd "$ROOT"
     go mod tidy
     if ! git diff --exit-code -- go.mod go.sum; then

script/setup

@@ -1,6 +1,6 @@
 #!/bin/sh
 # script/setup: set up the repo for development after a fresh clone:
-# installs dependencies (script/bootstrap) and the git pre-commit hook.
+# installs dependencies and the git pre-commit hook.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"

script/test

@@ -1,17 +1,23 @@
 #!/bin/sh
-# script/test: run the test suite. Reruns verbosely on failure so CI
-# logs show which test failed.
+# script/test: run the test suite. Testing is a phase of the Dockerfile
+# and this builds that phase alone, on the same terms as script/lint:
+# --target because a phase that is not the last stage is built only when
+# named, and a new CACHEBUST value because a cached test layer is a test
+# that did not run; unlike --no-cache, it keeps Go's build cache. This
+# relies on every stage of the Dockerfile declaring ARG CACHEBUST first;
+# a stage without that line is served from cache on an unchanged tree,
+# with no warning. --output type=cacheonly writes no image, since
+# nothing uses one.
 set -eu
 
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    go test -timeout 30s -cover ./... || {
-        echo "--- Rerunning with -v for details ---"
-        go test -timeout 30s -v ./...
-        exit 1
-    }
+    docker build --build-arg CACHEBUST="$(date +%s)-$$" \
+        --target test \
+        --output type=cacheonly .
 }
 
 main "$@"

script/test-race

@@ -1,40 +0,0 @@
-#!/bin/sh
-# script/test-race: run the test suite under the race detector. Not part
-# of script/check.
-#
-# The race detector needs cgo and a C compiler, which the host build
-# never uses, so the tests run in a golang image that has gcc. The
-# checkout is mounted read-only, so the docker daemon must be local. The
-# container starts with empty caches every time: each run downloads the
-# dependencies and compiles them with the detector, which needs the
-# network and takes minutes.
-#
-# The tests run as the calling user, never as root: several of them make
-# a file unreadable and expect reading it to fail, and root reads it
-# anyway. When the caller is root they run as nobody, and then the
-# checkout must be readable by other users. Neither user has a home
-# directory in the image, so HOME is /tmp, where Go puts its build cache.
-set -eu
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-
-# golang:1.25-trixie, 2026-10-04. Debian rather than the Alpine image the
-# Dockerfile builds with, because this one includes gcc.
-IMAGE="golang@sha256:2c4c60ef415fbfa5e90300722293bef36c5e63fae17570ce18f580af933dbd73"
-
-main() {
-    user="$(id -u):$(id -g)"
-    if [ "$(id -u)" -eq 0 ]; then
-        user=65534:65534
-    fi
-    docker run --rm \
-        --user "$user" \
-        --env HOME=/tmp \
-        --env CGO_ENABLED=1 \
-        --volume "$ROOT:/src:ro" \
-        --workdir /src \
-        "$IMAGE" \
-        go test -race -timeout 60s ./...
-}
-
-main "$@"

script/verify-lint-image-pin

@@ -1,77 +0,0 @@
-#!/bin/sh
-# script/verify-lint-image-pin: fail unless the golangci-lint image
-# referenced by Dockerfile.lint and the one referenced by the main
-# Dockerfile's lint stage are the same image at the same digest. Our own
-# extension to scripts-to-rule-them-all, not one of its entrypoints; run
-# as a gate in both files. Nothing else keeps the two pins in sync, and
-# a bump applied to one alone would lint the same tree against different
-# rulesets, both green.
-#
-# Do not hardcode the expected digest here: that is a third copy to keep
-# in sync.
-#
-# A reference that cannot be read is a hard failure, not a skip: two
-# empty strings compare equal.
-set -eu
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-
-LINT_DOCKERFILE="Dockerfile.lint"
-MAIN_DOCKERFILE="Dockerfile"
-
-# Echo the single golangci-lint image reference in the named Dockerfile.
-# Scans every argument of every FROM instruction rather than assuming a
-# field position, so `FROM --platform=... img AS stage` reads correctly.
-# Exits non-zero, with a diagnosis, unless there is exactly one.
-lint_image_ref() {
-    file="$1"
-
-    if [ ! -f "$file" ]; then
-        echo "verify-lint-image-pin: $file: not found" >&2
-        return 1
-    fi
-
-    refs="$(
-        awk '
-            toupper($1) == "FROM" {
-                for (i = 2; i <= NF; i++) {
-                    if ($i ~ /^golangci\/golangci-lint[:@]/) {
-                        print $i
-                    }
-                }
-            }
-        ' "$file"
-    )"
-
-    count="$(printf '%s' "$refs" | grep -c . || true)"
-    if [ "$count" -ne 1 ]; then
-        echo "verify-lint-image-pin: $file: expected exactly one" \
-            "golangci/golangci-lint FROM reference, found $count" >&2
-        return 1
-    fi
-
-    printf '%s\n' "$refs"
-}
-
-main() {
-    cd "$ROOT"
-
-    lint_ref="$(lint_image_ref "$LINT_DOCKERFILE")"
-    main_ref="$(lint_image_ref "$MAIN_DOCKERFILE")"
-
-    if [ "$lint_ref" != "$main_ref" ]; then
-        echo "verify-lint-image-pin: the linter image is pinned twice and" \
-            "the two pins disagree:" >&2
-        echo "verify-lint-image-pin:   $LINT_DOCKERFILE: $lint_ref" >&2
-        echo "verify-lint-image-pin:   $MAIN_DOCKERFILE: $main_ref" >&2
-        echo "verify-lint-image-pin: bump both FROM lines together so" \
-            "script/lint and the Dockerfile lint stage keep running the" \
-            "same linter" >&2
-        exit 1
-    fi
-
-    echo "verify-lint-image-pin: $LINT_DOCKERFILE and $MAIN_DOCKERFILE" \
-        "agree on $lint_ref"
-}
-
-main "$@"

trees.go

@@ -29,10 +29,16 @@ type treeNode struct {
 // the record paths, computes a Merkle-style digest per directory, and
 // prints maximal duplicate-tree groups as TSV on stdout. It never
 // touches the scanned filesystem; its only I/O is the database, stdout,
-// and stderr. Any database problem, including a missing database, is
-// fatal.
+// and stderr. It names the database on stderr before it opens it. Any
+// database problem, including a missing database, is fatal.
 func runTrees(ctx context.Context, stdout io.Writer) error {
-	dbPath := databasePath()
+	dbPath, source, err := databasePath()
+	if err != nil {
+		return err
+	}
+
+	fmt.Fprintf(os.Stderr, "trees: database %s (%s)\n",
+		escapePath(dbPath), source)
 
 	db, err := openReportDatabase(ctx, dbPath)
 	if err != nil {