Reformat all Markdown with prettier

Mechanical result of `make fmt` now that prettier runs over Markdown: README.md and TODO.md rewrapped to the house settings (4-space, proseWrap always). REPO_POLICIES.md was already compliant. No prose was changed by hand in this commit. Model: opus-4-8
Restore Markdown formatting in fmt/fmt-check and pin prettier (closes #19 )
2026-09-21 07:32:12 +00:00 · 2026-09-21 07:31:53 +00:00
19 changed files with 929 additions and 1370 deletions
@@ -2,6 +2,8 @@
 .claude
 .DS_Store
 sfdupes
 files.dat
 node_modules
 *.log
 *.out
 *.test
@@ -27,6 +27,7 @@ node_modules/
 *.log
 # Local scan data
 files.dat
 *.sqlite
 *.sqlite-shm
 *.sqlite-wal
@@ -0,0 +1,2 @@
 node_modules/
 yarn.lock
@@ -0,0 +1,4 @@
 {
    "tabWidth": 4,
    "proseWrap": "always"
 }
@@ -27,9 +27,12 @@ ARG CHECK_EPOCH
 # target now runs `docker build -f Dockerfile.lint`, and a docker build
 # cannot run a docker build: routing the gate through make would mean
 # nesting docker inside this image. Same reason `make check` is gone
-# from the build stage below. `make fmt-check` stays as it is — it is a
+# from the build stage below.
-# gate, not the aggregate, and it shells out to nothing.
+#
-RUN echo "gate fmt-check, epoch ${CHECK_EPOCH}" && make fmt-check
+# `make fmt-check` is not run in this stage: it now also runs prettier
 # over Markdown, and this golangci-lint image has no node. The gate runs
 # in the build stage below, where script/bootstrap installs node and
 # prettier.
 # The FROM above and the one in Dockerfile.lint pin the same linter
 # twice, and nothing else keeps them in sync; this fails the build when
@@ -77,10 +80,12 @@ COPY --from=lint /src/go.sum /dev/null
 # rather than duplicating the installs inline. Only script/ and the
 # dependency manifests are copied first, nothing else, so this layer
 # stays cached until the scripts or the dependencies change — bootstrap
-# ends in `go mod download`, which is why there is no separate
+# runs `go mod download` and `yarn install`, which is why there is no
-# invocation of it here.
+# separate invocation of either here. The JS manifests (package.json,
 # yarn.lock) are copied too so the yarn install layer caches alongside
 # the Go one.
 COPY script/ script/
-COPY go.mod go.sum ./
+COPY go.mod go.sum package.json yarn.lock ./
 RUN script/bootstrap
 COPY . .
@@ -46,4 +46,4 @@ hooks:
 	@script/install-precommit
 clean:
-	rm -f $(BINARY)
+	rm -f $(BINARY) files.dat
@@ -1,449 +1,386 @@
 # Workflow
- take an issue from the `1.0.0` milestone on the tracker; work not
+- take an issue from the `1.0.0` milestone on the tracker; work not yet on the
-  yet on the tracker gets filed as an issue first
+  tracker gets filed as an issue first
 - branch (from `main`)
 - do the work, with tests, in small focused commits
- record it at the top of Completed Steps (`TODO.md` changes in the
+- record it at the top of Completed Steps (`TODO.md` changes in the same commit
-  same commit as the work)
+  as the work)
- push the branch and open a PR whose title ends with
+- push the branch and open a PR whose title ends with ` (closes #N)`
-  ` (closes #N)`
+- an independent review gates the merge; every finding is addressed or
- an independent review gates the merge; every finding is addressed
+  explicitly rebutted on the PR
  or explicitly rebutted on the PR
 - merge to `main` once the review passes
 # Status
 - pre-1.0
- the Gitea tracker is authoritative for the pre-1.0 backlog: the
+- the Gitea tracker is authoritative for the pre-1.0 backlog: the open issues
-  open issues under the `1.0.0` milestone are what remains before
+  under the `1.0.0` milestone are what remains before the tag, and this file
-  the tag, and this file records history and process, not the queue
+  records history and process, not the queue
 # Next Step
 - take the next issue from the `1.0.0` milestone on the tracker:
-  https://git.eeqj.de/sneak/sfdupes/milestone/17 — the milestone is
+  https://git.eeqj.de/sneak/sfdupes/milestone/17 — the milestone is the source
-  the source of truth for what is left before 1.0.0. Individual
+  of truth for what is left before 1.0.0. Individual issues are deliberately not
-  issues are deliberately not restated here; a copy in this file
+  restated here; a copy in this file drifts out of date the moment the tracker
-  drifts out of date the moment the tracker moves
+  moves
 # Completed Steps
- replace the 1 KiB end-window sampling with the head/tail plus
+- restore Markdown formatting in `script/fmt`/`fmt-check` and reformat all
-  content-hash ladder (2026-09-22, branch `next`, closes
+  Markdown to the house prettier settings (2026-09-21, closes
-  https://git.eeqj.de/sneak/sfdupes/issues/61): a file under 10 MiB is
+  https://git.eeqj.de/sneak/sfdupes/issues/19)
  hashed in full and compared directly, with no end-window step — its
  `head`, `tail`, and `content` all hold the whole-file hash. A file at
  10 MiB or above is gated on the 64 KiB `head` and `tail`, then
  compared on a `content` hash — the whole file below 50 MiB,
  gigabyte-spaced 1 MiB samples at or above. Schema bumps to version 2
  (new `content` column); a version 1 database is rejected and must be
  rescanned, which is required anyway since every stored hash changed.
  `report` and `trees` group by the extended signature, so the ladder is
  applied across the whole database. README "Duplicate detection"
  documents every rung including the probabilistic large-file path.
 - remove the dead `files.dat` references from `Makefile`, `.gitignore`
  and `.dockerignore` (2026-09-21, branch `next`, closes
  https://git.eeqj.de/sneak/sfdupes/issues/22)
 - fix the lint-image pin comments and `FROM` form in `Dockerfile` and
  `Dockerfile.lint` (2026-08-10, branch `next`, closes
  https://git.eeqj.de/sneak/sfdupes/issues/25): dropped the false
-  `(Debian-based)` parenthetical (v2.12.1 was Debian too) and the
+  `(Debian-based)` parenthetical (v2.12.1 was Debian too) and the redundant tag,
-  redundant tag, so both pins are the policy `# image:vX.Y.Z,
+  so both pins are the policy `# image:vX.Y.Z, YYYY-MM-DD` comment over a bare
-  YYYY-MM-DD` comment over a bare `FROM image@sha256:...`. Digest
+  `FROM image@sha256:...`. Digest unchanged. `script/verify-lint-image-pin`
-  unchanged. `script/verify-lint-image-pin` parses those `FROM` lines
+  parses those `FROM` lines and still matches the tagless form; its advice line
-  and still matches the tagless form; its advice line lost the now
+  lost the now meaningless "tag and digest". With no tag in either reference, a
-  meaningless "tag and digest". With no tag in either reference, a
+  tag-only disagreement no longer exists — a one-sided tag is caught as a plain
-  tag-only disagreement no longer exists — a one-sided tag is caught as
+  mismatch.
  a plain mismatch.
- run all linting in Docker via `Dockerfile.lint` and `script/lint`
+- run all linting in Docker via `Dockerfile.lint` and `script/lint` (2026-08-10,
-  (2026-08-10, branch `next`, closes
+  branch `next`, closes https://git.eeqj.de/sneak/sfdupes/issues/46): per the
-  https://git.eeqj.de/sneak/sfdupes/issues/46): per the owner ruling, the
+  owner ruling, the linter runs inside a container invoked through the `script/`
-  linter runs inside a container invoked through the `script/`
+  entrypoint and is never installed on a host. New root `Dockerfile.lint` COPYs
-  entrypoint and is never installed on a host. New root
+  the repo into the digest-pinned `golangci/golangci-lint:v2.12.2` image and
-  `Dockerfile.lint` COPYs the repo into the digest-pinned
+  runs `golangci-lint config verify` and `golangci-lint run` as build steps, so
-  `golangci/golangci-lint:v2.12.2` image and runs
+  a successful build IS a clean lint; `script/lint` is reduced to building it.
-  `golangci-lint config verify` and `golangci-lint run` as build
+  `script/bootstrap` loses the `go install`, the pin constants, the version
-  steps, so a successful build IS a clean lint; `script/lint` is
+  parser and `verify_golangci_lint` outright rather than hardening them — with
-  reduced to building it. `script/bootstrap` loses the `go install`,
+  nothing linting on the host, the `$GOPATH/bin` versus `PATH` problem that
-  the pin constants, the version parser and `verify_golangci_lint`
+  motivated them has no subject — and now warns rather than fails when `docker`
-  outright rather than hardening them — with nothing linting on the
+  is absent. Two traps handled. A lint build on an unchanged tree returns
-  host, the `$GOPATH/bin` versus `PATH` problem that motivated them has
+  success in well under a second having run no linter, which is
  no subject — and now warns rather than fails when `docker` is absent.
  Two traps handled. A lint build on an unchanged tree returns success
  in well under a second having run no linter, which is
  https://git.eeqj.de/sneak/sfdupes/issues/32 and
-  https://git.eeqj.de/sneak/sfdupes/issues/39 again, so
+  https://git.eeqj.de/sneak/sfdupes/issues/39 again, so `Dockerfile.lint`
-  `Dockerfile.lint` carries `ARG CHECK_EPOCH` referenced
+  carries `ARG CHECK_EPOCH` referenced inside every gate `RUN` (BuildKit hashes
-  inside every gate `RUN` (BuildKit hashes the expanded command, not
+  the expanded command, not the declaration) and `script/lint` passes
-  the declaration) and `script/lint` passes `"$(date +%s)-$$"` — the
+  `"$(date +%s)-$$"` — the PID matters because two lint runs land inside the
-  PID matters because two lint runs land inside the same second easily.
+  same second easily. And nothing inside an image build may shell out to docker,
-  And nothing inside an image build may shell out to docker, so the
+  so the main `Dockerfile`'s lint stage now invokes `golangci-lint` directly
  main `Dockerfile`'s lint stage now invokes `golangci-lint` directly
  instead of `make lint`, and its build stage runs `make test` and
-  `make fmt-check` instead of the `make check` aggregate (`make`, not
+  `make fmt-check` instead of the `make check` aggregate (`make`, not the
-  the scripts bare, because the Makefile's `export CGO_ENABLED = 0`
+  scripts bare, because the Makefile's `export CGO_ENABLED = 0` only reaches
-  only reaches what it invokes). `COPY --from=lint`
+  what it invokes). `COPY --from=lint` `/usr/bin/golangci-lint` is replaced by
-  `/usr/bin/golangci-lint` is replaced by
+  `COPY --from=lint /src/go.sum /dev/null`: the copied binary was the only edge
-  `COPY --from=lint /src/go.sum /dev/null`: the copied binary was the
+  forcing BuildKit to finish linting before the build stage starts, and dropping
-  only edge forcing BuildKit to finish linting before the build stage
+  it without replacing the edge would have ended fail-fast linting silently
-  starts, and dropping it without replacing the edge would have ended
+  under a still-green build. That is canonical `REPO_POLICIES.md:107`'s ordering
-  fail-fast linting silently under a still-green build. That is
+  edge, restored. `ENV PATH=/home/builder/go/bin:$PATH` is gone with the
-  canonical `REPO_POLICIES.md:107`'s ordering edge, restored.
+  `go install` that justified it. `script/verify-linter-pin` is retired, deleted
-  `ENV PATH=/home/builder/go/bin:$PATH` is gone with the `go install`
+  along with its README entry, because both of its subjects ceased to exist in
-  that justified it. `script/verify-linter-pin` is retired, deleted
+  the same change: it compared a linter binary against `GOLANGCI_LINT_VERSION`
-  along with its README entry, because both of its subjects ceased to
+  in `script/bootstrap`, and there is now neither a binary crossing between
-  exist in the same change: it compared a linter binary against
+  stages nor a version pin in bootstrap. The drift it guarded has not gone away,
-  `GOLANGCI_LINT_VERSION` in `script/bootstrap`, and there is now
+  it has moved — the linter is still pinned twice, now as the `FROM` line of
-  neither a binary crossing between stages nor a version pin in
+  `Dockerfile.lint` and the `FROM` line of the `Dockerfile` lint stage, with
-  bootstrap. The drift it guarded has not gone away, it has moved — the
+  nothing syncing them, which is exactly what
  linter is still pinned twice, now as the `FROM` line of
  `Dockerfile.lint` and the `FROM` line of the `Dockerfile` lint stage,
  with nothing syncing them, which is exactly what
  https://git.eeqj.de/sneak/sfdupes/issues/42 made a build failure. Its
-  replacement is one new `script/verify-lint-image-pin`,
+  replacement is one new `script/verify-lint-image-pin`, run as a gate in both
-  run as a gate in both files, which compares the two references to
+  files, which compares the two references to each other and deliberately
-  each other and deliberately restates neither: a hardcoded expected
+  restates neither: a hardcoded expected digest would be a third copy and the
-  digest would be a third copy and the same drift one file further out.
+  same drift one file further out. `golangci-lint config verify` is included per
-  `golangci-lint config verify` is included per the ruling, and the
+  the ruling, and the concern about its unpinned live HTTPS schema fetch was
-  concern about its unpinned live HTTPS schema fetch was measured
+  measured rather than assumed — under `--network none` the pinned binary both
-  rather than assumed — under `--network none` the pinned binary both
+  passes a valid config and rejects an invalid one with the jsonschema error, so
-  passes a valid config and rejects an invalid one with the jsonschema
+  it validates from an embedded schema and makes no network call of its own. The
-  error, so it validates from an embedded schema and makes no network
+  README scopes that to the gate steps rather than to linting as a whole:
-  call of its own. The README scopes that to the gate steps rather
+  `Dockerfile.lint` runs `go mod download` above them, so a cold cache still
-  than to linting as a whole: `Dockerfile.lint` runs `go mod download`
+  needs the network and only a warm one lints offline. Verified: `make lint`
-  above them, so a cold cache still needs the network and only a warm
+  green with every `PATH` directory containing a `golangci-lint` removed
  one lints offline. Verified: `make lint` green with every `PATH`
  directory containing a `golangci-lint` removed
  (`/home/user/go/bin`, `/home/user/.local/bin`, `/usr/local/bin`;
-  `command -v golangci-lint` empty); two consecutive `script/lint` runs
+  `command -v golangci-lint` empty); two consecutive `script/lint` runs on an
-  on an untouched tree both executed the linter, 27.7s and 28.7s in the
+  untouched tree both executed the linter, 27.7s and 28.7s in the lint step
-  lint step under distinct epochs with the `COPY . .` layer `CACHED`
+  under distinct epochs with the `COPY . .` layer `CACHED` above them, at 42.2s
-  above them, at 42.2s and 41.8s wall clock — the no-cache rule was not
+  and 41.8s wall clock — the no-cache rule was not weakened to shorten that.
-  weakened to shorten that. Negative control: a planted
+  Negative control: a planted `var unusedIssue46Sentinel = 1` failed
-  `var unusedIssue46Sentinel = 1` failed `script/lint` with
+  `script/lint` with
-  `report.go:173:5: var unusedIssue46Sentinel is unused (unused)`, and
+  `report.go:173:5: var unusedIssue46Sentinel is unused (unused)`, and failed
-  failed `make docker` at `[lint 9/9]` with the build stage stopped at
+  `make docker` at `[lint 9/9]` with the build stage stopped at `[builder 3/12]`
-  `[builder 3/12]` — `COPY --from=lint`, `script/bootstrap`, the test
+  — `COPY --from=lint`, `script/bootstrap`, the test gate and `make build` all
-  gate and `make build` all zero occurrences — then reverted clean. The
+  zero occurrences — then reverted clean. The drift guard fails on a tag-only
-  drift guard fails on a tag-only disagreement, on a digest-only
+  disagreement, on a digest-only disagreement, and on an unreadable reference,
-  disagreement, and on an unreadable reference, naming both sides.
+  naming both sides. `make docker` green in 5m35s with all six gates executing
-  `make docker` green in 5m35s with all six gates executing under one
+  under one epoch (lint 37.6s, test 25.2s reporting
-  epoch (lint 37.6s, test 25.2s reporting
+  `ok sneak.berlin/go/sfdupes 1.938s coverage: 88.5%`, not `(cached)`). The
-  `ok sneak.berlin/go/sfdupes 1.938s coverage: 88.5%`, not `(cached)`).
+  non-root quirk still holds: in the builder image with the Go test cache off,
-  The non-root quirk still holds: in the builder image with the Go test
+  `--user 0:0` fails `TestScanHardlinkRunFailsTogether` (exit 1) where the
-  cache off, `--user 0:0` fails `TestScanHardlinkRunFailsTogether`
+  unprivileged user passes (exit 0). Noted for follow-up, not fixed here:
-  (exit 1) where the unprivileged user passes (exit 0). Noted for
+  `golangci-lint` warns that the `gomodguard` linter is deprecated since v2.12.0
-  follow-up, not fixed here: `golangci-lint` warns that the
+  in favour of `gomodguard_v2`.
  `gomodguard` linter is deprecated since v2.12.0 in favour of
  `gomodguard_v2`.
- install the Docker build stage's prerequisites by running
+- install the Docker build stage's prerequisites by running `script/bootstrap`
-  `script/bootstrap` instead of `apk add --no-cache make` inline
+  instead of `apk add --no-cache make` inline (2026-08-09, branch
-  (2026-08-09, branch `dockerfile-bootstrap`, closes #42): canonical
+  `dockerfile-bootstrap`, closes #42): canonical `REPO_POLICIES.md:97` requires
-  `REPO_POLICIES.md:97` requires it, and the inline install left the
+  it, and the inline install left the build stage maintaining its own notion of
-  build stage maintaining its own notion of the toolchain — exactly
+  the toolchain — exactly the divergence #24 exists to close, one layer down.
-  the divergence #24 exists to close, one layer down. The stage now
+  The stage now copies `script/` plus `go.mod`/`go.sum` and runs
-  copies `script/` plus `go.mod`/`go.sum` and runs `script/bootstrap`,
+  `script/bootstrap`, which ends in `go mod download`, so the separate
-  which ends in `go mod download`, so the separate invocation of that
+  invocation of that is gone. `COPY --from=lint /usr/bin/golangci-lint` stays,
-  is gone. `COPY --from=lint /usr/bin/golangci-lint` stays, and moves
+  and moves above the bootstrap layer. It is the only edge making this stage
-  above the bootstrap layer. It is the only edge making this stage
+  depend on the lint stage, so deleting it as redundant would end fail-fast
-  depend on the lint stage, so deleting it as redundant would end
+  linting silently. Letting bootstrap install its own linter here would have
-  fail-fast linting silently. Letting bootstrap install its own linter
+  reintroduced the second toolchain and paid for a from-source build of it. What
-  here would have reintroduced the second toolchain and paid for a
+  makes the two stages provably one toolchain rather than two that happen to
-  from-source build of it. What makes the two stages provably one
+  agree is a new `script/verify-linter-pin`, run in the build stage on the
-  toolchain rather than two that happen to agree is a new
+  binary that arrives from the lint stage, before bootstrap: it fails the build
-  `script/verify-linter-pin`, run in the build stage on the binary
+  naming both versions unless that binary is the version `script/bootstrap`
-  that arrives from the lint stage, before bootstrap: it fails the
+  pins. Bootstrap's own check could not serve that purpose — it reinstalls its
-  build naming both versions unless that binary is the version
+  pin from source and then verifies whatever `PATH` resolves, so drift
-  `script/bootstrap` pins. Bootstrap's own check could not serve that
+  self-heals silently and a lint stage image bumped on its own would lint at the
-  purpose — it reinstalls its pin from source and then verifies
+  new version while `make check` ran at the old one, green. The linter version
-  whatever `PATH` resolves, so drift self-heals silently and a lint
+  is pinned in two independent places (the lint stage image digest and
  stage image bumped on its own would lint at the new version while
  `make check` ran at the old one, green. The linter version is pinned
  in two independent places (the lint stage image digest and
  `GOLANGCI_LINT_VERSION`) and nothing else keeps them in sync, so a
  half-applied bump is now a build failure. The pin is read out of
-  `script/bootstrap`, which stays the single source of truth; a pin
+  `script/bootstrap`, which stays the single source of truth; a pin that cannot
-  that cannot be read is a hard failure, not a skip. The check needs
+  be read is a hard failure, not a skip. The check needs no `CHECK_EPOCH`: its
-  no `CHECK_EPOCH`: its only inputs are the copied binary and
+  only inputs are the copied binary and `script/`, so Docker invalidates the
-  `script/`, so Docker invalidates the layer exactly when a cached
+  layer exactly when a cached result would stop being true, and it is documented
-  result would stop being true, and it is documented with the other
+  with the other entrypoints in the README. `$GOPATH/bin` joins `PATH` because
-  entrypoints in the README. `$GOPATH/bin` joins `PATH` because
+  that is where bootstrap's `go install` lands and bootstrap verifies its
-  that is where bootstrap's `go install` lands and bootstrap verifies
+  installs against what `PATH` resolves — nothing in the image is shadowed by
-  its installs against what `PATH` resolves — nothing in the image is
+  it, the directory does not exist until bootstrap runs. Everything added sits
-  shadowed by it, the directory does not exist until bootstrap runs.
+  above `ARG CHECK_EPOCH`, and the `chown` and `USER builder` still precede
-  Everything added sits above `ARG CHECK_EPOCH`, and the `chown` and
+  `make check`. Verified: the guard fails the build with both versions named
-  `USER builder` still precede `make check`. Verified: the guard fails
+  when the lint stage's linter is faked to a different version, and an
-  the build with both versions named when the lint stage's linter is
+  unmodified build still passes it; bootstrap runs clean under Alpine's `sh` and
-  faked to a different version, and an unmodified build still passes
+  its `apk` branch, installing `git` and `make` and finding the copied linter
-  it; bootstrap runs clean under Alpine's `sh` and its `apk` branch,
+  already at the pin; a second build served the bootstrap and dependency layers
-  installing `git` and `make` and finding the copied
+  `CACHED` while both gates ran with a fresh epoch; a planted `unused` finding
-  linter already at the pin; a second build served the bootstrap and
+  failed the build at the lint gate in 48.9s with the build stage's `make check`
-  dependency layers `CACHED` while both gates ran with a fresh epoch;
+  never starting; and the suite run in the image as `--user 0:0` fails
-  a planted `unused` finding failed the build at the lint gate in
+  `TestScanHardlinkRunFailsTogether`, so the drop to the unprivileged user is
-  48.9s with the build stage's `make check` never starting; and the
+  still load-bearing. That last check needs the Go test cache disabled — the
-  suite run in the image as `--user 0:0` fails
+  first attempt reported `ok ... (cached)` as root, reusing the result the
-  `TestScanHardlinkRunFailsTogether`, so the drop to the unprivileged
+  build-time run had left in the shared cache, which would have read as a pass.
-  user is still load-bearing. That last check needs the Go test cache
+  Build wall time, on a shared host running many concurrent builds and so noisy:
-  disabled — the first attempt reported `ok ... (cached)` as root,
+  2m13s on an unchanged tree, 2m17s and 4m29s for two builds after a source
-  reusing the result the build-time run had left in the shared cache,
+  change, 5m14s cold. Only the cold one breaches the policy ceiling, and not
-  which would have read as a pass. Build wall time, on a shared host
+  because of this change — `chown -R builder:builder /src /home/builder` walks
-  running many concurrent builds and so noisy: 2m13s on an unchanged
+  the module cache and re-runs on every source change, and it alone varied
-  tree, 2m17s and 4m29s for two builds after a source change, 5m14s
+  between 77s and 210s across those four builds, which is also the whole spread
-  cold. Only the cold one breaches the policy ceiling, and not because
+  in the totals. The same cold measurement against `main` is 5m03s with a 209s
-  of this change — `chown -R builder:builder /src /home/builder` walks
+  `chown`. Filed as #43
-  the module cache and re-runs on every source change, and it alone
+- bust the Docker layer cache for the gate steps, so `script/cibuild` and
-  varied between 77s and 210s across those four builds, which is also
+  `script/docker` cannot report a green they did not earn (2026-08-09, branch
-  the whole spread in the totals. The same cold measurement against
+  `cibuild-cache-bust`, closes #32): both scripts were bare `docker build`
-  `main` is 5m03s with a 209s `chown`. Filed as #43
+  invocations with no cache control, and the `Dockerfile` copies the tree before
- bust the Docker layer cache for the gate steps, so `script/cibuild`
+  running its gates, so on an unchanged tree Docker served those layers from
-  and `script/docker` cannot report a green they did not earn
+  cache and the build exited 0 having executed nothing. That is not hypothetical
-  (2026-08-09, branch `cibuild-cache-bust`, closes #32): both scripts
+  here — every merge this repo has done is a non-fast-forward merge of an
-  were bare `docker build` invocations with no cache control, and the
+  undiverged branch, so each merge commit's tree is byte-identical to the branch
-  `Dockerfile` copies the tree before running its gates, so on an
+  head's and each merge CI run was almost certainly a full cache hit; and PR
-  unchanged tree Docker served those layers from cache and the build
+  #31's reviewer found `make docker` returning success as a 17-layer cache hit,
-  exited 0 having executed nothing. That is not hypothetical here —
+  catching it only by being suspicious. The fix is `ARG CHECK_EPOCH` with the
-  every merge this repo has done is a non-fast-forward merge of an
+  scripts passing `--build-arg CHECK_EPOCH="$(date +%s)"`. Two details make or
-  undiverged branch, so each merge commit's tree is byte-identical to
+  break it. `ARG` is scoped per stage and this `Dockerfile` has three gates
-  the branch head's and each merge CI run was almost certainly a full
+  across two — `make fmt-check` and `make lint` in the lint stage, `make check`
-  cache hit; and PR #31's reviewer found `make docker` returning
+  in the build stage — so a single declaration would have left one stage
-  success as a 17-layer cache hit, catching it only by being
+  silently cacheable; it is declared in both. And BuildKit hashes the expanded
-  suspicious. The fix is `ARG CHECK_EPOCH` with the scripts passing
+  command, not the declaration, so a declared-but-unreferenced `ARG` invalidates
-  `--build-arg CHECK_EPOCH="$(date +%s)"`. Two details make or break
+  nothing: each gate `RUN` echoes the epoch, which also puts the value in the
-  it. `ARG` is scoped per stage and this `Dockerfile` has three gates
+  build log as evidence the layer really ran. Placement is below the dependency
-  across two — `make fmt-check` and `make lint` in the lint stage,
+  layers on purpose — a build that goes cold every time would be a different
-  `make check` in the build stage — so a single declaration would have
+  bug, not a fix. Verified by running each script twice back to back on an
-  left one stage silently cacheable; it is declared in both. And
+  unchanged tree under `BUILDKIT_PROGRESS=plain`: all three gates executed on
-  BuildKit hashes the expanded command, not the declaration, so a
+  all four runs, each with a fresh epoch in the log (`script/cibuild` 78.8s then
-  declared-but-unreferenced `ARG` invalidates nothing: each gate `RUN`
+  61.1s; `script/docker` 61.1s then 53.4s), and twelve steps were still served
-  echoes the epoch, which also puts the value in the build log as
+  `CACHED` in the steady state — both `go mod download`s, `apk add`, `adduser`,
-  evidence the layer really ran. Placement is below the dependency
+  the `chown`, every `go.mod`/`go.sum` and source copy, the linter copy out of
-  layers on purpose — a build that goes cold every time would be a
+  the lint stage, and the binary copy into the runtime stage. The lint stage
-  different bug, not a fix. Verified by running each script twice back
+  still gates the build stage: with a deliberate `unused` finding planted in the
-  to back on an unchanged tree under `BUILDKIT_PROGRESS=plain`: all
+  tree, the build failed at `make lint` in 36.1s and the build-stage
-  three gates executed on all four runs, each with a fresh epoch in
+  `make check` never started. The build stage also still drops to the
-  the log (`script/cibuild` 78.8s then 61.1s; `script/docker` 61.1s
+  unprivileged `builder` user before `make check`, which the suite depends on
-  then 53.4s), and twelve steps were still served `CACHED` in the
+  rather than merely prefers: forcing the same image to run the tests as root
-  steady state — both `go mod download`s, `apk add`, `adduser`, the
+  fails `TestScanHardlinkRunFailsTogether`, because root reads straight through
-  `chown`, every `go.mod`/`go.sum` and source copy, the linter copy
+  the `chmod(0)` the test uses to prove hard links are read once. This is the
-  out of the lint stage, and the binary copy into the runtime stage.
+  local fix only; propagating it to the canonical templates is `prompts` #26
-  The lint stage still gates the build stage: with a deliberate
+- check the installed golangci-lint version in `script/bootstrap` instead of
-  `unused` finding planted in the tree, the build failed at
+  only its presence (2026-08-09, branch `bootstrap-version-check`, closes #24):
-  `make lint` in 36.1s and the build-stage `make check` never started.
+  `missing golangci-lint` meant any linter already on `PATH` satisfied the
-  The build stage also still drops to the unprivileged `builder` user
+  check, so the pin was never consulted and the v2.12.2 bump from #3 was inert
-  before `make check`, which the suite depends on rather than merely
+  on every host that already had one — this host ran v2.10.1 against a v2.12.2
-  prefers: forcing the same image to run the tests as root fails
+  pin, `make check` went green, and `make docker` then rejected the same commit
-  `TestScanHardlinkRunFailsTogether`, because root reads straight
+  with findings the local gate never saw. The version now lives in one place,
-  through the `chmod(0)` the test uses to prove hard links are read
+  `GOLANGCI_LINT_VERSION`, with the `go install` module ref derived from it so a
-  once. This is the local fix only; propagating it to the canonical
+  bump cannot half-apply; a `golangci_lint_version` helper parses
-  templates is `prompts` #26
+  `golangci-lint --version` (taking the field after the word `version` and
- check the installed golangci-lint version in `script/bootstrap`
+  tolerating an optional leading `v`, which the module ref carries and the
-  instead of only its presence (2026-08-09, branch
+  binary's output does not), and any version that is not the pin — older, newer,
-  `bootstrap-version-check`, closes #24): `missing golangci-lint` meant
+  absent or unparseable — is reinstalled. The install is then verified against
-  any linter already on `PATH` satisfied the check, so the pin was never
+  the binary `PATH` actually resolves: `go install` writes into `GOBIN` (or
-  consulted and the v2.12.2 bump from #3 was inert on every host that
+  `GOPATH/bin`) while `make lint` runs whichever `golangci-lint` comes first on
-  already had one — this host ran v2.10.1 against a v2.12.2 pin,
+  `PATH`, so a wrong-version one sitting ahead of it — nix, apt, brew, apk, or
-  `make check` went green, and `make docker` then rejected the same
+  the `/usr/local/bin` copy the `Dockerfile` builder stage makes — would swallow
-  commit with findings the local gate never saw. The version now lives
+  the install and leave the local gate disagreeing with CI under an affirmative
-  in one place, `GOLANGCI_LINT_VERSION`, with the `go install` module
+  `bootstrap complete`. Bootstrap now re-reads the effective version after
-  ref derived from it so a bump cannot half-apply; a
+  installing and, on a mismatch, prints both paths and both versions to stderr
-  `golangci_lint_version` helper parses `golangci-lint --version`
+  and exits non-zero instead of claiming success; it does not reorder anyone's
  (taking the field after the word `version` and tolerating an optional
  leading `v`, which the module ref carries and the binary's output does
  not), and any version that is not the pin — older, newer, absent or
  unparseable — is reinstalled. The install is then verified against the
  binary `PATH` actually resolves: `go install` writes into `GOBIN` (or
  `GOPATH/bin`) while `make lint` runs whichever `golangci-lint` comes
  first on `PATH`, so a wrong-version one sitting ahead of it — nix,
  apt, brew, apk, or the `/usr/local/bin` copy the `Dockerfile` builder
  stage makes — would swallow the install and leave the local gate
  disagreeing with CI under an affirmative `bootstrap complete`.
  Bootstrap now re-reads the effective version after installing and, on
  a mismatch, prints both paths and both versions to stderr and exits
  non-zero instead of claiming success; it does not reorder anyone's
  `PATH` or delete their binary. The `--version` call keeps its stderr
-  connected, so a present-but-broken binary says why rather than
+  connected, so a present-but-broken binary says why rather than reinstalling
-  reinstalling forever in silence, and is bounded by `timeout(1)` where
+  forever in silence, and is bounded by `timeout(1)` where that exists, so a
-  that exists, so a wedged binary cannot hang bootstrap. `git`, `make`
+  wedged binary cannot hang bootstrap. `git`, `make` and `go` keep their
-  and `go` keep their presence-only checks and now say why in a
+  presence-only checks and now say why in a comment: they are host
-  comment: they are host package-manager tools the repo deliberately
+  package-manager tools the repo deliberately does not pin, with `go.mod`
-  does not pin, with `go.mod` governing the language version and the
+  governing the language version and the digest-pinned images covering
-  digest-pinned images covering reproducible builds. Verified on this
+  reproducible builds. Verified on this host by bootstrapping from v2.10.1 to
-  host by bootstrapping from v2.10.1 to v2.12.2 and running it again to
+  v2.12.2 and running it again to a no-op, plus stub runs of the real script
-  a no-op, plus stub runs of the real script under `dash` covering a
+  under `dash` covering a thirteen-input parse matrix (absent, older, newer,
-  thirteen-input parse matrix (absent, older, newer, host-style,
+  host-style, image-style, leading-`v`, stderr-only, empty, non-zero exit,
-  image-style, leading-`v`, stderr-only, empty, non-zero exit, impostor
+  impostor binary, `(devel)`, trailing `version`), a shadowed install that must
-  binary, `(devel)`, trailing `version`), a shadowed install that must
+  exit non-zero, an install destination not on `PATH` at all, `GOBIN` set, and a
-  exit non-zero, an install destination not on `PATH` at all, `GOBIN`
+  wedged binary that must hit the timeout; `make check` and `make lint` are
-  set, and a wedged binary that must hit the timeout; `make check` and
+  clean at v2.12.2, so v2.10.1 was not hiding any findings on `main`
  `make lint` are clean at v2.12.2, so v2.10.1 was not hiding any
  findings on `main`
 - unwind the hash worker pool on the error path (2026-08-09, branch
-  `hash-pool-cleanup`, closes #6): `hashPhase` used to return the
+  `hash-pool-cleanup`, closes #6): `hashPhase` used to return the moment
-  moment `recordRun` failed and abandon the pool — the feeder parked
+  `recordRun` failed and abandon the pool — the feeder parked forever on a full
-  forever on a full `jobs` channel and every worker on a full
+  `jobs` channel and every worker on a full `results` channel. That only stopped
-  `results` channel. That only stopped being invisible when #4 landed
+  being invisible when #4 landed and `runScan` began unwinding instead of
-  and `runScan` began unwinding instead of calling `os.Exit`. The
+  calling `os.Exit`. The pool is now an owned, context-aware `hashPool`: every
-  pool is now an owned, context-aware `hashPool`: every blocking send
+  blocking send in the feeder and the workers selects on `ctx.Done()`, `jobs` is
-  in the feeder and the workers selects on `ctx.Done()`, `jobs` is
+  closed on every path out, and `hashPhase` defers `pool.stop()`, which cancels
-  closed on every path out, and `hashPhase` defers `pool.stop()`,
+  and then drains `results` until the last goroutine has exited — draining is
-  which cancels and then drains `results` until the last goroutine
+  what frees a worker already parked on a send. `ctx` is threaded from
-  has exited — draining is what frees a worker already parked on a
+  `cmd.Context()` through `runScan`, `syncScan`, both worker pools and the whole
-  send. `ctx` is threaded from `cmd.Context()` through `runScan`,
+  database layer (it is the first parameter everywhere), so #5 can hand this
-  `syncScan`, both worker pools and the whole database layer (it is
+  path a signal and needs to add nothing else. The walk pool never leaked,
-  the first parameter everywhere), so #5 can hand this path a signal
+  because `walkPhase` always drains its events to close, but it has the same
-  and needs to add nothing else. The walk pool never leaked, because
+  unbounded-send shape and #5 will give it an early return, so it gets the same
-  `walkPhase` always drains its events to close, but it has the same
+  treatment plus a `ctx.Err()` guard after the walk: a cancelled walk yields a
-  unbounded-send shape and #5 will give it an early return, so it
+  partial size census, and every file it never reached looks vanished to the
-  gets the same treatment plus a `ctx.Err()` guard after the walk: a
+  update phase. That phase's own `BeginTx` fails on the same cancelled context
-  cancelled walk yields a partial size census, and every file it never
+  before deleting anything, so the guard is defence in depth rather than the
-  reached looks vanished to the update phase. That phase's own
+  only barrier — but it is the one that survives #5 deciding an interrupted scan
-  `BeginTx` fails on the same cancelled context before deleting
+  may commit what it has. Tests drive `run(scan)` against a database whose
-  anything, so the guard is defence in depth rather than the only
+  insert trigger aborts, and assert both that the scan fails instead of hanging
-  barrier — but it is the one that survives #5 deciding an interrupted
+  and that `runtime.NumGoroutine()` polls back to its pre-scan baseline; a
-  scan may commit what it has. Tests drive `run(scan)` against a
+  second set cancels a scan part-way through the walk — deterministically, by
-  database whose insert trigger aborts, and assert both that the scan
+  counting the scan's own consultations of `ctx.Done()` rather than racing a
-  fails instead of hanging and that `runtime.NumGoroutine()` polls
+  timer — and asserts that it stops at the guard holding a partial census and a
-  back to its pre-scan baseline; a second set cancels a scan part-way
+  still-populated record index, with every record intact. The remaining
-  through the walk — deterministically, by counting the scan's own
+  cancellation branches of both pools are covered by direct tests of
-  consultations of `ctx.Done()` rather than racing a timer — and
+  `sendEvent`, the walk workers, `dispatchDirs`, `feedHashJobs`, `hashWorker`
-  asserts that it stops at the guard holding a partial census and a
+  and `hashPhase`
-  still-populated record index, with every record intact. The
+- guarantee the database is closed on every fatal exit path (2026-08-09, branch
-  remaining cancellation branches of both pools are covered by direct
+  `db-close-on-fatal`, closes #4): `fatalf` and its `os.Exit(1)` are gone, so
-  tests of `sendEvent`, the walk workers, `dispatchDirs`,
+  the deferred `db.Close()` — and with it the SQLite WAL checkpoint — now
-  `feedHashJobs`, `hashWorker` and `hashPhase`
+  actually runs when a subcommand fails; `runScan`, `runReport`, `runTrees`,
- guarantee the database is closed on every fatal exit path
+  `loadRecords` and `resolveRoots` return errors instead. The single exit point
-  (2026-08-09, branch `db-close-on-fatal`, closes #4): `fatalf` and
+  is `run` in `main.go`: it maps a `fatalError` (anything a subcommand returned)
-  its `os.Exit(1)` are gone, so the deferred `db.Close()` — and with
+  to exit 1 and cobra's own argument and flag errors to exit 2, which keeps a
-  it the SQLite WAL checkpoint — now actually runs when a subcommand
+  runtime failure from being reported as a usage error or printing the usage
-  fails; `runScan`, `runReport`, `runTrees`, `loadRecords` and
+  text. New `main_test.go` drives the CLI in-process and asserts the exit codes
-  `resolveRoots` return errors instead. The single exit point is `run`
+  from README §Error handling plus the stdout/stderr split, including that a
-  in `main.go`: it maps a `fatalError` (anything a subcommand
+  fatal error raised after the database is open leaves no `-wal`/`-shm` sidecar
-  returned) to exit 1 and cobra's own argument and flag errors to exit
+  behind for `scan`, `report` or `trees`
-  2, which keeps a runtime failure from being reported as a usage
+- update golangci-lint to v2.12.2 with the canonical config (2026-08-09, branch
-  error or printing the usage text. New `main_test.go` drives the CLI
+  `golangci-v2.12.2`, merged as `38a01bd`, closes #3): bumped the pinned linter
-  in-process and asserts the exit codes from README §Error handling
+  in the `Dockerfile` lint stage and `script/bootstrap` from v2.12.1 to v2.12.2,
-  plus the stdout/stderr split, including that a fatal error raised
+  and replaced `.golangci.yml` with the canonical file — the linter settings
  after the database is open leaves no `-wal`/`-shm` sidecar behind
  for `scan`, `report` or `trees`
 - update golangci-lint to v2.12.2 with the canonical config
  (2026-08-09, branch `golangci-v2.12.2`, merged as `38a01bd`,
  closes #3): bumped the pinned linter in the `Dockerfile` lint
  stage and `script/bootstrap` from v2.12.1 to v2.12.2, and replaced
  `.golangci.yml` with the canonical file — the linter settings
  (`lll`, `funlen`, `cyclop`, `dupl` thresholds) now live under
-  `linters.settings` per the v2 schema, so they are actually
+  `linters.settings` per the v2 schema, so they are actually applied; no new
-  applied; no new lint findings surfaced
+  lint findings surfaced
- convert Makefile targets to scripts-to-rule-them-all `script/`
+- convert Makefile targets to scripts-to-rule-them-all `script/` entrypoints
-  entrypoints like the other managed repos (2026-07-26, commit
+  like the other managed repos (2026-07-26, commit `3abeacf`, closes #1): all 12
-  `3abeacf`, closes #1): all 12 `script/` entrypoints exist
+  `script/` entrypoints exist (`bootstrap`, `setup`, `projectname`, `test`,
-  (`bootstrap`, `setup`, `projectname`, `test`, `lint`, `fmt`,
+  `lint`, `fmt`, `fmt-check`, `check`, `docker`, `cibuild`, `precommit`,
-  `fmt-check`, `check`, `docker`, `cibuild`, `precommit`,
+  `install-precommit`) and every Makefile target is now a thin shim over them,
-  `install-precommit`) and every Makefile target is now a thin shim
+  matching the other managed repos
  over them, matching the other managed repos
 - make the binary the default Make target (2026-07-24, branch
-  `make-default-target`): plain `make` now builds `sfdupes`
+  `make-default-target`): plain `make` now builds `sfdupes` (previously it ran
-  (previously it ran `check` plus `build`); `make build` remains as
+  `check` plus `build`); `make build` remains as an alias
-  an alias
+- scan-wide phases, concurrent operands, batched updates (2026-07-24, branch
- scan-wide phases, concurrent operands, batched updates (2026-07-24,
+  `scan-wide-phases`): all operands seed the shared walk pool and every pass
-  branch `scan-wide-phases`): all operands seed the shared walk pool
+  runs once over the whole scan, so totals and ETAs are scan-global; the
-  and every pass runs once over the whole scan, so totals and ETAs
+  per-operand walk/hash/update cycles and their stderr announcements are gone;
-  are scan-global; the per-operand walk/hash/update cycles and their
+  the update pass commits in batched transactions — the filesystem is
-  stderr announcements are gone; the update pass commits in batched
+  authoritative and the database an eventually-consistent reflection, so
-  transactions — the filesystem is authoritative and the database an
+  scan-level atomicity is not required
  eventually-consistent reflection, so scan-level atomicity is not
  required
 - split the stat pass back out of the walk (2026-07-24, branch
-  `parallel-phases`): phases are strictly sequential again — walk,
+  `parallel-phases`): phases are strictly sequential again — walk, stat, hash,
-  stat, hash, update per operand — with parallelism only inside each
+  update per operand — with parallelism only inside each phase; the walk
-  phase; the walk enumerates paths with per-directory workers and the
+  enumerates paths with per-directory workers and the stat pass lstats them with
-  stat pass lstats them with per-file workers, restoring the exact
+  per-file workers, restoring the exact total/ETA stat bar
-  total/ETA stat bar
+- announce each operand on stderr before its passes (2026-07-24, branch
- announce each operand on stderr before its passes (2026-07-24,
+  `scan-operand-progress`): with per-operand walk/hash/update cycles, a
-  branch `scan-operand-progress`): with per-operand walk/hash/update
+  multi-operand run (e.g. `scan /srv/*`) showed pass totals that looked like the
-  cycles, a multi-operand run (e.g. `scan /srv/*`) showed pass totals
+  whole run's — an operator watching operand 3 of 14 hash 300k files concluded
-  that looked like the whole run's — an operator watching operand 3 of
+  20M files were being skipped
-  14 hash 300k files concluded 20M files were being skipped
+- parallel walk (2026-07-24, branch `parallel-walk`): the walk pass was a single
- parallel walk (2026-07-24, branch `parallel-walk`): the walk pass
+  goroutine and took hours at ~20M files on a busy pool (observed: 22M files in
-  was a single goroutine and took hours at ~20M files on a busy pool
+  4h on a ZFS server); it is now a per-directory worker-pool traversal that
-  (observed: 22M files in 4h on a ZFS server); it is now a
+  records size/mtime during the walk (folding away the separate stat pass,
-  per-directory worker-pool traversal that records size/mtime during
+  halving metadata I/O), and each `PATH` operand commits in its own transaction
-  the walk (folding away the separate stat pass, halving metadata
+  so an interrupted scan keeps completed operands
  I/O), and each `PATH` operand commits in its own transaction so an
  interrupted scan keeps completed operands
- persistent scan database (2026-07-24, branch `persistent-database`):
+- persistent scan database (2026-07-24, branch `persistent-database`): `scan`
-  `scan` now maintains a SQLite database (`modernc.org/sqlite`, pure
+  now maintains a SQLite database (`modernc.org/sqlite`, pure Go, cgo stays
-  Go, cgo stays disabled) keyed by absolute path that survives between
+  disabled) keyed by absolute path that survives between runs — a rescan hashes
-  runs — a rescan hashes only new or changed files (by mtime/size),
+  only new or changed files (by mtime/size), deletes records for files vanished
-  deletes records for files vanished from under the scanned operands,
+  from under the scanned operands, and leaves records outside them untouched, so
-  and leaves records outside them untouched, so `scan` can be cronned
+  `scan` can be cronned daily; `report` and `trees` read the database (no
-  daily; `report` and `trees` read the database (no positional
+  positional arguments) instead of a scan stream. Database at
-  arguments) instead of a scan stream. Database at
+  `/var/lib/sfdupes/db.sqlite`, overridable via `SFDUPES_DATABASE`; WAL
-  `/var/lib/sfdupes/db.sqlite`, overridable via `SFDUPES_DATABASE`;
+  journaling plus a single-transaction update keep a report run during a scan
-  WAL journaling plus a single-transaction update keep a report run
+  safe
-  during a scan safe
+- add the `origin` remote (`git@git.eeqj.de:sneak/sfdupes.git`), tag `v0.0.1`,
- add the `origin` remote (`git@git.eeqj.de:sneak/sfdupes.git`), tag
+  and push `main` plus tags (2026-07-23)
  `v0.0.1`, and push `main` plus tags (2026-07-23)
 - `scan` CLI rework (2026-07-23, branch `scan-required-paths`): required
-  `PATH...` operands via cobra flags replacing the `/srv` `-root`
+  `PATH...` operands via cobra flags replacing the `/srv` `-root` default; new
-  default; new `-x`/`--one-file-system` flag (GNU convention) to stop
+  `-x`/`--one-file-system` flag (GNU convention) to stop at filesystem
-  at filesystem boundaries, which are crossed by default
+  boundaries, which are crossed by default
 - bring the repo into full policy compliance (2026-07-23, branch
  `repo-policy-compliance`; checklist below)
- `git init` with README-only first commit; code baseline committed on
+- `git init` with README-only first commit; code baseline committed on `main`
-  `main` (2026-07-22)
+  (2026-07-22)
 - implement `scan`, `report`, and `trees` subcommands (pre-git history)
 # Future Steps
- possible later features (explicitly out of scope per README):
+- possible later features (explicitly out of scope per README): full-content
-  full-content verification of candidates, removal-script helpers
+  verification of candidates, removal-script helpers
 # Repo Policy Compliance
-Audited 2026-07-22 against `REPO_POLICIES.md` (2026-07-06), the existing
+Audited 2026-07-22 against `REPO_POLICIES.md` (2026-07-06), the existing repo
-repo checklist, and the Go styleguide. Code is already gofmt-clean, so no
+checklist, and the Go styleguide. Code is already gofmt-clean, so no standalone
-standalone formatting commit is needed.
+formatting commit is needed.
- [x] `.gitignore` missing — the compiled `sfdupes` binary and
+- [x] `.gitignore` missing — the compiled `sfdupes` binary and `files.dat` sit
-      `files.dat` sit untracked in the tree; needs OS/editor/Go
+      untracked in the tree; needs OS/editor/Go artifacts plus secrets patterns
      artifacts plus secrets patterns
 - [x] `.editorconfig` missing
- [x] `LICENSE` missing and README has no License section (MIT assumed
+- [x] `LICENSE` missing and README has no License section (MIT assumed from
-      from house convention — user to confirm)
+      house convention — user to confirm)
 - [x] `REPO_POLICIES.md` missing from repo root
- [x] `.golangci.yml` missing (install canonical copy); code must then
+- [x] `.golangci.yml` missing (install canonical copy); code must then pass
-      pass `make lint` (150 findings fixed; `make lint` is clean)
+      `make lint` (150 findings fixed; `make lint` is clean)
- [x] `Makefile` lacks required targets `test`, `lint`, `fmt`,
+- [x] `Makefile` lacks required targets `test`, `lint`, `fmt`, `fmt-check`,
-      `fmt-check`, `docker`, `hooks`; `check` currently depends on
+      `docker`, `hooks`; `check` currently depends on `build`, which writes the
-      `build`, which writes the binary (`make check` must not modify
+      binary (`make check` must not modify files)
-      files)
+- [x] no tests — `go test ./...` has nothing to run; policy requires real tests
- [x] no tests — `go test ./...` has nothing to run; policy requires
+      with a 30-second timeout and the conditional `-v` rerun pattern (suite
-      real tests with a 30-second timeout and the conditional `-v`
+      covers parsing, grouping, digests, suppression, hashing, and the scan
-      rerun pattern (suite covers parsing, grouping, digests,
+      pipeline; 64% coverage)
-      suppression, hashing, and the scan pipeline; 64% coverage)
+- [x] `Dockerfile` missing — Go multistage with hash-pinned images: fail-fast
- [x] `Dockerfile` missing — Go multistage with hash-pinned images:
+      lint stage, build stage running `make check`
      fail-fast lint stage, build stage running `make check`
 - [x] `.dockerignore` missing
- [x] `.gitea/workflows/check.yml` missing (`docker build .` on push,
+- [x] `.gitea/workflows/check.yml` missing (`docker build .` on push, checkout
-      checkout action pinned by commit SHA)
+      action pinned by commit SHA)
 - [x] README lacks required sections: Description first line
-      (name/purpose/category/license/author), Getting Started,
+      (name/purpose/category/license/author), Getting Started, Rationale, TODO,
-      Rationale, TODO, License, Author
+      License, Author
- [x] README non-goal "no git repository setup and no CI" is stale now
+- [x] README non-goal "no git repository setup and no CI" is stale now that the
-      that the repo is under git with CI
+      repo is under git with CI
- [x] pre-commit hook not installed (`make hooks` once the target
+- [x] pre-commit hook not installed (`make hooks` once the target exists)
      exists)
 Accepted divergences (no action):
- flat single-package layout with `.go` files in the repo root — fine
+- flat single-package layout with `.go` files in the repo root — fine for a
-  for a small single-binary tool per the Go styleguide; the tracker
+  small single-binary tool per the Go styleguide; the tracker audit agrees
-  audit agrees
+- `go test` runs without `-race` — the repo mandates `CGO_ENABLED=0` (pure-Go
- `go test` runs without `-race` — the repo mandates `CGO_ENABLED=0`
+  builds) and the race detector requires cgo
  (pure-Go builds) and the race detector requires cgo
@@ -25,11 +25,8 @@ const defaultDatabasePath = "/var/lib/sfdupes/db.sqlite"
 const databaseEnv = "SFDUPES_DATABASE"
 // schemaVersion is the database schema version this build reads and
-// writes, stored in PRAGMA user_version. Version 2 adds the content
+// writes, stored in PRAGMA user_version.
-// column and the head/tail/content signature (replacing the version 1
+const schemaVersion = 1
 // 1 KiB end windows), so a version 1 database is rejected and must be
 // rescanned.
 const schemaVersion = 2
 // dbDirPerm is the mode for a database parent directory created by
 // scan.
@@ -39,24 +36,22 @@ const dbDirPerm = 0o755
 // BLOBs because Unix paths are raw bytes, not guaranteed UTF-8.
 const createTableSQL = `
 CREATE TABLE files (
-    path    BLOB PRIMARY KEY,
+    path  BLOB PRIMARY KEY,
-    size    INTEGER NOT NULL,
+    size  INTEGER NOT NULL,
-    mtime   INTEGER NOT NULL,
+    mtime INTEGER NOT NULL,
-    head    TEXT NOT NULL,
+    head  TEXT NOT NULL,
-    tail    TEXT NOT NULL,
+    tail  TEXT NOT NULL
    content TEXT NOT NULL
 ) WITHOUT ROWID
 `
 // upsertSQL inserts one file record, replacing any existing record for
 // the same path.
 const upsertSQL = `
-INSERT INTO files (path, size, mtime, head, tail, content)
+INSERT INTO files (path, size, mtime, head, tail)
-VALUES (?, ?, ?, ?, ?, ?)
+VALUES (?, ?, ?, ?, ?)
 ON CONFLICT (path) DO UPDATE SET
    size = excluded.size, mtime = excluded.mtime,
-    head = excluded.head, tail = excluded.tail,
+    head = excluded.head, tail = excluded.tail
    content = excluded.content
 `
 // errNoDatabase reports a missing database file for report/trees.
@@ -210,7 +205,7 @@ func userVersion(ctx context.Context, db *sql.DB) (int, error) {
 // loadFileRows reads every record from the files table.
 func loadFileRows(ctx context.Context, db *sql.DB) ([]scanRec, error) {
 	rows, err := db.QueryContext(ctx,
-		"SELECT path, size, mtime, head, tail, content FROM files")
+		"SELECT path, size, mtime, head, tail FROM files")
 	if err != nil {
 		return nil, fmt.Errorf("read records: %w", err)
 	}
@@ -225,8 +220,7 @@ func loadFileRows(ctx context.Context, db *sql.DB) ([]scanRec, error) {
 			r    scanRec
 		)
-		err = rows.Scan(&path, &r.size, &r.mtime, &r.head, &r.tail,
+		err = rows.Scan(&path, &r.size, &r.mtime, &r.head, &r.tail)
 			&r.content)
 		if err != nil {
 			return nil, fmt.Errorf("read record: %w", err)
 		}
@@ -354,7 +348,7 @@ func execUpserts(ctx context.Context, tx *sql.Tx, upserts []scanRec,
 	for _, r := range upserts {
 		_, err = st.ExecContext(ctx,
-			[]byte(r.path), r.size, r.mtime, r.head, r.tail, r.content)
+			[]byte(r.path), r.size, r.mtime, r.head, r.tail)
 		if err != nil {
 			return fmt.Errorf("upsert %s: %w", r.path, err)
 		}
@@ -0,0 +1,5 @@
 {
  "devDependencies": {
    "prettier": "3.8.1"
  }
 }
@@ -17,15 +17,14 @@ const ioBufSize = 1 << 20
 const minGroupSize = 2
 // scanRec is one file record from the database. The signature (size,
-// head, tail, content) is the duplicate key; mtime is informational
+// head, tail) is the duplicate key; mtime is informational only and
-// only and used by scan for change detection.
+// used by scan for change detection.
 type scanRec struct {
-	size    int64
+	size  int64
-	mtime   int64
+	mtime int64
-	head    string
+	head  string
-	tail    string
+	tail  string
-	content string
+	path  string
 	path    string
 }
 // loadRecords opens the database and reads every file record for the
@@ -53,9 +52,8 @@ func loadRecords(ctx context.Context) ([]scanRec, error) {
 }
 // dupeGroup is one set of candidate-duplicate files: identical size,
-// head hash, tail hash, and content hash. paths is sorted
+// head hash, and tail hash. paths is sorted lexicographically; the
-// lexicographically; the first entry is the group's "first", the rest
+// first entry is the group's "first", the rest are dupes.
 // are dupes.
 type dupeGroup struct {
 	size  int64
 	paths []string
@@ -124,9 +122,7 @@ func collectDupeGroups(recs []scanRec) []dupeGroup {
 			continue
 		}
-		k := fileSig{
+		k := fileSig{size: r.size, head: r.head, tail: r.tail}
 			size: r.size, head: r.head, tail: r.tail, content: r.content,
 		}
 		groups[k] = append(groups[k], r.path)
 	}
@@ -38,28 +38,6 @@ func TestCollectDupeGroups(t *testing.T) {
 	}
 }
 func TestCollectDupeGroupsContentSeparates(t *testing.T) {
 	t.Parallel()
 	// Same size, head, and tail, but different content hashes: the final
 	// rung keeps them apart, so no group forms. Matching content groups.
 	recs := []scanRec{
 		{size: 100, head: "h", tail: "t", content: "c1", path: "/a"},
 		{size: 100, head: "h", tail: "t", content: "c2", path: "/b"},
 		{size: 100, head: "h", tail: "t", content: "c1", path: "/c"},
 	}
 	groups := collectDupeGroups(recs)
 	if len(groups) != 1 {
 		t.Fatalf("len(groups) = %d, want 1 (only the matching content)",
 			len(groups))
 	}
 	if !slices.Equal(groups[0].paths, []string{"/a", "/c"}) {
 		t.Errorf("group paths = %q, want /a /c", groups[0].paths)
 	}
 }
 func TestCollectDupeGroupsMtimeExcluded(t *testing.T) {
 	t.Parallel()
@@ -7,7 +7,6 @@ import (
 	"database/sql"
 	"encoding/hex"
 	"fmt"
 	"io"
 	"io/fs"
 	"os"
 	"path/filepath"
@@ -17,37 +16,8 @@ import (
 	"syscall"
 )
-// The duplicate ladder (see hashSignature and README "Duplicate
+// chunk is the number of bytes hashed from each end of a file.
-// detection"). A same-size candidate below headTailMin is hashed in
+const chunk = 1024
 // full and compared directly; a larger one is separated first by the
 // hashes of its end windows, then by a content hash that is exact below
 // wholeFileMax and deliberately sampled at or above it.
 // headTailMin is the size threshold for the end-window gate. A file
 // smaller than this is hashed in full directly, with no separate head
 // and tail step: its head, tail, and content all carry the whole-file
 // hash. A file this size or larger is separated first by its end
 // windows.
 const headTailMin = 10 * 1024 * 1024
 // headTailWindow is the number of bytes hashed from each end of a file
 // at or above headTailMin (the head and tail rungs). Because
 // headTailMin is far larger than two windows, the head and tail windows
 // never overlap.
 const headTailWindow = 64 * 1024
 // wholeFileMax is the size boundary between the two content rungs: a
 // file strictly smaller than this is content-hashed in full; a file
 // this size or larger is content-hashed by sampling.
 const wholeFileMax = 50 * 1024 * 1024
 // sampleStride is the spacing between content samples for large files:
 // one window is read at each gigabyte-aligned offset (0, 1 GiB, ...).
 const sampleStride = 1024 * 1024 * 1024
 // sampleWindow is the number of bytes read at each large-file sample
 // offset, truncated at end of file.
 const sampleWindow = 1024 * 1024
 // workQueueDepth bounds the job and result channels feeding the walk
 // and hash worker pools.
@@ -469,12 +439,11 @@ func (s *scanState) recordRun(ctx context.Context, r hashResult) error {
 		s.resolve(rec.path)
 		s.batch = append(s.batch, scanRec{
-			size:    rec.size,
+			size:  rec.size,
-			mtime:   rec.mtime,
+			mtime: rec.mtime,
-			head:    r.head,
+			head:  r.head,
-			tail:    r.tail,
+			tail:  r.tail,
-			content: r.content,
+			path:  rec.path,
 			path:    rec.path,
 		})
 	}
@@ -865,15 +834,13 @@ func inodeOfInfo(fi fs.FileInfo) (uint64, uint64) {
 	return statDev(st), st.Ino
 }
-// hashResult carries one inode run's signature hashes — head, tail, and
+// hashResult carries one inode run's head/tail hashes (or the error
-// content — (or the error that prevented hashing it) from the hash
+// that prevented hashing it) from the hash workers to the hash phase.
 // workers to the hash phase.
 type hashResult struct {
-	run     []fileRec
+	run  []fileRec
-	head    string
+	head string
-	tail    string
+	tail string
-	content string
+	err  error
 	err     error
 }
 // hashPool owns every goroutine of the hash worker pool: the feeder
@@ -963,11 +930,11 @@ func hashWorker(ctx context.Context, jobs <-chan []fileRec,
 			continue
 		}
-		head, tail, content, err := hashSignature(run[0].path, run[0].size)
+		head, tail, err := hashHeadTail(run[0].path, run[0].size)
 		select {
 		case results <- hashResult{
-			run: run, head: head, tail: tail, content: content, err: err,
+			run: run, head: head, tail: tail, err: err,
 		}:
 		case <-ctx.Done():
 			return
@@ -975,138 +942,55 @@ func hashWorker(ctx context.Context, jobs <-chan []fileRec,
 	}
 }
-// emptyHash is the lowercase-hex SHA-256 of the empty input: the head,
+// emptyHash is the lowercase-hex SHA-256 of the empty input: the head
-// tail, and content hash of every zero-length file.
+// and tail hash of every zero-length file.
 const emptyHash = "e3b0c44298fc1c149afbf4c8996fb924" +
 	"27ae41e4649b934ca495991b7852b855"
-// hashSignature computes the three content hashes that, with the file
+// hashHeadTail returns the lowercase-hex SHA-256 of the first
-// size, form its duplicate signature. A file below headTailMin is
+// min(chunk, size) bytes and of the last min(chunk, size) bytes of the
-// hashed in full and its whole-file SHA-256 is returned as head, tail,
+// file at path. The two reads overlap when size < 2*chunk. size is the
-// and content alike — that range takes no separate end-window step. For
+// value recorded when the file was statted; a zero-length file's
-// a file at or above headTailMin the head and tail are the SHA-256 of
+// hashes are constant, so it is never even opened.
-// its first and last headTailWindow bytes, and content is the SHA-256
+func hashHeadTail(path string, size int64) (string, string, error) {
 // of the whole file below wholeFileMax (the exact rung) or of
 // gigabyte-spaced samples at or above it (the sampled, deliberately
 // probabilistic rung). Two files are duplicates only when all four
 // agree; any mismatch means not a duplicate. size is the value recorded
 // when the file was statted; a zero-length file has constant hashes and
 // is never opened.
 func hashSignature(path string, size int64) (string, string, string, error) {
 	if size == 0 {
-		return emptyHash, emptyHash, emptyHash, nil
+		return emptyHash, emptyHash, nil
 	}
 	//nolint:gosec // hashing operator-supplied paths is the tool's purpose
 	f, err := os.Open(path)
 	if err != nil {
-		return "", "", "", err
+		return "", "", err
 	}
 	defer func() { _ = f.Close() }()
-	// Below the threshold the whole file is hashed directly, with no
+	n := min(int64(chunk), size)
 	// end-window step: head and tail both carry the whole-file hash.
 	if size < int64(headTailMin) {
 		content, err := hashWhole(f, size)
 		if err != nil {
 			return "", "", "", err
 		}
-		return content, content, content, nil
+	buf := make([]byte, n)
 	}
-	head, tail, err := hashEnds(f, size)
+	_, err = f.ReadAt(buf, 0)
 	if err != nil {
 		return "", "", "", err
 	}
 	content, err := hashContent(f, size)
 	if err != nil {
 		return "", "", "", err
 	}
 	return head, tail, content, nil
 }
 // hashEnds returns the SHA-256 of the first and last headTailWindow
 // bytes of f. It is called only for files at least headTailMin, which
 // is far larger than two windows, so the windows never overlap and both
 // reads are always full.
 func hashEnds(f *os.File, size int64) (string, string, error) {
 	buf := make([]byte, headTailWindow)
 	_, err := f.ReadAt(buf, 0)
 	if err != nil {
 		return "", "", err
 	}
 	h := sha256.Sum256(buf)
 	head := hex.EncodeToString(h[:])
-	_, err = f.ReadAt(buf, size-int64(headTailWindow))
+	// When the whole file fits in one chunk the tail window is exactly
 	// the bytes just read: reuse the head hash instead of issuing a
 	// second read for every small file.
 	if size <= int64(chunk) {
 		hh := hex.EncodeToString(h[:])
 		return hh, hh, nil
 	}
 	_, err = f.ReadAt(buf, size-n)
 	if err != nil {
 		return "", "", err
 	}
 	t := sha256.Sum256(buf)
-	return head, hex.EncodeToString(t[:]), nil
+	return hex.EncodeToString(h[:]), hex.EncodeToString(t[:]), nil
 }
 // hashContent returns the content-rung hash of f: the SHA-256 of the
 // whole file when it is smaller than wholeFileMax, or of sampled
 // windows when it is that size or larger.
 func hashContent(f *os.File, size int64) (string, error) {
 	if size >= int64(wholeFileMax) {
 		return hashSamples(f, size)
 	}
 	return hashWhole(f, size)
 }
 // hashWhole returns the SHA-256 of the entire file. A SectionReader is
 // used so the read is independent of the offset left by any end-window
 // reads. Reading fewer than size bytes means the file shrank between
 // the stat and the hash; that is an error rather than a hash of content
 // that no longer matches the recorded size.
 func hashWhole(f *os.File, size int64) (string, error) {
 	h := sha256.New()
 	n, err := io.Copy(h, io.NewSectionReader(f, 0, size))
 	if err != nil {
 		return "", err
 	}
 	if n != size {
 		return "", fmt.Errorf("read %d of %d bytes: %w", n, size,
 			io.ErrUnexpectedEOF)
 	}
 	return hex.EncodeToString(h.Sum(nil)), nil
 }
 // hashSamples feeds sampleWindow bytes at each gigabyte-aligned offset
 // (0, sampleStride, 2*sampleStride, ... while inside the file), in
 // order, into one hash, each window truncated at end of file. This is
 // the probabilistic large-file rung: two files of equal size agreeing
 // on every sample are reported as duplicates without every byte being
 // read. Because size is part of the signature, files of different sizes
 // never reach this comparison, so the sample boundaries always align.
 func hashSamples(f *os.File, size int64) (string, error) {
 	h := sha256.New()
 	buf := make([]byte, sampleWindow)
 	for off := int64(0); off < size; off += int64(sampleStride) {
 		n := min(int64(sampleWindow), size-off)
 		_, err := f.ReadAt(buf[:n], off)
 		if err != nil {
 			return "", err
 		}
 		h.Write(buf[:n])
 	}
 	return hex.EncodeToString(h.Sum(nil)), nil
 }
@@ -53,23 +53,7 @@ func pattern(tag byte, n int) []byte {
 	return data
 }
-// sig returns a file's full signature (head, tail, content), failing the
+func TestHashHeadTail(t *testing.T) {
 // test on any error.
 func sig(t *testing.T, path string, size int64) (string, string, string) {
 	t.Helper()
 	head, tail, content, err := hashSignature(path, size)
 	if err != nil {
 		t.Fatalf("hashSignature %s: %v", path, err)
 	}
 	return head, tail, content
 }
 // TestHashSignatureBelowThreshold verifies that a file below headTailMin
 // is hashed in full and compared directly: head, tail, and content all
 // carry the whole-file SHA-256, with no separate end-window step.
 func TestHashSignatureBelowThreshold(t *testing.T) {
 	t.Parallel()
 	dir := t.TempDir()
@@ -78,10 +62,13 @@ func TestHashSignatureBelowThreshold(t *testing.T) {
 		name string
 		data []byte
 	}{
 		{"empty", nil},
 		{"one-byte", []byte("x")},
-		{"one-window", pattern(1, headTailWindow)},
+		{"under-one-chunk", pattern(1, chunk-1)},
-		{"several-windows", pattern(2, 3*headTailWindow)},
+		{"exactly-one-chunk", pattern(2, chunk)},
-		{"near-threshold", pattern(3, headTailMin-1)},
+		{"overlapping-reads", pattern(3, chunk+chunk/2)},
 		{"exactly-two-chunks", pattern(4, 2*chunk)},
 		{"beyond-two-chunks", pattern(5, 3*chunk)},
 	}
 	for _, c := range cases {
 		t.Run(c.name, func(t *testing.T) {
@@ -89,240 +76,49 @@ func TestHashSignatureBelowThreshold(t *testing.T) {
 			p := writeFile(t, dir, c.name, c.data)
-			head, tail, content := sig(t, p, int64(len(c.data)))
+			head, tail, err := hashHeadTail(p, int64(len(c.data)))
 			if err != nil {
 				t.Fatalf("hashHeadTail: %v", err)
 			}
-			whole := hexSum(c.data)
+			n := min(chunk, len(c.data))
-			if head != whole || tail != whole || content != whole {
+			if want := hexSum(c.data[:n]); head != want {
-				t.Errorf("head=%s tail=%s content=%s, want all whole-file %s",
+				t.Errorf("head = %s, want %s", head, want)
-					head, tail, content, whole)
+			}
 			if want := hexSum(c.data[len(c.data)-n:]); tail != want {
 				t.Errorf("tail = %s, want %s", tail, want)
 			}
 		})
 	}
 }
-// TestHashSignatureEnds exercises the head and tail rungs, which apply
+func TestHashHeadTailErrors(t *testing.T) {
 // only to files at least headTailMin. Sparse files keep the fixtures
 // cheap: a difference in the first window changes only head, a
 // difference in the last window changes only tail, and a difference
 // between the windows changes neither end hash but does change the
 // whole-file content rung (the file is below wholeFileMax).
 func TestHashSignatureEnds(t *testing.T) {
 	t.Parallel()
 	dir := t.TempDir()
-	// Between headTailMin and wholeFileMax: the end-window gate is active
+	_, _, err := hashHeadTail(filepath.Join(dir, "missing"), 1)
 	// and the content rung is a whole-file hash.
 	const size = int64(headTailMin + 2*1024*1024)
 	base := sparseFile(t, dir, "ends-base", size)
 	headDiff := sparseFile(t, dir, "ends-head", size)
 	tailDiff := sparseFile(t, dir, "ends-tail", size)
 	midDiff := sparseFile(t, dir, "ends-mid", size)
 	pokeAt(t, headDiff, 0, []byte{1})
 	pokeAt(t, tailDiff, size-1, []byte{1})
 	pokeAt(t, midDiff, size/2, []byte{1})
 	bHead, bTail, bContent := sig(t, base, size)
 	h, tl, c := sig(t, headDiff, size)
 	if h == bHead {
 		t.Error("a byte in the first window did not change head")
 	}
 	if tl != bTail {
 		t.Error("a byte in the first window changed tail")
 	}
 	if c == bContent {
 		t.Error("a byte in the first window did not change content")
 	}
 	h, tl, c = sig(t, tailDiff, size)
 	if tl == bTail {
 		t.Error("a byte in the last window did not change tail")
 	}
 	if h != bHead {
 		t.Error("a byte in the last window changed head")
 	}
 	if c == bContent {
 		t.Error("a byte in the last window did not change content")
 	}
 	h, tl, c = sig(t, midDiff, size)
 	if h != bHead || tl != bTail {
 		t.Error("a byte between the windows changed an end hash")
 	}
 	if c == bContent {
 		t.Error("whole-file content rung ignored a byte between the windows")
 	}
 }
 func TestHashSignatureErrors(t *testing.T) {
 	t.Parallel()
 	dir := t.TempDir()
 	// A missing file: an error, and every hash left empty.
 	head, tail, content, err := hashSignature(filepath.Join(dir, "missing"), 1)
 	if err == nil {
 		t.Error("no error for a missing file")
 	}
 	if head != "" || tail != "" || content != "" {
 		t.Errorf("missing file returned hashes: %q %q %q", head, tail, content)
 	}
 	// A zero-length file has constant hashes and is never opened: even
 	// a missing path succeeds.
-	head, tail, content, err = hashSignature(filepath.Join(dir, "missing"), 0)
+	head, tail, err := hashHeadTail(filepath.Join(dir, "missing"), 0)
-	if err != nil ||
+	if err != nil || head != emptyHash || tail != emptyHash {
-		head != emptyHash || tail != emptyHash || content != emptyHash {
+		t.Errorf("empty: head=%q tail=%q err=%v, want constant hashes",
-		t.Errorf("empty: head=%q tail=%q content=%q err=%v, "+
+			head, tail, err)
 			"want constant hashes", head, tail, content, err)
 	}
 	// A file that shrank between the stat and hash passes: reading at
 	// the stat-reported size must fail rather than emit wrong hashes.
 	p := writeFile(t, dir, "shrunk", []byte("tiny"))
-	head, tail, content, err = hashSignature(p, int64(2*headTailWindow))
+	_, _, err = hashHeadTail(p, int64(2*chunk))
 	if err == nil {
 		t.Error("no error when the stat size exceeds the file size")
 	}
 	if head != "" || tail != "" || content != "" {
 		t.Errorf("shrunk file returned hashes: %q %q %q", head, tail, content)
 	}
 }
 // sparseFile creates a file that is logically size bytes long without
 // allocating blocks for the hole, so multi-gigabyte cases stay cheap.
 func sparseFile(t *testing.T, dir, name string, size int64) string {
 	t.Helper()
 	p := filepath.Join(dir, name)
 	f, err := os.Create(p) //nolint:gosec // test-controlled path
 	if err != nil {
 		t.Fatal(err)
 	}
 	err = f.Truncate(size)
 	if err != nil {
 		t.Fatal(err)
 	}
 	err = f.Close()
 	if err != nil {
 		t.Fatal(err)
 	}
 	return p
 }
 // pokeAt writes data into an existing file at off, leaving the rest of
 // the file (a sparse hole) untouched.
 func pokeAt(t *testing.T, path string, off int64, data []byte) {
 	t.Helper()
 	f, err := os.OpenFile(path, os.O_WRONLY, 0o600) //nolint:gosec // test path
 	if err != nil {
 		t.Fatal(err)
 	}
 	_, err = f.WriteAt(data, off)
 	if err != nil {
 		t.Fatal(err)
 	}
 	err = f.Close()
 	if err != nil {
 		t.Fatal(err)
 	}
 }
 // contentHash returns just the content rung of a file's signature.
 func contentHash(t *testing.T, path string, size int64) string {
 	t.Helper()
 	_, _, content := sig(t, path, size)
 	return content
 }
 // TestContentRungBoundary checks the 50 MiB boundary between the two
 // content rungs: just below it the whole file is hashed and any byte
 // difference shows; at the boundary only the gigabyte-spaced samples are
 // hashed, so a difference outside a sample window is invisible.
 func TestContentRungBoundary(t *testing.T) {
 	t.Parallel()
 	dir := t.TempDir()
 	// A byte that lands outside the single [0, sampleWindow) sample a
 	// sub-gigabyte file has, but well inside the file.
 	const off = 10 * 1024 * 1024
 	// Just under the boundary: the whole-file rung sees the poked byte.
 	under := int64(wholeFileMax - 1)
 	underBase := sparseFile(t, dir, "under-base", under)
 	underPoked := sparseFile(t, dir, "under-poked", under)
 	pokeAt(t, underPoked, off, []byte{1})
 	if contentHash(t, underBase, under) == contentHash(t, underPoked, under) {
 		t.Error("whole-file rung ignored a byte difference below wholeFileMax")
 	}
 	// At the boundary: only [0, sampleWindow) is sampled, so the poked
 	// byte at off is invisible and the two content hashes match.
 	at := int64(wholeFileMax)
 	atBase := sparseFile(t, dir, "at-base", at)
 	atPoked := sparseFile(t, dir, "at-poked", at)
 	pokeAt(t, atPoked, off, []byte{1})
 	if contentHash(t, atBase, at) != contentHash(t, atPoked, at) {
 		t.Error("sampled rung saw a byte outside every sample window")
 	}
 }
 // TestContentRungMultiGigabyte exercises the sampled rung across several
 // gigabytes using sparse files: a difference inside the third sample
 // window (at offset 2*sampleStride) changes the hash, while a difference
 // in the gap after it does not.
 func TestContentRungMultiGigabyte(t *testing.T) {
 	t.Parallel()
 	dir := t.TempDir()
 	// Three sample windows (offsets 0, 1 GiB, 2 GiB) plus a trailing gap
 	// that no sample covers.
 	size := int64(2*sampleStride + 2*sampleWindow)
 	thirdSample := int64(2 * sampleStride)
 	gap := thirdSample + int64(sampleWindow)
 	base := sparseFile(t, dir, "g-base", size)
 	inSample := sparseFile(t, dir, "g-insample", size)
 	inGap := sparseFile(t, dir, "g-ingap", size)
 	pokeAt(t, inSample, thirdSample, []byte{1})
 	pokeAt(t, inGap, gap, []byte{1})
 	baseHash := contentHash(t, base, size)
 	if contentHash(t, inSample, size) == baseHash {
 		t.Error("sample at 2 GiB was not read: difference there was invisible")
 	}
 	if contentHash(t, inGap, size) != baseHash {
 		t.Error("a byte in an unsampled gap changed the content hash")
 	}
 }
 // collectWalk runs a walk over roots and returns the emitted records
@@ -11,6 +11,12 @@ set -eu
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 # yarn provides prettier, which formats Markdown. yarn is a tool, like
 # node/git/make/go below; the reference that governs formatting output is
 # prettier, pinned by yarn.lock's integrity hash and installed by
 # `yarn install --frozen-lockfile`.
 YARN_VERSION="1.22.22"
 PKGMGR=""
 SUDO=""
 APT_UPDATED=""
@@ -58,6 +64,21 @@ missing() {
    ! command -v "$1" >/dev/null 2>&1
 }
 ensure_node() {
    if ! missing node; then return 0; fi
    pkg_install nodejs nodejs node nodejs
 }
 ensure_yarn() {
    if ! missing yarn; then return 0; fi
    if ! missing corepack; then
        corepack enable >/dev/null 2>&1 || true
        corepack prepare "yarn@$YARN_VERSION" --activate
    else
        pkg_install yarn yarn yarn yarn
    fi
 }
 main() {
    cd "$ROOT"
@@ -71,6 +92,16 @@ main() {
    if missing make; then pkg_install gnumake make make make; fi
    if missing go; then pkg_install go golang go go; fi
    # node runs prettier and is an unpinned host tool for the same reason
    # git/make/go are: it comes from the host package manager, whatever
    # version it ships. It is not installed via nvm the way the canonical
    # template does, because nvm's prebuilt node is glibc-linked and does
    # not run on this repo's musl/Alpine build image. prettier — the tool
    # whose version affects formatting output — is pinned by yarn.lock.
    ensure_node
    ensure_yarn
    yarn install --frozen-lockfile
    # Linting runs via docker only (script/lint), so docker is a lint
    # prerequisite rather than something bootstrap installs. Warn, do
    # not fail: everything except `make lint` — and, through it,
@@ -1,12 +1,23 @@
 #!/bin/sh
-# script/fmt: format all files (writes).
+# script/fmt: format all files (writes). gofmt for Go, prettier for
 # Markdown. prettier is the pinned devDependency in package.json/
 # yarn.lock; script/bootstrap installs it (see run_prettier).
 set -eu
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 run_prettier() {
    if ! command -v yarn >/dev/null 2>&1; then
        echo "fmt: yarn not found; run script/bootstrap first" >&2
        exit 1
    fi
    yarn run prettier "$@"
 }
 main() {
    cd "$ROOT"
    gofmt -s -w .
    run_prettier --write '**/*.md' --tab-width 4 --prose-wrap always
 }
 main "$@"
@@ -1,18 +1,37 @@
 #!/bin/sh
 # script/fmt-check: check formatting (read-only). Same scope as
-# script/fmt, but fails instead of writing.
+# script/fmt: gofmt for Go, prettier for Markdown. Both run every time
 # and each reports independently, so a failure names which formatter is
 # unhappy; the script exits non-zero if either found unformatted files.
 set -eu
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 run_prettier() {
    if ! command -v yarn >/dev/null 2>&1; then
        echo "fmt-check: yarn not found; run script/bootstrap first" >&2
        exit 1
    fi
    yarn run prettier "$@"
 }
 main() {
    cd "$ROOT"
    rc=0
    files="$(gofmt -s -l .)"
    if [ -n "$files" ]; then
        echo "gofmt: files not formatted:" >&2
        echo "$files" >&2
-        exit 1
+        rc=1
    fi
    if ! run_prettier --check '**/*.md' --tab-width 4 --prose-wrap always; then
        echo "prettier: Markdown not formatted; run make fmt" >&2
        rc=1
    fi
    exit "$rc"
 }
 main "$@"
@@ -13,10 +13,9 @@ import (
 // fileSig is a file's duplicate signature; mtime is excluded.
 type fileSig struct {
-	size    int64
+	size int64
-	head    string
+	head string
-	tail    string
+	tail string
 	content string
 }
 // treeNode is one directory reconstructed from the scan stream.
@@ -123,9 +122,7 @@ func buildHierarchy(recs []scanRec) (*treeNode, []*treeNode) {
 			node.files = make(map[string]fileSig)
 		}
-		sig := fileSig{
+		sig := fileSig{size: r.size, head: r.head, tail: r.tail}
 			size: r.size, head: r.head, tail: r.tail, content: r.content,
 		}
 		// An unhashed record (its size was unique when last scanned)
 		// has unknown content: give it a signature no other file can
@@ -191,7 +188,7 @@ func (n *treeNode) compute() {
 	for name, sig := range n.files {
 		entries = append(entries,
 			"f\x00"+name+"\x00"+strconv.FormatInt(sig.size, 10)+
-				"\x00"+sig.head+"\x00"+sig.tail+"\x00"+sig.content)
+				"\x00"+sig.head+"\x00"+sig.tail)
 		n.fileCount++
 		n.totalSize += sig.size
 	}
@@ -0,0 +1,8 @@
 # THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
 # yarn lockfile v1
 prettier@3.8.1:
  version "3.8.1"
  resolved "https://registry.yarnpkg.com/prettier/-/prettier-3.8.1.tgz#edf48977cf991558f4fcbd8a3ba6015ba2a3a173"
  integrity sha512-UOnG6LftzbdaHZcKoPFtOcCKztrQ57WkHDeRD9t/PTQtmT0NHSeWWepj6pS0z/N7+08BHFDQVUrfmfMRcZwbMg==