Return sink write errors from every handler (closes #22 )

The console and JSON handlers threw away the error from their write to stdout, so a lost log line looked delivered. They now return it, wrapped. The webhook handler also returns an error for a status outside 2xx. The multiplex handler passes the record to every handler and returns their errors joined with errors.Join instead of stopping at the first. Both stdout handlers gain an unexported writer, nil meaning os.Stdout at write time, so tests can supply a sink that fails. The README says what each handler returns and that the slog.Logger methods discard a handler's error. Model: opus-5-5
2026-10-06 00:32:23 +00:00
25 changed files with 276 additions and 1312 deletions
@@ -1,83 +0,0 @@
 # .dockerignore does NOT use .gitignore semantics. Docker matches with
 # moby/patternmatcher: filepath.Match plus `**`, so `*` does not cross
 # `/` and an unprefixed pattern is anchored at the context root. Every
 # depth-independent pattern therefore needs `**/`, or `config/.env` and
 # `certs/server.key` still ship while this file reads as solved. Only
 # genuinely root-anchored entries go unprefixed. Never transplant these
 # into .gitignore, where `**/` is wrong.
 #
 # Matching is case-sensitive, so secrets use character ranges rather
 # than an ALL-CAPS twin, which would still miss `Server.Key`.
 #
 # Extend with this repo's own host-built artifacts, written anchored:
 # `/myapp`, never `**/myapp`, which also matches `cmd/myapp/` and
 # deletes the package directory from the context.
 # .git is sent without its config. Without a VERSION build argument the
 # stage that compiles runs `git describe --tags --always` on .git, which
 # does not need .git/config; that file can hold a credential, such as a
 # password in a remote URL or the token the CI checkout step stores there.
 # Each submodule keeps a config with the same exposure in its git directory
 # under .git/modules/, nested again for a submodule's own submodules, or in
 # its own .git directory when it keeps one.
 # KNOWN GAP: a submodule whose name has a `config` segment (`config`,
 # `deploy/config`, `config/lib`) loses its whole git directory, because
 # `**/.git/modules/**/config` also matches that segment's directory
 # under .git/modules/. Go's version stamping then fails the build;
 # nothing leaks. Name such a submodule without that segment:
 # `git submodule add --name`.
 **/.git/config
 **/.git/modules/**/config
 # Agent scratch: one full checkout of the repo per in-flight agent.
 # Anchored because it occurs once where agents run at the repo root.
 # KNOWN GAP: a repo running agents in subdirectories still ships
 # `services/api/.claude/` and must add its own anchored entry.
 .claude
 # Environment files. `*.env` covers bare `.env` and the `prod.env`
 # convention. Re-include a committed template with a negation if the
 # build needs one: `!docs/example.env`.
 **/*.[eE][nN][vV]
 **/.[eE][nN][vV].*
 **/.[eE][nN][vV][rR][cC]
 # Private keys and the bundles carrying them. Public certificates
 # (*.crt, *.cer) are deliberately absent: they are legitimate inputs.
 **/*.[pP][eE][mM]
 **/*.[kK][eE][yY]
 **/*.[pP]12
 **/*.[pP][fF][xX]
 **/[iI][dD]_[rR][sS][aA]
 **/[iI][dD]_[dD][sS][aA]
 **/[iI][dD]_[eE][cC][dD][sS][aA]
 **/[iI][dD]_[eE][cC][dD][sS][aA]_[sS][kK]
 **/[iI][dD]_[eE][dD]25519
 **/[iI][dD]_[eE][dD]25519_[sS][kK]
 # Dependencies: restored inside the image, never copied in.
 **/node_modules
 # OS metadata.
 **/.DS_Store
 **/Thumbs.db
 # Editor state: never a build input, and it churns COPY.
 **/*.swp
 **/*.swo
 **/*~
 **/*.bak
 **/.idea
 **/.vscode
 **/*.sublime-*
 # This repository's host-built artifacts: the example program's binary,
 # test binaries, coverage output, and the log yarn writes when an install
 # fails.
 /cmd/example/example
 /*.test
 /*.out
 /yarn-error.log
 # aider's files, among them a config file that can hold an API key.
 **/.aider*
@@ -1,15 +0,0 @@
 root = true
 [*]
 indent_style = space
 indent_size = 4
 end_of_line = lf
 charset = utf-8
 trim_trailing_whitespace = true
 insert_final_newline = true
 [Makefile]
 indent_style = tab
 [*.go]
 indent_style = tab
@@ -1,9 +1,12 @@
 name: check
-on: [push]
+
 on:
  push:
  pull_request:
 jobs:
-    check:
+  check:
-        runs-on: ubuntu-latest
+    runs-on: ubuntu-latest
-        steps:
+    steps:
-            # actions/checkout v4.2.2, 2026-02-22
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-            - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - run: script/cibuild
            - run: script/cibuild
@@ -1,57 +1,2 @@
 # OS
 .DS_Store
 Thumbs.db
 # Editors
 *.swp
 *.swo
 *~
 *.bak
 .idea/
 .vscode/
 *.sublime-*
 # Agent scratch (worktrees of this repo, created and destroyed by
 # in-flight tooling). Unanchored: .gitignore patterns already match at
 # every depth, so no prefix is wanted here. This is not a .dockerignore
 # entry and must not be given a `**/` prefix on the way into one.
 .claude/
 # Node
 node_modules/
 # Secrets. Unanchored like every entry above, so each matches at every
 # depth. Matching is case-sensitive on Linux, so names use character
 # ranges rather than a lowercase form that misses `Server.Key`.
 # Environment files. `*.env` covers bare `.env` and the `prod.env`
 # convention. Only the templates `example.env` and `sample.env` are
 # re-included below. A repository that commits any other template adds
 # its own negation after these lines, for example `!.env.example`.
 *.[eE][nN][vV]
 .[eE][nN][vV].*
 .[eE][nN][vV][rR][cC]
 !example.env
 !sample.env
 # Private keys and the bundles carrying them.
 *.[pP][eE][mM]
 *.[kK][eE][yY]
 *.[pP]12
 *.[pP][fF][xX]
 [iI][dD]_[rR][sS][aA]
 [iI][dD]_[dD][sS][aA]
 [iI][dD]_[eE][cC][dD][sS][aA]
 [iI][dD]_[eE][cC][dD][sS][aA]_[sS][kK]
 [iI][dD]_[eE][dD]25519
 [iI][dD]_[eE][dD]25519_[sS][kK]
 # This repository's own entries. Go: logs, coverage output, test
 # binaries, and the example program's binary.
 *.log
 *.out
 *.test
 cmd/example/example
 # aider's files, among them a config file that can hold an API key.
 .aider*
 cmd/example/example
@@ -10,21 +10,14 @@ run:
 linters:
  default: all
  enable:
    # Successor to the deprecated gomodguard. Named explicitly, rather than
    # left to `default: all`, because it carries the module policy below.
    - gomodguard_v2
  disable:
    # Genuinely incompatible with project patterns
    - exhaustruct      # Requires all struct fields
-    - exhaustruct_v5   # Requires all struct fields (successor to exhaustruct)
+    - depguard         # Dependency allow/block lists
    - godot            # Requires comments to end with periods
    - wsl              # Deprecated, replaced by wsl_v5
    - wrapcheck        # Too verbose for internal packages
    - varnamelen       # Short names like db, id are idiomatic Go
    # Deprecated: the warning is attached to the old name, so it is
    # silenced by disabling that name, not by enabling the successor.
    - wsl              # Deprecated, replaced by wsl_v5
    - gomodguard       # Deprecated, replaced by gomodguard_v2
  settings:
    lll:
      line-length: 88
@@ -35,64 +28,6 @@ linters:
      max-complexity: 15
    dupl:
      threshold: 100
    depguard:
      # Test-support code must not be compiled into the shipped binary. A
      # test-support package exists to hand a test privileges the program
      # itself must never have, so a file that is not a test must not import
      # one. Test files, and the files inside a package whose directory name
      # ends in `test`, are where that code belongs, and are exempt.
      #
      # The deny list below is the one part of this file a repository is
      # expected to extend, and the only part it may. depguard matches an
      # import path against a list of prefixes, so it cannot be told "any path
      # whose last segment ends in test"; a repository's own test-support
      # packages have to be named here one at a time, by full import path,
      # under a module path that differs from repository to repository. Add
      # them; change nothing else.
      rules:
        test-support:
          list-mode: lax
          files:
            - "$all"
            - "!$test"
            - "!**/*test/**"
          deny:
            - pkg: net/http/httptest
              desc: >-
                Test-support code belongs in test files and in packages whose
                directory name ends in test, not in the shipped binary.
    # Only decisions already recorded in the Go package defaults are
    # listed here. Every entry matches the module path exactly.
    gomodguard_v2:
      blocked:
        - module: github.com/rs/zerolog
          recommendations:
            - log/slog
          reason: "Structured logging is stdlib log/slog."
        # One entry per pre-fork module path, because the later releases
        # are separate paths. A prefix match would be shorter but would
        # also reach github.com/go-redis/redismock, the test double for
        # the successor these entries recommend.
        - module: github.com/go-redis/redis
          recommendations:
            - github.com/redis/go-redis/v9
          reason: "Pre-fork module; use the maintained go-redis v9."
        - module: github.com/go-redis/redis/v7
          recommendations:
            - github.com/redis/go-redis/v9
          reason: "Pre-fork module; use the maintained go-redis v9."
        - module: github.com/go-redis/redis/v8
          recommendations:
            - github.com/redis/go-redis/v9
          reason: "Pre-fork module; use the maintained go-redis v9."
        - module: github.com/sergi/go-diff
          recommendations:
            - github.com/aymanbagabas/go-udiff
          reason: "No unified diff output; use go-udiff."
        - module: github.com/hexops/gotextdiff
          recommendations:
            - github.com/aymanbagabas/go-udiff
          reason: "Unmaintained fork; use go-udiff."
 issues:
  max-issues-per-linter: 0
@@ -1,2 +0,0 @@
 node_modules/
 yarn.lock
@@ -1,4 +0,0 @@
 {
    "tabWidth": 4,
    "proseWrap": "always"
 }
@@ -1,36 +1,20 @@
-# Lint stage. The format check is not here: it runs on the host, in
+# Lint stage: format check + golangci-lint
-# script/fmt-check.
+# golangci/golangci-lint:v2.12.2 (Debian-based), 2026-08-07
-# golangci/golangci-lint:v2.14.0 (Debian-based), 2026-09-24
+FROM golangci/golangci-lint:v2.12.2@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240 AS lint
 FROM golangci/golangci-lint@sha256:ad862ba6b3798cbe0fd9fd7408d498fd74fbd2623a92406b2fd3898faf0bf98f AS lint
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download
 COPY . .
-# Called directly: make lint is itself a docker build of this stage.
+RUN make fmt-check
-RUN golangci-lint run --config .golangci.yml ./...
+RUN make lint
-# Test stage: run full test suite under the race detector
+# Test stage: run full test suite
 # golang 1.22.12 (Debian-based; -race needs its C toolchain), 2025-02-04
 FROM golang@sha256:1cf6c45ba39db9fd6db16922041d074a63c935556a05c5ccb62d181034df7f02 AS test
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download
 COPY . .
 # Called directly: make test is itself a docker build of this stage.
 RUN go test -timeout 90s -race -cover ./... || \
    { echo "--- Rerunning with -v for details ---"; \
      go test -timeout 90s -race -v ./...; exit 1; }
 # Final stage: a development environment, set up by script/bootstrap.
 # The copies make a plain docker build run both stages above. No stage
 # compiles a binary, since simplelog is a library, so none declares the
 # VERSION build argument that script/docker and script/cibuild pass.
 # golang 1.22.12 (2025-02-04)
-FROM golang@sha256:1cf6c45ba39db9fd6db16922041d074a63c935556a05c5ccb62d181034df7f02
+FROM golang@sha256:1cf6c45ba39db9fd6db16922041d074a63c935556a05c5ccb62d181034df7f02 AS test
 # Depend on lint stage so both stages always run
 COPY --from=lint /src/go.sum /dev/null
 COPY --from=test /src/go.sum /dev/null
 WORKDIR /src
-COPY script/ script/
+COPY go.mod go.sum ./
-COPY go.mod go.sum package.json yarn.lock ./
+RUN go mod download
 RUN script/bootstrap
 COPY . .
 RUN make test
@@ -3,33 +3,35 @@
 ## Summary
 simplelog is an opinionated logging package designed to facilitate easy and
-structured logging in Go applications with an absolute minimum of boilerplate.
+structured logging in Go applications with an absolute minimum of
 boilerplate.
-The idea is that you can add a single import line which replaces the stdlib
+The idea is that you can add a single import line which replaces the
-`log/slog` default handler, and solve the 90% case for logging.
+stdlib `log/slog` default handler, and solve the 90% case for logging.
 ## Current Status
-Released v1.0.0 2024-06-14. Works as intended. No known bugs.
+Released v1.0.0 2024-06-14.  Works as intended.  No known bugs.
 ## Features
- if output is a tty, outputs pretty color logs
+-   if output is a tty, outputs pretty color logs
- if output is not a tty, outputs json
+-   if output is not a tty, outputs json
- supports delivering each log message via a webhook
+-   supports delivering each log message via a webhook
- emits every `slog` attribute: those passed to a log call, those accumulated
+-   emits every `slog` attribute: those passed to a log call, those
-  with `WithAttrs`, and those qualified by `WithGroup`. `slog.Group` values
+    accumulated with `WithAttrs`, and those qualified by `WithGroup`.
-  nest, and `slog.LogValuer` values are resolved. In json output attributes are
+    `slog.Group` values nest, and `slog.LogValuer` values are resolved. In
-  object fields (groups become nested objects); in console output they are
+    json output attributes are object fields (groups become nested objects);
-  appended as `key=value` pairs, with grouped keys written as `group.key=value`.
+    in console output they are appended as `key=value` pairs, with grouped
-  See [Attribute output](#attribute-output) for the details worth knowing
+    keys written as `group.key=value`. See
- reports a record that could not be delivered as an error from the handler's
+    [Attribute output](#attribute-output) for the details worth knowing
-  `Handle` method. See [When delivery fails](#when-delivery-fails) for how to
+-   reports a record that could not be delivered as an error from the
-  receive it
+    handler's `Handle` method. See
    [When delivery fails](#when-delivery-fails) for how to receive it
 ## Planned Features
- supports delivering logs via tcp RELP (e.g. to remote rsyslog using imrelp)
+-   supports delivering logs via tcp RELP (e.g. to remote rsyslog using imrelp)
 ## Installation
@@ -47,9 +49,9 @@ go get sneak.berlin/go/simplelog
 ## Usage
-Below is an example of how to use SimpleLog in a Go application. This example is
+Below is an example of how to use SimpleLog in a Go application. This
-provided in the form of a `main.go` file, which demonstrates logging at various
+example is provided in the form of a `main.go` file, which demonstrates
-levels using structured logging syntax.
+logging at various levels using structured logging syntax.
 ```go
 package main
@@ -71,59 +73,59 @@ func main() {
 ## Attribute output
 Attributes reach every handler: the ones passed to the log call, the ones
-accumulated with `WithAttrs`, and the ones qualified by the groups open at the
+accumulated with `WithAttrs`, and the ones qualified by the groups open at
-time they were attached. `slog.Group` values nest, and `slog.LogValuer` values
+the time they were attached. `slog.Group` values nest, and
-are resolved to the value they stand for. A few behaviours are worth knowing
+`slog.LogValuer` values are resolved to the value they stand for. A few
-before you rely on them.
+behaviours are worth knowing before you rely on them.
-**Your values are never modified.** Whatever you log is read and rendered, never
+**Your values are never modified.** Whatever you log is read and rendered,
-written to. A map or a slice you pass to `slog.Any` comes back from the logger
+never written to. A map or a slice you pass to `slog.Any` comes back from
-exactly as you handed it over, even when a group later uses the same key.
+the logger exactly as you handed it over, even when a group later uses the
 same key.
-**Durations are nanoseconds in json, and readable on the console.** The json and
+**Durations are nanoseconds in json, and readable on the console.** The
-webhook payloads emit a `slog.Duration` as a number of nanoseconds, matching
+json and webhook payloads emit a `slog.Duration` as a number of
-`slog.NewJSONHandler`, so a consumer can compare and aggregate the field without
+nanoseconds, matching `slog.NewJSONHandler`, so a consumer can compare and
-parsing it. The console line emits the same duration as `3s`, matching
+aggregate the field without parsing it. The console line emits the same
-`slog.NewTextHandler`, because a person reads it.
+duration as `3s`, matching `slog.NewTextHandler`, because a person reads
 it.
-**The json payload is an object, with the consequences an object has.** The
+**The json payload is an object, with the consequences an object has.**
-record's own fields are named `Time`, `Level`, `Message` and `PC`, and they own
+The record's own fields are named `Time`, `Level`, `Message` and `PC`, and
-those names: an attribute keyed after one of them is dropped from the json and
+they own those names: an attribute keyed after one of them is dropped from
-webhook output. A key logged more than once keeps its last value there for the
+the json and webhook output. A key logged more than once keeps its last
-same reason, with one exception: when both are `slog.Group` values sharing a
+value there for the same reason, with one exception: when both are
-key, the two groups are merged into one object holding the members of both,
+`slog.Group` values sharing a key, the two groups are merged into one
-rather than the second replacing the first. Neither the collision nor the merge
+object holding the members of both, rather than the second replacing the
-applies to the console output, which is a line of text: every pair appears, in
+first. Neither the collision nor the merge applies to the console output,
-order. If you need a field called `message`, pick a key that does not collide -
+which is a line of text: every pair appears, in order. If you need a field
-the collision is silent.
+called `message`, pick a key that does not collide - the collision is
 silent.
-**Empty things follow the `slog.Handler` contract.** An empty `Attr` is ignored,
+**Empty things follow the `slog.Handler` contract.** An empty `Attr` is
-an empty group is elided along with its key, a group with an empty key is
+ignored, an empty group is elided along with its key, a group with an
-inlined into its parent, and `WithGroup("")` returns the handler unchanged.
+empty key is inlined into its parent, and `WithGroup("")` returns the
 handler unchanged.
 ## When delivery fails
-Every handler returns an error from `Handle` when it could not deliver the
+Every handler returns an error from `Handle` when it could not deliver
-record:
+the record:
- `ConsoleHandler` and `JSONHandler` return the error from their write to
+-   `ConsoleHandler` and `JSONHandler` return the error from their write to
-  stdout, wrapped, so `errors.Is` still matches the original
+    stdout, wrapped, so `errors.Is` still matches the original
- `WebhookHandler` returns an error when the request fails, and also when the
+-   `WebhookHandler` returns an error when the request fails, and also when
-  server answers with a status outside 2xx, a redirect included, since it does
+    the server answers with a status outside 2xx
-  not follow redirects. A request that has not finished after 5 seconds fails
+-   `MultiplexHandler`, which simplelog installs as the default, passes the
-  with a timeout error, so a webhook server that never answers holds up a log
+    record to every handler it holds even after one of them fails, then
-  call for 5 seconds at most
+    returns all their errors joined with `errors.Join` (nil if none failed)
 - `MultiplexHandler`, which simplelog installs as the default, passes the record
  to every handler it holds even after one of them fails, then returns all their
  errors joined with `errors.Join` (nil if none failed)
-`slog.Info`, `slog.Error` and the other `slog.Logger` methods throw that error
+`slog.Info`, `slog.Error` and the other `slog.Logger` methods throw that
-away. That is how `log/slog` works, and simplelog cannot change it. To find out
+error away. That is how `log/slog` works, and simplelog cannot change it.
-whether a record was delivered, build a `slog.Record` and pass it to the handler
+To find out whether a record was delivered, build a `slog.Record` and pass
-yourself, for example `slog.Default().Handler().Handle(ctx, record)`, then check
+it to the handler yourself, for example
-the error it returns. Console output takes the file and line from the record's
+`slog.Default().Handler().Handle(ctx, record)`, then check the error it
-`PC`, which you set with `runtime.Callers` as the `log/slog` documentation
+returns.
 shows. A record whose `PC` is zero prints `???:0` instead.
 ## Entrypoints
@@ -134,36 +136,26 @@ development workflow, and the Makefile targets are thin shims that call them.
 The scripts are POSIX sh (not bash) so they run in minimal containers such as
 alpine. We provide:
- `script/bootstrap` — install all dependencies (go if missing, goimports with
+- `script/bootstrap` — install all dependencies (go and golangci-lint if
-  `go install` at a pinned commit unless the installed one already reports the
+  missing, then `go mod download`)
  pinned version, then `go mod download`; node through nvm at a pinned version
  if node is missing, yarn at a pinned version if it is missing, then the
  `prettier` that `package.json` and `yarn.lock` pin); golangci-lint is not
  installed, since it runs only in Docker
 - `script/setup` — set up the repo for development after a fresh clone: runs
  `script/bootstrap`, then `script/install-precommit`
 - `script/projectname` — output the project name (our own extension); used by
  `script/docker` for the image tag
- `script/test` — run the test suite under the race detector in Docker by
+- `script/test` — run the test suite (`go test -v ./...`)
-  building only the `test` stage of the `Dockerfile`, without the build cache,
+- `script/lint` — run golangci-lint
-  so every run tests; the image is tagged `simplelog-test`
+- `script/fmt` — format all files (goimports plus `golangci-lint run --fix`;
- `script/lint` — run golangci-lint in Docker by building only the `lint` stage
+  writes)
-  of the `Dockerfile`, without the build cache, so every run lints; the image is
+- `script/fmt-check` — check formatting (read-only); fails if `gofmt -l`
-  tagged `simplelog-lint`
+  reports files
 - `script/fmt` — format all files (writes): Go with the goimports that
  `script/bootstrap` installs, then every `*.md` file with `prettier`
 - `script/fmt-check` — check formatting (read-only); fails if `gofmt -l` reports
  files, or if `prettier` would change any `*.md` file
 - `script/check` — run all checks: `test`, `lint`, `fmt-check` (our own
  extension)
- `script/docker` — build the Docker image without the build cache, tagged via
+- `script/docker` — build the Docker image, tagged via `script/projectname`
-  `script/projectname` (byte-identical across repos); it also passes the output
+  (byte-identical across repos)
-  of `git describe` as the `VERSION` build argument, which is ignored because
+- `script/cibuild` — cd to the repo root and `docker build .` (what CI runs;
-  this `Dockerfile` does not declare it
+  the image build runs the checks)
- `script/cibuild` — what CI runs: `script/bootstrap`, then `script/check`, then
+- `script/precommit` — run by the git pre-commit hook (our own extension);
-  the same image build as `script/docker` (byte-identical across repos)
+  runs a `go mod tidy` guard, then `script/check`
 - `script/precommit` — run by the git pre-commit hook (our own extension); runs
  a `go mod tidy` guard, then `script/check`
 - `script/install-precommit` — installs the git pre-commit hook (our own
  extension); `make hooks` shims to it
@@ -1,6 +1,6 @@
 ---
 title: Repository Policies
-last_modified: 2026-10-04
+last_modified: 2026-07-06
 ---
 This document covers repository structure, tooling, and workflow standards. Code
@@ -60,28 +60,17 @@ style conventions are in separate documents:
  prerequisite since nvm requires bash. yarn is then pinned via
  `corepack prepare yarn@<version> --activate`. Never install "latest" or "lts";
  always exact versions. `script/cibuild` runs the CI build: it changes to the
-  repo root, runs `script/bootstrap`, runs `script/check`, and builds the image
+  repo root and runs `docker build .`; the Gitea workflow calls it. Four further
-  with the version; the Gitea workflow calls it. **`script/cibuild` runs
+  scripts are our own extensions to the standard: `script/check` runs
-  `script/bootstrap` first**, because the workflow checks out the repo and runs
+  `script/test`, `script/lint`, and `script/fmt-check`; `script/precommit` is
-  nothing else, while `script/fmt-check` runs the formatter on the host: on a
+  what the git pre-commit hook runs, and it calls `script/check`;
-  pristine checkout with nothing installed the run dies there, after the
+  `script/install-precommit` installs the git pre-commit hook (the `make hooks`
-  containerised gates have passed. **The bootstrap alone is not enough**:
+  target shims to it); and `script/projectname` (literally that filename) simply
-  `script/bootstrap` installs node and yarn under nvm and leaves neither on the
+  outputs the project's name. Scripts that need the name call
-  `PATH` of the shell that called it, so a bare `yarn` still exits 127. The host
+  `script/projectname` — e.g. `script/docker` assembles its image tag from it —
-  entrypoints that need yarn — `script/fmt` and `script/fmt-check` — therefore
+  so those scripts stay byte-identical across all repos. Repo-type-specific
-  source nvm for the pinned node version before invoking it, exactly as
+  pre-commit extras (e.g. `go mod tidy` verification in Go repos) belong in
-  `script/bootstrap`'s own install step does. A runner carrying nothing but
+  `script/precommit`, not in the hook itself. Model scripts are at
  docker and git then gets through `script/check`. Four further scripts are our
  own extensions to the standard: `script/check` runs `script/test`,
  `script/lint` and `script/fmt-check`; `script/precommit` is what the git
  pre-commit hook runs, and it calls `script/check`; `script/install-precommit`
  installs the git pre-commit hook (the `make hooks` target shims to it); and
  `script/projectname` (literally that filename) simply outputs the project's
  name. Scripts that need the name call `script/projectname` — e.g.
  `script/docker` assembles its image tag from it — so those scripts stay
  byte-identical across all repos. Repo-type-specific pre-commit extras (e.g.
  `go mod tidy` verification in Go repos) belong in `script/precommit`, not in
  the hook itself. Model scripts are at
  `https://git.eeqj.de/sneak/prompts/raw/branch/main/script/<name>`. The README
  must document the provided scripts in an **Entrypoints** section (see the
  README requirements below).
@@ -100,198 +89,87 @@ style conventions are in separate documents:
  contributor should be able to understand the entire development workflow by
  reading the Makefile.
- Every repo should have a `Dockerfile`, and it carries the repo's gates: a
+- Every repo should have a `Dockerfile`. All Dockerfiles must run `make check`
-  `lint` phase and a `test` phase, with the final stage depending on both so the
+  as a build step so the build fails if the branch is not green. For non-server
-  image cannot be built unless they pass. For non-server repos the final stage
+  repos, the Dockerfile should bring up a development environment and run
-  brings up a development environment; for server repos it is the runtime image.
+  `make check`. For server repos, `make check` should run as an early build
-  The gate phases and the build stage start from their pinned base images and
+  stage before the final image is assembled. Dockerfiles install development
-  install what those images lack either inline, as the canonical Go `Dockerfile`
+  prerequisites by running `script/bootstrap` rather than duplicating installs
-  below does for `git`, or by running `script/bootstrap`, as the `prompts`
+  inline; COPY `script/` and the dependency manifests (`package.json` +
-  repo's own `Dockerfile` does for its yarn packages. The development
+  `yarn.lock`, `go.mod` + `go.sum`, etc.) before running it so the bootstrap
-  environment stage installs development prerequisites by running
+  layer stays cached until dependencies change.
  `script/bootstrap` rather than duplicating its installs inline. A stage that
  runs `script/bootstrap` COPYs `script/` and the dependency manifests
  (`package.json` + `yarn.lock`, `go.mod` + `go.sum`, etc.) before running it.
- **Linting and testing run in Docker, as phases of the `Dockerfile`.** There is
+- **Dockerfiles must use a separate lint stage for fail-fast feedback.** Go
-  no separate lint file. `script/lint` and `script/test` each build one phase
+  repos use a multistage build where linting runs in an independent stage based
-  and nothing else:
+  on the `golangci/golangci-lint` image (pinned by hash). This stage runs
  `make fmt-check` and `make lint` before the full build begins. The build stage
  then declares an explicit dependency on the lint stage via
  `COPY --from=lint /src/go.sum /dev/null`, which forces BuildKit to complete
  linting before proceeding to compilation and tests. This ensures lint failures
  surface in seconds rather than minutes, without blocking on dependency
  download or compilation in the build stage.
-    ```sh
+    The standard pattern for a Go repo Dockerfile is:
    docker build --no-cache --target lint -t "$(script/projectname)-lint" .
    docker build --no-cache --target test -t "$(script/projectname)-test" .
    ```
    **A stage that is not the last one in the file is built only when the final
    stage's chain depends on it, or when `--target` names it.** That is why the
    two gates are always invoked by name here, and why the final stage carries a
    `COPY --from=` of a harmless file from each of them: without that edge a
    plain `docker build .` builds the last stage alone and exits 0 having linted
    and tested nothing.
    **Every `docker build` in `script/` is tagged**, here and in
    `script/cibuild` and `script/docker`. An untagged build leaves a dangling
    image behind on every invocation, on every developer host and every CI
    runner; a tagged one replaces the previous image.
    Inside a phase the tool is invoked directly — `golangci-lint`, `go test`,
    `eslint`, `prettier` — never through `make lint` or `script/test`, which are
    themselves a `docker build` and would recurse into a daemon that does not
    exist in a build step. Formatting is the exception and stays on the host:
    `script/fmt` writes the working tree, and `script/fmt-check` is its
    read-only twin.
    **No lint verdict may come from a host invocation of the linter.** On a
    shared host golangci-lint reads a result cache keyed on file content rather
    than location, so a second checkout of the same content is served the first
    one's findings, and a host-global lock in `$TMPDIR` makes concurrent runs
    exit non-zero with `parallel golangci-lint is running` — a status a caller
    cannot tell from real findings. Both have produced wrong verdicts in this
    org, in both directions. A container has its own cache, its own `TMPDIR` and
    a digest-pinned binary, so neither is reachable.
 - **Any build that runs checks is built with `--no-cache`.** Docker invalidates
  a `COPY` layer only when the copied content changes, so on an unchanged tree
  the check `RUN` is served from cache, nothing executes, and the build still
  exits 0. Every `docker build` in `script/` therefore passes `--no-cache`:
  `script/lint`, `script/test`, `script/cibuild` and `script/docker` are the
  four, and there is no fifth — `script/check` runs the two gate phases and
  `script/fmt-check`, and builds no image of its own. A bare `docker build .` is
  not evidence that anything ran: a sub-second build reporting success is a
  cache hit, not a result. Never invalidate by pruning — `docker builder prune`
  and friends destroy a build cache shared with every other build on the host.
  When a check is added or changed, prove it works by planting a defect it must
  catch and watching the run fail on it, then revert the defect. A green run
  alone shows neither that the check ran nor that it covers what it should.
 - **The gate phases are separate stages, and the build stage depends on both.**
  The lint phase is based on the `golangci/golangci-lint` image (pinned by
  hash), so lint failures surface in seconds rather than after a full compile,
  and the test phase is based on the Debian Go image. The canonical Go repo
  `Dockerfile`:
    ```dockerfile
-    # Lint phase
+    # Lint stage — fast feedback on formatting and lint issues
    # golangci/golangci-lint:v2.x.x, YYYY-MM-DD
    FROM golangci/golangci-lint@sha256:... AS lint
    WORKDIR /src
    COPY go.mod go.sum ./
    RUN go mod download
    COPY . .
-    RUN golangci-lint run --config .golangci.yml ./...
+    RUN make fmt-check
    RUN make lint
-    # Test phase. -race needs cgo and so a C compiler, which the Debian Go
+    # Build stage
    # image ships and the alpine one does not.
    # golang:1.x, YYYY-MM-DD
    FROM golang@sha256:... AS test
    WORKDIR /src
    COPY go.mod go.sum ./
    RUN go mod download
    COPY . .
    RUN go test -timeout 90s -race -cover ./... || \
        { echo "--- Rerunning with -v for details ---"; \
          go test -timeout 90s -race -v ./...; exit 1; }
    # Build stage. Nothing is wanted from either phase above; the copies
    # are what make BuildKit build them first, so this stage cannot run
    # unless lint and test passed.
    # golang:1.x-alpine, YYYY-MM-DD
    FROM golang@sha256:... AS builder
    COPY --from=lint /src/go.sum /dev/null
    COPY --from=test /src/go.sum /dev/null
    RUN apk add --no-cache git
    # A tar-stream context keeps the sender's file owners, which git refuses.
    RUN git config --system --add safe.directory /src
    WORKDIR /src
    # Force BuildKit to run the lint stage before proceeding
    COPY --from=lint /src/go.sum /dev/null
    COPY go.mod go.sum ./
    RUN go mod download
    COPY . .
    RUN make test
-    # The VERSION build arg when one is given, otherwise
+    ARG VERSION=dev
-    # `git describe --tags --always` on the .git in the build context. With
+    RUN CGO_ENABLED=0 go build -trimpath \
-    # .git present, a version that is still empty, dev or unknown fails the
+        -ldflags="-s -w -X main.Version=${VERSION}" \
-    # build: git is missing or could not read the checkout.
+        -o /app ./cmd/app/
    ARG VERSION
    RUN VERSION="${VERSION:-$(git describe --tags --always)}"; \
        if [ -e .git ]; then \
            case "$VERSION" in ""|dev|unknown) \
                echo "version is '$VERSION' although .git is present" >&2; \
                exit 1 ;; \
            esac; \
        fi; \
        CGO_ENABLED=0 go build -trimpath \
            -ldflags="-s -w -X main.Version=${VERSION}" \
            -o /app ./cmd/app/
-    # Runtime stage, and the last one
+    # Runtime stage
    FROM alpine@sha256:...
    COPY --from=builder /app /usr/local/bin/app
    ENTRYPOINT ["app"]
    ```
    Key points:
-    - The lint phase uses the `golangci/golangci-lint` image directly (it has
+    - The lint stage uses the `golangci/golangci-lint` image directly (it
-      both Go and the linter), so nothing needs installing.
+      includes both Go and the linter), so there is no need to install the
-    - `COPY --from=<phase> /src/go.sum /dev/null` is a no-op copy whose only
+      linter separately.
-      purpose is the ordering edge. BuildKit runs stages in parallel by default,
+    - `COPY --from=lint /src/go.sum /dev/null` is a no-op file copy that creates
-      and a stage nothing depends on is not built at all, so without these two
+      a stage dependency. BuildKit runs stages in parallel by default; without
-      lines a red gate would not fail the build.
+      this line, the build stage would not wait for lint to finish and a lint
-    - Keep the runtime stage last, and if you add a stage after it, give it the
+      failure might not fail the overall build.
      same two copies. A plain `docker build .` builds the last stage's chain
      and nothing else.
    - If the project uses `//go:embed` directives that reference build artifacts
-      (e.g. a web frontend compiled in a separate stage), the lint phase must
+      (e.g. a web frontend compiled in a separate stage), the lint stage must
      create placeholder files so the embed directives resolve. Example:
      `RUN mkdir -p web/dist && touch web/dist/index.html web/dist/style.css`.
-    - If the project requires CGO or system libraries for linting, install them
+      The lint stage should not depend on the actual build output — it exists to
-      in the lint phase. The `golangci/golangci-lint` image is Debian-based and
+      fail fast.
-      has no `apk`, so install with `apt-get` under the Debian package name
+    - If the project requires CGO or system libraries for linting (e.g.
-      (`libvips-dev`, where alpine says `vips-dev`), and delete the package
+      `vips-dev`), install them in the lint stage with `apk add`.
-      lists in the same `RUN`, so the layer does not keep them:
+    - The build stage runs `make test` after compilation setup. Tests run in the
-
+      build stage, not the lint stage, because they may require compiled
-        ```dockerfile
+      artifacts or heavier dependencies.
        RUN apt-get update \
            && apt-get install -y --no-install-recommends libvips-dev \
            && rm -rf /var/lib/apt/lists/*
        ```
    - `.dockerignore` lets `.git` into the build context. It keeps out every git
      `config` at any depth (`**/.git/config`, `**/.git/modules/**/config`): the
      repository's own, each submodule's under `.git/modules/`, and that of a
      submodule keeping its own `.git` directory. `git describe` does not need
      them, and each can hold a credential: a password in a remote URL, or the
      token the CI checkout step stores there. A submodule whose name has a
      `config` segment (`config`, `deploy/config`, `config/lib`) loses its whole
      git directory to `**/.git/modules/**/config`, and Go's version stamping
      then fails the build: give it a name without that segment
      (`git submodule add --name`). The stage that compiles has `git` (the
      Debian Go image has it; an alpine one needs `apk add --no-cache git`) and
      takes the version from the `VERSION` build argument when one is given,
      otherwise from `git describe --tags --always`. That gives the tag on a
      tagged commit; on a later commit, the tag, the number of commits since it
      and the short commit (`v1.2.3-4-gabc1234`); and the short commit when no
      tag is reachable. The stage that compiles also marks its working directory
      safe for git (`git config --system --add safe.directory /src`): a context
      sent as a tar stream keeps the sender's file owners, and git refuses a
      checkout owned by another user, so the version would come out empty.
      `ARG VERSION` has no default, and the build fails if the context carries
      `.git` and the version still comes out empty, `dev` or `unknown`. A plain
      `docker build .` with no build arguments must succeed; a Dockerfile that
      refuses an empty build argument drops that refusal and keeps the argument.
 - Every repo should have a Gitea Actions workflow (`.gitea/workflows/`) that
-  runs `script/cibuild` on push, and checks out the repo as its only other step.
+  runs `script/cibuild` (which runs `docker build .`) on push. Since the
-  That script bootstraps, runs the gate phases, and then builds the image, so a
+  Dockerfile already runs `make check`, a successful build implies all checks
-  successful run means every check passed; a bare `docker build .` does not
+  pass.
  carry the same guarantee, because its gate phases may come from the cache. The
  image build is uncached and so runs the gate phases a second time. That is the
  price of the rule above, and it is worth paying: the image that ships is built
  from a run of its own gates rather than from a cache entry. A separate
  workflow limited to `main` by a `branches` list under `on: push` cannot be
  checked by review: to try a change to it, add the feature branch to that list
  and push, then remove the branch from the list again before merging. Keep any
  job in it that publishes behind `if: github.ref_name == 'main'`, so the run
  from the feature branch publishes nothing.
 - Use platform-standard formatters: `black` for Python, `prettier` for
  JS/CSS/Markdown/HTML, `go fmt` for Go. Always use default configuration with
@@ -311,21 +189,14 @@ style conventions are in separate documents:
  module under test to verify it compiles/parses. There is no excuse for
  `make test` to be a no-op.
- `make test` must complete in under 60 seconds. That is the hard cap, and a
+- `make test` must complete in under 20 seconds. Add a 30-second timeout in the
-  suite that exceeds it fails. Under 20 seconds is the target. A suite between
+  Makefile.
  20 and 60 seconds is still green, but the overage must be filed as an
  improvement bug against that repo. Add a 90-second timeout to the test
  invocation (`go test -timeout 90s`). The backstop deliberately sits above the
  hard cap so that it catches a genuinely hung test rather than a merely slow
  one.
- **The test command should use the conditional verbose rerun pattern.** Run
+- **`make test` should use the conditional verbose rerun pattern.** Run tests
-  tests without `-v` (verbose) first. If tests fail, automatically rerun with
+  without `-v` (verbose) first. If tests fail, automatically rerun with `-v` to
-  `-v` to show full output. This keeps CI logs and `docker build` output clean
+  show full output. This keeps CI logs and `docker build` output clean on
-  on success (just package/suite summaries) while providing full diagnostic
+  success (just package/suite summaries) while providing full diagnostic detail
-  detail on failure (every test case, every assertion). The command lives in the
+  on failure (every test case, every assertion). The general shell pattern:
  `test` phase of the `Dockerfile`, since `script/test` builds that phase; the
  Makefile form below is the same pattern for any repo-local invocation:
    ```makefile
    test:
@@ -338,26 +209,11 @@ style conventions are in separate documents:
    ```makefile
    test:
-    	@go test -count=1 -timeout 90s -race -cover ./... || \
+    	@go test -timeout 30s -race -cover ./... || \
    		{ echo "--- Rerunning with -v for details ---"; \
-    		  go test -count=1 -timeout 90s -race -v ./...; exit 1; }
+    		  go test -timeout 30s -race -v ./...; exit 1; }
    ```
    `-count=1` is required on both invocations: it defeats Go's test _result_
    cache, so neither run can report a stored pass in place of running the
    tests. It leaves the build cache alone, so it costs the runtime of the suite
    and no recompilation.
    That cache is Go's own, separate from Docker's layer cache. Go stores a
    passing result in its cache directory (`GOCACHE`), and when the same tests
    run again on unchanged code it prints that result, marked `(cached)`,
    without running them. That matters on a developer's machine, where this
    target runs and the directory lasts from one run to the next. The `test`
    phase of the `Dockerfile` needs no `-count=1`: its base image holds no
    result for this repo's tests and nothing before its `go test` step runs a
    test, so there is nothing to replay. `--no-cache` (above) is what makes that
    step run on an unchanged tree.
    Python example:
    ```makefile
@@ -383,84 +239,10 @@ style conventions are in separate documents:
  must be in `.gitignore`. No exceptions.
 - `.gitignore` should be comprehensive from the start: OS files (`.DS_Store`),
-  editor files (`.swp`, `*~`), in-repo agent scratch directories (`.claude/`),
+  editor files (`.swp`, `*~`), language build artifacts, and `node_modules/`.
-  language build artifacts, and `node_modules/`. Fetch the standard `.gitignore`
+  Fetch the standard `.gitignore` from
-  from `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitignore` when
+  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitignore` when setting up
-  setting up a new repo. These patterns are written to `.gitignore`'s own
+  a new repo.
  semantics, in which an unanchored pattern already matches at every depth; they
  are not a `.dockerignore` and must not be transplanted into one unmodified.
 - **`.dockerignore` does not use `.gitignore` semantics, and copying patterns
  across unmodified leaves secrets in the build context.** Docker matches with
  `moby/patternmatcher`: `filepath.Match` semantics plus a `**` extension, so
  `*` does not cross `/` and a pattern without a leading `**/` is anchored at
  the build-context root. A `.dockerignore` listing `.env`, `*.pem` and `*.key`
  therefore excludes only the copies at the repository root, while `config/.env`
  and `certs/server.key` still reach the context and can land in an image layer
  — which is more dangerous than a short file with no secret patterns at all,
  because it reads as solved and stops anyone looking. Give every
  depth-independent pattern the `**/` prefix and leave only genuinely
  root-anchored entries unprefixed: `.claude`, and the repo's own host-built
  binary, written `/myapp` and never `**/myapp`, which would also match
  `cmd/myapp/` and delete the package directory from the context. Matching is
  case-sensitive, and an ALL-CAPS twin per pattern still misses `Server.Key`, so
  secret names use character ranges — `**/*.[kK][eE][yY]`, `**/*.[pP][eE][mM]`,
  and likewise for `.envrc` and the extensionless SSH keys. Where such a pattern
  also catches something the build needs, re-include it with a negation
  (`!docs/example.env`); deleting the pattern reopens the exposure for every
  other file it covers. Fetch the standard `.dockerignore` from
  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.dockerignore` and extend
  it with the repo's own artifacts.
 - **In-repo agent scratch belongs in both files, written to each file's own
  semantics.** `.claude/` holds one worktree per in-flight agent — an entire
  additional checkout of the repo — so under `COPY . .` the build context
  inflates by a multiple of the repo and another session's unreviewed work can
  be copied into an image layer. In `.gitignore` the entry is `.claude/`,
  unanchored. In `.dockerignore` it is `.claude`, anchored and with **no** `**/`
  prefix, because the prefixed form would also delete any nested directory of
  that name from the build. Anchoring carries a known gap that the canonical
  `.dockerignore` states in its own comment, since consuming repos receive the
  file and not the tracker: the directory is created in the agent's working
  directory, so a repo running agents in subdirectories still ships
  `services/api/.claude/` and must add its own anchored entry there.
 - **A plain `docker build .` of a clone stamps the version that
  `git describe --tags --always` gives**, derived from the `.git` in the build
  context as the canonical `Dockerfile` above shows. Without its failure check,
  a missing `git` or an unreadable checkout would leave `-X main.Version=` empty
  and the build would still exit 0. `script/docker` and `script/cibuild` pass
  the version they compute on the host; it takes precedence. They do this
  byte-identically across repos:
    ```sh
    # Own line: a failing command substitution inside an argument does not
    # trip `set -e`, so the inline form degrades to an empty constant.
    version="$(git describe --tags --always --dirty 2>/dev/null || true)"
    [ -n "$version" ] || version="unknown"
    docker build --no-cache \
        --build-arg VERSION="$version" \
        -t "$(script/projectname)" .
    ```
    `--always` makes an untagged repo yield an abbreviated commit hash rather
    than failing, and the `[ -n "$version" ]` line is the single place the
    fallback is applied — a live check that fires on a build from an export with
    no `.git` and on a repository with no commits yet. Do not fold it into the
    substitution as `|| echo unknown`, which makes the guard unreachable. The
    Dockerfile's side is `ARG VERSION` in the stage that compiles, declared
    there because `ARG` is stage-scoped; passing `VERSION` to a repo whose
    Dockerfile declares no such `ARG` is ignored and costs nothing, which is why
    the scripts stay byte-identical. One consequence for CI: the standard
    checkout action clones shallow and fetches no tags, so a repo that embeds a
    tag-derived version must set `fetch-depth: 0` on its checkout step.
 - **Verify `.dockerignore` by enumerating the image, not by reading the
  patterns.** Plant files at the root _and_ at least two directories deep, build
  a probe image that does `COPY . .`, and list what actually landed
  (`docker run --rm --entrypoint find IMAGE /app`). The `transferring context`
  size is not a substitute: a nested secret is a few bytes, and BuildKit
  transfers only the delta from the previous build.
 - **No build artifacts in version control.** Code-derived data (compiled
  bundles, minified output, generated assets) must never be committed to the
@@ -476,56 +258,9 @@ style conventions are in separate documents:
 - Make all changes on a feature branch. You can do whatever you want on a
  feature branch.
- `.golangci.yml` is standardized. The vendored copy in a consuming repo must
+- `.golangci.yml` is standardized and must _NEVER_ be modified by an agent, only
-  _NEVER_ be modified by an agent: fetch it from
+  manually by the user. Fetch from
-  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml` and keep it
+  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml`.
  byte-identical, so that no repo can quietly loosen its own linting. Linter
  configuration changes are made to the canonical copy in the `prompts` repo and
  reach consuming repos by re-vendoring; an agent may open a PR against
  canonical, which only the user merges. One list is exempt from byte-identity,
  because it cannot be written once for every repo: the `deny` list of the
  `test-support` depguard rule, where a repo names its own test-support packages
  by full import path. A repo adds entries there and changes nothing else, and a
  re-vendor carries its entries forward. The canonical golangci-lint version is
  v2.14.0 (released 2026-09-24), pinned as the digest of the lint phase's base
  image
  (`golangci/golangci-lint@sha256:ad862ba6b3798cbe0fd9fd7408d498fd74fbd2623a92406b2fd3898faf0bf98f`,
  which reports `2.14.0 built with go1.27.0 from 114493f9`). A module's `go`
  directive must not name a newer Go minor version than the one golangci-lint
  was built with, or golangci-lint refuses to lint it: this release lints
  `go 1.27.1` but not `go 1.28`. That digest is the only pin, since no repo
  installs golangci-lint on the host. A repo sets the lint phase digest to the
  one named here and re-vendors `.golangci.yml` in the same commit, whichever of
  the two prompted the change: the canonical copy can name linters that an older
  golangci-lint rejects, and a newer golangci-lint can add linters that
  `default: all` switches on until the canonical copy disables them.
 - **`script/bootstrap` installs a pinned tool by comparing versions, never by
  testing presence.** An `if ! command -v <tool>; then install; fi` guard tests
  `PATH` only, so on an already-provisioned machine the pin is inert and a
  version bump is a silent no-op — while the Dockerfile, installing into a clean
  image, gets the pinned version, so a local `make check` and `make docker` can
  disagree about what the tool even is. The canonical form:
    - compares the installed version against the pin over the **whole** version
      token; a parser that stops at the first `-` reports `2.12.2` for a host
      running `2.12.2-rc1` and skips the install;
    - treats absent, non-zero, empty or unrecognised `--version` output as a
      mismatch, so the failure direction is a redundant install and never a
      skipped one;
    - after installing, re-resolves the binary the way callers do — `hash -r`,
      then through `PATH`, not through the directory the installer wrote to —
      and fails naming the resolved path, since an install that a shadowing
      binary hides succeeds while changing nothing any caller sees;
    - is actually called, and prints the version on both success paths: a
      function defined and never invoked has the same exit status and the same
      empty output as one that worked.
    Keep it POSIX sh: no arrays, no `[[`, no `grep -P`.
    A Go tool a repo needs on the host is installed with `go install` pinned to
    a commit hash (`go install <package>@<commit hash>`). It is never tracked as
    a `go.mod` tool dependency or through a `tools.go` file, either of which
    pulls the tool's own dependencies into the repo's `go.mod` and `go.sum`.
 - When pinning images or packages by hash, add a comment above the reference
  with the version and date (YYYY-MM-DD).
@@ -639,14 +374,12 @@ style conventions are in separate documents:
  settings.
 - Avoid putting files in the repo root unless necessary. Root should contain
-  only project-level config files (`README.md`, `AGENTS.md`, `Makefile`,
+  only project-level config files (`README.md`, `Makefile`, `Dockerfile`,
-  `Dockerfile`, `LICENSE`, `.gitignore`, `.editorconfig`, `REPO_POLICIES.md`,
+  `LICENSE`, `.gitignore`, `.editorconfig`, `REPO_POLICIES.md`, and
-  and language-specific config). Everything else goes in a subdirectory.
+  language-specific config). Everything else goes in a subdirectory. Canonical
-  Canonical subdirectory names:
+  subdirectory names:
    - `bin/` — executable scripts and tools
-    - `cmd/` — Go command entrypoints; thin only: one `main.go` per binary whose
+    - `cmd/` — Go command entrypoints
      body is a single call into `internal/` or `pkg/`, no project logic in
      `cmd/`
    - `configs/` — configuration templates and examples
    - `deploy/` — deployment manifests (k8s, compose, terraform)
    - `docs/` — documentation and markdown (README.md stays in root)
@@ -673,7 +406,3 @@ style conventions are in separate documents:
    - Go: `go.mod`, `go.sum`, `.golangci.yml`
    - JS: `package.json`, `yarn.lock`, `.prettierrc`, `.prettierignore`
    - Python: `pyproject.toml`
 - Guidance for coding agents lives in one `AGENTS.md` at the repository root. It
  is never committed under a file or directory named after one agent tool, such
  as `CLAUDE.md` or `.claude/`, and never split into separate memory files.
@@ -1,89 +1,70 @@
 # Workflow
- branch (from `main`)
+* branch (from `main`)
- do the work in Next Step
+* do the work in Next Step
- move Next Step to the top of Completed Steps
+* move Next Step to the top of Completed Steps
- move the top item of Future Steps into Next Step
+* move the top item of Future Steps into Next Step
- commit (`TODO.md` changes in the same commit as the work)
+* commit (`TODO.md` changes in the same commit as the work)
- merge to `main` if the branch is not protected, otherwise open a PR
+* merge to `main` if the branch is not protected, otherwise open a PR
- push
+* push
 # Status
 1.0+
-Tagged v1.0.0 (2024-06-14) and 1.0.1 (2026-02-08). In post-1.0 maintenance; the
+Tagged v1.0.0 (2024-06-14) and 1.0.1 (2026-02-08). In post-1.0
-library is referenced by the Go styleguide.
+maintenance; the library is referenced by the Go styleguide.
 # Next Step
-Restructure README.md into the standard sections: Description, Getting Started,
+Bring the Makefile up to policy in one commit: add fmt-check, check, and
-Rationale, Design, TODO, License, Author
+hooks targets (test/lint/fmt/docker exist) and add the missing policy
 files it depends on: .golangci.yml, REPO_POLICIES.md, .editorconfig,
 .dockerignore, and .gitea/workflows/check.yml running make check.
 # Completed Steps
- 2026-10-06: `make fmt` and `make fmt-check` also format Markdown, with
+* 2026-10-06: every handler now returns a failed delivery from Handle
-  `prettier` at the standard settings, pinned through `package.json` and
+    instead of discarding it: console and JSON return the stdout write
-  `yarn.lock`; `script/bootstrap` installs node and yarn for it, and the
+    error, the webhook also fails on a non-2xx answer, and the multiplex
-  existing Markdown was formatted once
+    delivers to every handler and returns their errors joined
- 2026-10-06: re-vendored the standard files from `sneak/prompts` at commit
+* 2026-08-10: fixed every handler discarding slog attributes: console,
-  `dd4027b`: `REPO_POLICIES.md`, the CI workflow, `.gitignore`, and
+    JSON and webhook handlers now emit record attributes, accumulate
-  `.golangci.yml` together with the lint stage's new image, plus the
+    WithAttrs without mutating the receiver, and honour WithGroup;
-  `.editorconfig` and `.dockerignore` this repo lacked, which finishes the
+    slog.Group values nest and LogValuer values are resolved; console
-  Makefile and policy-files step. `script/cibuild` now bootstraps and runs
+    keys and values holding invalid UTF-8 are quoted
-  `script/check` before building the image, the format check runs only on the
+* 2026-08-07: added canonical `.golangci.yml` (v2 schema), pinned the
-  host, the last `Dockerfile` stage runs `script/bootstrap`, which installs
+    `Dockerfile` lint stage to golangci-lint v2.12.2 (tag+digest), and
-  goimports at a pinned commit
+    fixed all findings the v1→v2 jump surfaced without changing any
- 2026-10-06: a webhook request now times out after 5 seconds, so a server that
+    exported signatures or behavior
-  never answers no longer stops every log call; the webhook handler also reads
+- 2026-07-07 Adopted scripts-to-rule-them-all: `script/` entrypoints,
-  each answer to the end so its connection is reused
+    Makefile shims, README Entrypoints section
- 2026-10-06: the console handler takes the file and line it prints from the
+* 2026-02-08: fixed JSONHandler deadlock from recursive log.Println,
-  record's `PC` instead of counting stack frames, so they name the call site
+    with regression test; tagged 1.0.1
-  whether the record came through a `slog.Logger` or straight to `Handle`
+* 2024-06-14: 1.0 prep: lint and fmt enforced in Docker build, call
- 2026-10-06: the tests run under the race detector, in Docker: `script/test`
+    stack depth fix so log locations report correctly, example script,
-  builds the `test` stage of the `Dockerfile`, which runs `go test -race`, and a
+    removed non-building RELP code; tagged v1.0.0
-  new final stage makes a plain `docker build` run both the `lint` and `test`
+* 2024-05-22: module path moved to sneak.berlin/go/simplelog
-  stages
+* 2024-05-14: initial library: slog-based console, JSON, webhook, and
- 2026-10-06: the linter runs only in Docker: `script/lint` builds the `lint`
+    RELP handlers, MultiplexHandler, caller file/line info, UTC ISO
-  stage of the `Dockerfile`, every `docker build` in `script/` runs without the
+    timestamps, level-colored output
  build cache, and `script/bootstrap` no longer installs golangci-lint
 - 2026-10-06: every handler now returns a failed delivery from `Handle` instead
  of discarding it: console and JSON return the stdout write error, the webhook
  also fails on a non-2xx answer, and the multiplex delivers to every handler
  and returns their errors joined
 - 2026-08-10: fixed every handler discarding slog attributes: console, JSON and
  webhook handlers now emit record attributes, accumulate WithAttrs without
  mutating the receiver, and honour WithGroup; slog.Group values nest and
  LogValuer values are resolved; console keys and values holding invalid UTF-8
  are quoted
 - 2026-08-07: added canonical `.golangci.yml` (v2 schema), pinned the
  `Dockerfile` lint stage to golangci-lint v2.12.2 (tag+digest), and fixed all
  findings the v1→v2 jump surfaced without changing any exported signatures or
  behavior
 * 2026-07-07 Adopted scripts-to-rule-them-all: `script/` entrypoints, Makefile
  shims, README Entrypoints section
 - 2026-02-08: fixed JSONHandler deadlock from recursive log.Println, with
  regression test; tagged 1.0.1
 - 2024-06-14: 1.0 prep: lint and fmt enforced in Docker build, call stack depth
  fix so log locations report correctly, example script, removed non-building
  RELP code; tagged v1.0.0
 - 2024-05-22: module path moved to sneak.berlin/go/simplelog
 - 2024-05-14: initial library: slog-based console, JSON, webhook, and RELP
  handlers, MultiplexHandler, caller file/line info, UTC ISO timestamps,
  level-colored output
 # Future Steps
- Delete the old plain TODO file once this TODO.md lands
+* Rewrite the Dockerfile to run make check with sha256-pinned base
- Add .aider.\* to .gitignore and remove the stray aider artifacts from the
+    images (currently golangci/golangci-lint:latest and golang:1.22,
-  working tree
+    unpinned, duplicating Makefile logic instead of calling it)
- Pick one tag scheme before the next release (v1.0.0 vs 1.0.1 are inconsistent)
+* Restructure README.md into the standard sections: Description,
- Tag v1.0.2, with the leading v, once the attribute fix lands, so consuming
+    Getting Started, Rationale, Design, TODO, License, Author
-  repos can move off pseudo-version pins in one step
+* Delete the old plain TODO file once this TODO.md lands
- Fix RELP output to cache (from old TODO)
+* Add .aider.* to .gitignore and remove the stray aider artifacts from
- Re-add RELP delivery over TCP to remote rsyslog imrelp; removed 2024-06-14
+    the working tree
-  because it did not build (README planned feature)
+* Pick one tag scheme before the next release (v1.0.0 vs 1.0.1 are
- Add regex filtering for webhook logs (from old TODO)
+    inconsistent)
- Better console output format (from old TODO)
+* Tag v1.0.2, with the leading v, once the attribute fix lands, so
    consuming repos can move off pseudo-version pins in one step
 * Fix RELP output to cache (from old TODO)
 * Re-add RELP delivery over TCP to remote rsyslog imrelp; removed
    2024-06-14 because it did not build (README planned feature)
 * Add regex filtering for webhook logs (from old TODO)
 * Better console output format (from old TODO)
@@ -12,6 +12,10 @@ import (
 	"github.com/fatih/color"
 )
 // callerSkipFrames is the number of stack frames between runtime.Caller
 // and the slog call site that produced the record.
 const callerSkipFrames = 4
 // ConsoleHandler writes human-readable, colored log lines to stdout.
 type ConsoleHandler struct {
 	// out is where records are written. Nil means os.Stdout, looked up on
@@ -49,13 +53,11 @@ func (c *ConsoleHandler) Handle(
 		colorFunc = color.New(color.FgWhite).SprintfFunc()
 	}
-	// The file and line come from the record's PC, the call site; a record
+	// Get the caller information
-	// without one prints a placeholder.
+	_, file, line, ok := runtime.Caller(callerSkipFrames)
-	file, line := "???", 0
+	if !ok {
-
+		file = "???"
-	if record.PC != 0 {
+		line = 0
 		frame, _ := runtime.CallersFrames([]uintptr{record.PC}).Next()
 		file, line = frame.File, frame.Line
 	}
 	out := c.out
@@ -1,102 +0,0 @@
 package simplelog
 import (
 	"bytes"
 	"context"
 	"fmt"
 	"log/slog"
 	"runtime"
 	"strings"
 	"testing"
 	"time"
 )
 // These tests sit inside the package so they can read the console line
 // from a buffer instead of from stdout.
 // lineOf calls logCall and returns "file:line" for the line lineOf was
 // called from. Each test writes its log call inside logCall on that same
 // line, so the result is the location the console line must name.
 func lineOf(logCall func()) string {
 	_, file, line, _ := runtime.Caller(1)
 	logCall()
 	return fmt.Sprintf("%s:%d", file, line)
 }
 // wantLocation fails the test unless the console line names location as
 // where the record "casting" was logged.
 func wantLocation(t *testing.T, output, location string) {
 	t.Helper()
 	if !strings.Contains(output, location+": casting") {
 		t.Fatalf("console line %q does not name %s", output, location)
 	}
 }
 // The default handler as simplelog installs it when stdout is a terminal:
 // a MultiplexHandler holding a ConsoleHandler.
 func TestConsoleHandlerNamesCallSiteThroughDefaultHandler(t *testing.T) {
 	t.Parallel()
 	var output bytes.Buffer
 	logger := slog.New(&MultiplexHandler{handlers: []ExtendedHandler{
 		&ConsoleHandler{out: &output},
 	}})
 	want := lineOf(func() { logger.Info("casting") })
 	wantLocation(t, output.String(), want)
 }
 func TestConsoleHandlerNamesCallSiteUsedWithSlogNew(t *testing.T) {
 	t.Parallel()
 	var output bytes.Buffer
 	logger := slog.New(&ConsoleHandler{out: &output})
 	want := lineOf(func() { logger.Info("casting") })
 	wantLocation(t, output.String(), want)
 }
 // The record is built as the log/slog package documentation shows for a
 // function that logs on its caller's behalf: runtime.Callers supplies the
 // PC.
 func TestConsoleHandlerNamesCallSiteOfRecordPassedToHandle(t *testing.T) {
 	t.Parallel()
 	var (
 		output bytes.Buffer
 		pcs    [1]uintptr
 	)
 	want := lineOf(func() { runtime.Callers(1, pcs[:]) })
 	record := slog.NewRecord(time.Now(), slog.LevelInfo, "casting", pcs[0])
 	err := (&ConsoleHandler{out: &output}).Handle(context.Background(), record)
 	if err != nil {
 		t.Fatalf("Handle: %v", err)
 	}
 	wantLocation(t, output.String(), want)
 }
 func TestConsoleHandlerPrintsPlaceholderWithoutPC(t *testing.T) {
 	t.Parallel()
 	var output bytes.Buffer
 	record := slog.NewRecord(time.Now(), slog.LevelInfo, "casting", 0)
 	err := (&ConsoleHandler{out: &output}).Handle(context.Background(), record)
 	if err != nil {
 		t.Fatalf("Handle: %v", err)
 	}
 	wantLocation(t, output.String(), "???:0")
 }
@@ -5,7 +5,6 @@ import (
 	"context"
 	"errors"
 	"log/slog"
 	"net"
 	"net/http"
 	"net/http/httptest"
 	"strings"
@@ -83,38 +82,6 @@ func TestMultiplexHandlerDeliversPastFailingHandler(t *testing.T) {
 	}
 }
 // When more than one handler fails, the caller gets every failure, not
 // only the first.
 func TestMultiplexHandlerReturnsEveryFailure(t *testing.T) {
 	t.Parallel()
 	server := httptest.NewServer(http.HandlerFunc(
 		func(w http.ResponseWriter, _ *http.Request) {
 			w.WriteHeader(http.StatusInternalServerError)
 		},
 	))
 	defer server.Close()
 	webhook, err := NewWebhookHandler(server.URL)
 	if err != nil {
 		t.Fatalf("NewWebhookHandler: %v", err)
 	}
 	handler := &MultiplexHandler{handlers: []ExtendedHandler{
 		&JSONHandler{out: failingWriter{}},
 		webhook,
 	}}
 	err = handler.Handle(context.Background(), errorTestRecord())
 	if !errors.Is(err, errSinkFailed) {
 		t.Fatalf("Handle returned %v, want the JSON handler's error", err)
 	}
 	if !errors.Is(err, errWebhookStatus) {
 		t.Fatalf("Handle returned %v, want the webhook's error", err)
 	}
 }
 func TestWebhookHandlerReturnsErrorOnServerError(t *testing.T) {
 	t.Parallel()
@@ -135,129 +102,3 @@ func TestWebhookHandlerReturnsErrorOnServerError(t *testing.T) {
 		t.Fatalf("Handle returned %v, want an error for the 500 answer", err)
 	}
 }
 // Following the redirect would resend the request as a GET without the
 // record, and the GET is answered with 200, so only an error for the
 // redirect itself tells the caller the record was lost.
 func TestWebhookHandlerReturnsErrorOnRedirect(t *testing.T) {
 	t.Parallel()
 	server := httptest.NewServer(http.HandlerFunc(
 		func(w http.ResponseWriter, r *http.Request) {
 			if r.URL.Path != "/moved" {
 				http.Redirect(w, r, "/moved", http.StatusFound)
 			}
 		},
 	))
 	defer server.Close()
 	handler, err := NewWebhookHandler(server.URL)
 	if err != nil {
 		t.Fatalf("NewWebhookHandler: %v", err)
 	}
 	err = handler.Handle(context.Background(), errorTestRecord())
 	if !errors.Is(err, errWebhookStatus) {
 		t.Fatalf("Handle returned %v, want an error for the redirect", err)
 	}
 }
 // A server that accepts the request and never answers must not hold up
 // the log call: Handle gives up after webhookTimeout and says why.
 func TestWebhookHandlerTimesOutOnServerThatNeverAnswers(t *testing.T) {
 	t.Parallel()
 	testEnded := make(chan struct{})
 	server := httptest.NewServer(http.HandlerFunc(
 		func(_ http.ResponseWriter, _ *http.Request) {
 			<-testEnded
 		},
 	))
 	// server.Close waits for running requests, so the server's handler
 	// is released first.
 	defer func() {
 		close(testEnded)
 		server.Close()
 	}()
 	handler, err := NewWebhookHandler(server.URL)
 	if err != nil {
 		t.Fatalf("NewWebhookHandler: %v", err)
 	}
 	// Handle runs in a goroutine so that a lost timeout fails the test
 	// instead of hanging the test run.
 	handleErr := make(chan error, 1)
 	go func() {
 		handleErr <- handler.Handle(context.Background(), errorTestRecord())
 	}()
 	select {
 	case err = <-handleErr:
 	case <-time.After(webhookTimeout + time.Second):
 		t.Fatal("Handle did not return within webhookTimeout")
 	}
 	var netErr net.Error
 	if !errors.As(err, &netErr) || !netErr.Timeout() {
 		t.Fatalf("Handle returned %v, want a timeout error", err)
 	}
 }
 // A server that sends a 2xx status and then never finishes the answer
 // must not hold up the log call either: reading the answer counts toward
 // webhookTimeout, and Handle returns the read's error.
 func TestWebhookHandlerTimesOutOnServerThatStallsTheAnswer(t *testing.T) {
 	t.Parallel()
 	testEnded := make(chan struct{})
 	server := httptest.NewServer(http.HandlerFunc(
 		func(w http.ResponseWriter, _ *http.Request) {
 			w.WriteHeader(http.StatusOK)
 			// Flush sends the status now; the answer stays unfinished
 			// until the test ends.
 			err := http.NewResponseController(w).Flush()
 			if err != nil {
 				t.Errorf("flush the status: %v", err)
 			}
 			<-testEnded
 		},
 	))
 	// server.Close waits for running requests, so the server's handler
 	// is released first.
 	defer func() {
 		close(testEnded)
 		server.Close()
 	}()
 	handler, err := NewWebhookHandler(server.URL)
 	if err != nil {
 		t.Fatalf("NewWebhookHandler: %v", err)
 	}
 	// Handle runs in a goroutine so that a lost timeout fails the test
 	// instead of hanging the test run.
 	handleErr := make(chan error, 1)
 	go func() {
 		handleErr <- handler.Handle(context.Background(), errorTestRecord())
 	}()
 	select {
 	case err = <-handleErr:
 	case <-time.After(webhookTimeout + time.Second):
 		t.Fatal("Handle did not return within webhookTimeout")
 	}
 	var netErr net.Error
 	if !errors.As(err, &netErr) || !netErr.Timeout() {
 		t.Fatalf("Handle returned %v, want a timeout error", err)
 	}
 }
@@ -1,6 +0,0 @@
 {
  "private": true,
  "devDependencies": {
    "prettier": "3.8.1"
  }
 }
@@ -2,26 +2,11 @@
 # script/bootstrap: install all dependencies needed to build and develop
 # this repo. Idempotent: every install is guarded by a check so already
 # installed tools are skipped. Base tooling comes from nix, apt, brew,
-# or apk (detected in that order); assumes nothing is present. Node is
+# or apk (detected in that order); assumes nothing is present.
 # used directly if installed; otherwise it is installed at a pinned
 # version via nvm (installing nvm itself first, from a hash-verified
 # release archive, never curl | sh).
 set -eu
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 # Pinned versions, 2026-07-06
 NODE_VERSION="22.17.0"
 NVM_VERSION="0.40.3"
 # sha256 of https://github.com/nvm-sh/nvm/archive/refs/tags/v0.40.3.tar.gz
 NVM_SHA256="5f4d6aaa04a177dc93c985e31dbc411ab6b8c6e1e21d8015dbc1372625fcd1d0"
 YARN_VERSION="1.22.22"
 # goimports from golang.org/x/tools v0.30.0, 2025-02-10: the last release
 # that Go 1.22, the Go of go.mod and the Dockerfile, can build.
 GOIMPORTS_COMMIT="09747cdf594a7924dcecb506312be3bd6e437962"
 GOIMPORTS_VERSION="v0.30.0"
 PKGMGR=""
 SUDO=""
@@ -62,98 +47,6 @@ missing() {
    ! command -v "$1" >/dev/null 2>&1
 }
 # Print the golang.org/x/tools version that the goimports on PATH was
 # built from, or nothing. goimports has no --version flag; `go version -m`
 # prints the module versions Go records in every binary it builds.
 goimports_version() {
    bin="$(command -v goimports)" || return 0
    go version -m "$bin" 2>/dev/null |
        awk '$1 == "mod" && $2 == "golang.org/x/tools" { print $3 }'
 }
 # Install goimports at the pinned commit unless the one on PATH already
 # reports the pinned version. go install writes to GOBIN, or to the bin
 # directory of GOPATH when GOBIN is unset, which need not be on the
 # caller's PATH; script/fmt puts that directory first on PATH the same
 # way, so the check here sees the goimports that script/fmt runs.
 ensure_goimports() {
    gobin="$(go env GOBIN)"
    PATH="${gobin:-$(go env GOPATH)/bin}:$PATH"
    if [ "$(goimports_version)" != "$GOIMPORTS_VERSION" ]; then
        go install "golang.org/x/tools/cmd/goimports@$GOIMPORTS_COMMIT"
        hash -r
        if [ "$(goimports_version)" != "$GOIMPORTS_VERSION" ]; then
            echo "bootstrap: goimports on PATH is not $GOIMPORTS_VERSION" \
                "after installing it: $(command -v goimports || echo none)" >&2
            exit 1
        fi
    fi
    echo "goimports $GOIMPORTS_VERSION at $(command -v goimports)"
 }
 # verify_sha256 <file> <expected-hash>
 verify_sha256() {
    if command -v sha256sum >/dev/null 2>&1; then
        actual="$(sha256sum "$1" | cut -d' ' -f1)"
    else
        actual="$(shasum -a 256 "$1" | cut -d' ' -f1)"
    fi
    if [ "$actual" != "$2" ]; then
        echo "bootstrap: sha256 mismatch for $1" >&2
        echo "  expected: $2" >&2
        echo "  actual:   $actual" >&2
        exit 1
    fi
 }
 # nvm is a bash script; run a command in a bash with nvm loaded
 nvm_sh() {
    bash -c ". \"\$HOME/.nvm/nvm.sh\" && $*"
 }
 ensure_nvm() {
    [ -s "$HOME/.nvm/nvm.sh" ] && return 0
    # nvm prerequisites; nvm itself requires bash
    if missing bash; then pkg_install bash bash bash bash; fi
    if missing curl; then pkg_install curl curl curl curl; fi
    if missing git; then pkg_install git git git git; fi
    tmp="$(mktemp -d)"
    curl -fsSL -o "$tmp/nvm.tar.gz" \
        "https://github.com/nvm-sh/nvm/archive/refs/tags/v${NVM_VERSION}.tar.gz"
    verify_sha256 "$tmp/nvm.tar.gz" "$NVM_SHA256"
    mkdir -p "$HOME/.nvm"
    tar -xzf "$tmp/nvm.tar.gz" -C "$HOME/.nvm" --strip-components=1
    rm -rf "$tmp"
 }
 ensure_node() {
    if ! missing node; then return 0; fi
    ensure_nvm
    nvm_sh "nvm install $NODE_VERSION"
 }
 ensure_yarn() {
    if ! missing yarn; then return 0; fi
    if ! missing corepack; then
        corepack enable
        corepack prepare "yarn@$YARN_VERSION" --activate
    elif [ -s "$HOME/.nvm/nvm.sh" ]; then
        nvm_sh "nvm use $NODE_VERSION >/dev/null && corepack enable && \
            corepack prepare yarn@$YARN_VERSION --activate"
    else
        npm install -g "yarn@$YARN_VERSION"
    fi
 }
 install_js_deps() {
    if missing yarn && [ -s "$HOME/.nvm/nvm.sh" ]; then
        nvm_sh "nvm use $NODE_VERSION >/dev/null && cd \"$ROOT\" && \
            yarn install --frozen-lockfile"
    else
        yarn install --frozen-lockfile
    fi
 }
 main() {
    cd "$ROOT"
@@ -161,15 +54,15 @@ main() {
    if missing git; then pkg_install git git git git; fi
    if missing go; then pkg_install go golang go go; fi
-    # golangci-lint is not installed: it runs only in docker (script/lint).
+    # golangci-lint is packaged in nix, brew, and apk; there is no apt
-    ensure_goimports
+    # package (on apt hosts, install it from a hash-verified GitHub
    # release archive manually, never curl | sh).
    if missing golangci-lint; then
        pkg_install golangci-lint golangci-lint golangci-lint golangci-lint
    fi
    go mod download
    ensure_node
    ensure_yarn
    install_js_deps
    echo "bootstrap complete"
 }
@@ -1,8 +1,6 @@
 #!/bin/sh
 # script/check: run all checks (test, lint, fmt-check). Our own
-# extension to scripts-to-rule-them-all. test and lint are Docker
+# extension to scripts-to-rule-them-all. Must not modify any files.
 # phases; fmt-check is native, because a formatter writes the working
 # tree. Must not modify any files.
 set -eu
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
@@ -1,28 +1,13 @@
 #!/bin/sh
-# script/cibuild: run the CI build. It bootstraps first: a CI runner
+# script/cibuild: run the CI build. The Dockerfile runs script/check, so
-# checks out and runs this and nothing else, and script/fmt-check runs
+# a successful build implies all checks pass.
 # the formatter on the host, which a pristine checkout cannot do.
 # --no-cache for the same reason as script/docker: the gate phases the
 # final stage depends on are RUN steps, and a cached one is a check that
 # did not run.
 set -eu
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 main() {
    cd "$ROOT"
-    "$SCRIPT_DIR/bootstrap"
+    docker build .
    "$SCRIPT_DIR/check"
    # Own line: a failing command substitution inside an argument does
    # not trip `set -e`, so the inline form degrades silently to an
    # empty constant. The VERSION build argument takes precedence over
    # the version a build stage derives from the .git in the context.
    version="$(git describe --tags --always --dirty 2>/dev/null || true)"
    [ -n "$version" ] || version="unknown"
    docker build --no-cache \
        --build-arg VERSION="$version" \
        -t "$("$SCRIPT_DIR/projectname")" .
 }
 main "$@"
@@ -1,8 +1,6 @@
 #!/bin/sh
 # script/docker: build the Docker image tagged with the project name.
 # Identical in all repos; the tag comes from script/projectname.
 # --no-cache because the gate phases the final stage depends on are RUN
 # steps, and a cached one is a check that did not run.
 set -eu
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
@@ -10,15 +8,7 @@ ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 main() {
    cd "$ROOT"
-    # Own line: a failing command substitution inside an argument does
+    docker build -t "$("$SCRIPT_DIR/projectname")" .
    # not trip `set -e`, so the inline form degrades silently to an
    # empty constant. The VERSION build argument takes precedence over
    # the version a build stage derives from the .git in the context.
    version="$(git describe --tags --always --dirty 2>/dev/null || true)"
    [ -n "$version" ] || version="unknown"
    docker build --no-cache \
        --build-arg VERSION="$version" \
        -t "$("$SCRIPT_DIR/projectname")" .
 }
 main "$@"
@@ -1,37 +1,13 @@
 #!/bin/sh
-# script/fmt: format all files (writes): Go with the goimports that
+# script/fmt: format all files (writes).
 # script/bootstrap installs, then Markdown with prettier. It puts Go's bin
 # directory first on PATH, as script/bootstrap does, so it runs that
 # goimports even when the directory is not on the caller's PATH.
 set -eu
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 # Must match the pin in script/bootstrap.
 NODE_VERSION="22.17.0"
 # script/bootstrap installs node and yarn under nvm and leaves neither
 # on the PATH of the shell that called it, so resolve the pinned
 # toolchain here the way bootstrap's own install step does. nvm is a
 # bash script, hence the subshell.
 run_yarn() {
    if command -v yarn >/dev/null 2>&1; then
        exec yarn "$@"
    fi
    if [ ! -s "$HOME/.nvm/nvm.sh" ]; then
        echo "fmt: no yarn; run script/bootstrap first" >&2
        exit 1
    fi
    exec bash -c '. "$HOME/.nvm/nvm.sh" && nvm use "$1" >/dev/null &&
        shift && exec yarn "$@"' bash "$NODE_VERSION" "$@"
 }
 main() {
    cd "$ROOT"
    gobin="$(go env GOBIN)"
    PATH="${gobin:-$(go env GOPATH)/bin}:$PATH"
    goimports -l -w .
-    run_yarn run prettier --write '**/*.md' --tab-width 4 --prose-wrap always
+    golangci-lint run --fix
 }
 main "$@"
@@ -1,30 +1,10 @@
 #!/bin/sh
 # script/fmt-check: check formatting (read-only). Fails and lists the
-# offending files if gofmt would reformat any Go file; otherwise fails if
+# offending files if gofmt would reformat anything.
 # prettier would reformat any Markdown file.
 set -eu
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 # Must match the pin in script/bootstrap.
 NODE_VERSION="22.17.0"
 # script/bootstrap installs node and yarn under nvm and leaves neither
 # on the PATH of the shell that called it, so resolve the pinned
 # toolchain here the way bootstrap's own install step does. nvm is a
 # bash script, hence the subshell.
 run_yarn() {
    if command -v yarn >/dev/null 2>&1; then
        exec yarn "$@"
    fi
    if [ ! -s "$HOME/.nvm/nvm.sh" ]; then
        echo "fmt-check: no yarn; run script/bootstrap first" >&2
        exit 1
    fi
    exec bash -c '. "$HOME/.nvm/nvm.sh" && nvm use "$1" >/dev/null &&
        shift && exec yarn "$@"' bash "$NODE_VERSION" "$@"
 }
 main() {
    cd "$ROOT"
    unformatted="$(gofmt -l .)"
@@ -33,7 +13,6 @@ main() {
        echo "$unformatted"
        exit 1
    fi
    run_yarn run prettier --check '**/*.md' --tab-width 4 --prose-wrap always
 }
 main "$@"
@@ -1,23 +1,12 @@
 #!/bin/sh
-# script/lint: run the linter. Linting is a phase of the Dockerfile and
+# script/lint: run the linter.
 # this builds that phase alone; the linter is never installed or run on
 # a developer host, where a shared result cache and a host-global lock
 # make its answer untrustworthy.
 #
 # The phase is not the last stage in the file, so it is built only when
 # --target names it. --no-cache because a cached lint layer is a lint
 # that did not run. The tag makes each build replace the previous image
 # instead of leaving a dangling one behind.
 set -eu
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 main() {
    cd "$ROOT"
-    docker build --no-cache \
+    golangci-lint run
        --target lint \
        -t "$("$SCRIPT_DIR/projectname")-lint" .
 }
 main "$@"
@@ -1,19 +1,12 @@
 #!/bin/sh
-# script/test: run the test suite. Testing is a phase of the Dockerfile
+# script/test: run the test suite.
 # and this builds that phase alone, on the same terms as script/lint:
 # --target because a phase that is not the last stage is built only when
 # named, --no-cache because a cached test layer is a test that did not
 # run, and a tag so each build replaces the previous image.
 set -eu
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 main() {
    cd "$ROOT"
-    docker build --no-cache \
+    go test -v ./...
        --target test \
        -t "$("$SCRIPT_DIR/projectname")-test" .
 }
 main "$@"
@@ -6,27 +6,19 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
 	"io"
 	"log/slog"
 	"net/http"
 	"net/url"
 	"time"
 )
 // errWebhookStatus is returned when the webhook answers with a status
 // outside 2xx.
 var errWebhookStatus = errors.New("webhook did not accept the record")
 // webhookTimeout bounds each webhook request, reading the answer
 // included. Handle runs inside the log call, so a server that never
 // answers would otherwise hold that call up for good.
 const webhookTimeout = 5 * time.Second
 // WebhookHandler POSTs each log record as JSON to a configured webhook
 // URL.
 type WebhookHandler struct {
 	webhookURL string
 	client     *http.Client
 	attrs      handlerAttrs
 }
@@ -38,18 +30,7 @@ func NewWebhookHandler(webhookURL string) (*WebhookHandler, error) {
 		return nil, fmt.Errorf("invalid webhook URL: %w", err)
 	}
-	return &WebhookHandler{
+	return &WebhookHandler{webhookURL: webhookURL}, nil
 		webhookURL: webhookURL,
 		client: &http.Client{
 			Timeout: webhookTimeout,
 			// Following a redirect can resend the request as a GET
 			// without the record, so Handle gets the redirect answer
 			// itself and returns it as an error.
 			CheckRedirect: func(*http.Request, []*http.Request) error {
 				return http.ErrUseLastResponse
 			},
 		},
 	}, nil
 }
 // Enabled reports whether the handler processes records at the given
@@ -67,7 +48,6 @@ func (w *WebhookHandler) WithAttrs(attrs []slog.Attr) slog.Handler {
 	return &WebhookHandler{
 		webhookURL: w.webhookURL,
 		client:     w.client,
 		attrs:      w.attrs.withAttrs(attrs),
 	}
 }
@@ -81,15 +61,13 @@ func (w *WebhookHandler) WithGroup(name string) slog.Handler {
 	return &WebhookHandler{
 		webhookURL: w.webhookURL,
 		client:     w.client,
 		attrs:      w.attrs.withGroup(name),
 	}
 }
 // Handle marshals the record, with its attributes, to one JSON object and
 // POSTs it to the webhook URL. It returns an error when the request fails
-// or runs past webhookTimeout, or when the server answers with a status
+// or the server answers with a status outside 2xx.
 // outside 2xx.
 func (w *WebhookHandler) Handle(ctx context.Context, record slog.Record) error {
 	jsonData, err := json.Marshal(recordToMap(record, w.attrs))
 	if err != nil {
@@ -108,22 +86,13 @@ func (w *WebhookHandler) Handle(ctx context.Context, record slog.Record) error {
 	request.Header.Set("Content-Type", "application/json")
-	response, err := w.client.Do(request)
+	response, err := http.DefaultClient.Do(request)
 	if err != nil {
 		return err
 	}
 	defer func() { _ = response.Body.Close() }()
 	// The answer is read to the end so the client can reuse the
 	// connection for the next record. The read counts toward
 	// webhookTimeout, so a server that sends its status and then stalls
 	// fails here.
 	_, err = io.Copy(io.Discard, response.Body)
 	if err != nil {
 		return fmt.Errorf("error reading webhook answer: %w", err)
 	}
 	if response.StatusCode < http.StatusOK ||
 		response.StatusCode >= http.StatusMultipleChoices {
 		return fmt.Errorf("%w: %s", errWebhookStatus, response.Status)
@@ -1,8 +0,0 @@
 # THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
 # yarn lockfile v1
 prettier@3.8.1:
  version "3.8.1"
  resolved "https://registry.yarnpkg.com/prettier/-/prettier-3.8.1.tgz#edf48977cf991558f4fcbd8a3ba6015ba2a3a173"
  integrity sha512-UOnG6LftzbdaHZcKoPFtOcCKztrQ57WkHDeRD9t/PTQtmT0NHSeWWepj6pS0z/N7+08BHFDQVUrfmfMRcZwbMg==