Format the Markdown with prettier in make fmt and make fmt-check (closes #215)

`make fmt` formatted only Go, so the org's Markdown settings were unenforced and Markdown was wrapped by hand. prettier, pinned in `package.json` and `yarn.lock` beside ESLint, now formats the Markdown with `.prettierrc` (4-space tabs, `proseWrap: always`). It runs only in Docker: `make fmt` writes the formatted files back without a bind mount, and `make fmt-check`, `make check` and the image build fail on unformatted Markdown. The image build's lint stage now runs the Go format check directly and no longer installs `make`. `README.md` and `TODO.md` are reformatted with no word changed: the README reflows from 72 to 80 columns.

Model: opus-5-5

.dockerignore

@@ -15,8 +15,8 @@ bin/
 # Extracted from 3p/ by `make assets` inside the build; a host copy is not
 # needed. The tarball in 3p/ must stay in the context.
 static/js/alpine.min.js
-# The js-deps stage installs ESLint; a host copy would overwrite it at the
-# js-lint stage's `COPY . .`.
+# The js-deps stage installs ESLint and prettier; a host copy would overwrite
+# them at the `COPY . .` of the stages built on it.
 node_modules/
 .env
 .env.*

.gitea/workflows/check.yml

@@ -33,5 +33,5 @@ jobs:
         # and built cannot report success from cache.
         run: git rev-parse HEAD > .ci-fingerprint
 
-      - name: Build Docker image (runs make fmt-check, golangci-lint, the stylesheet check, ESLint, make test, make build)
+      - name: Build Docker image (runs the gofmt check, golangci-lint, the stylesheet check, ESLint, the Markdown check, make test, make build)
         run: script/cibuild

.gitignore

@@ -15,7 +15,7 @@ bin/
 # Go vendor directory
 vendor/
 
-# ESLint and its dependencies, installed from yarn.lock
+# ESLint, prettier and their dependencies, installed from yarn.lock
 node_modules/
 
 # IDE specific files

.prettierrc

@@ -0,0 +1,4 @@
+{
+    "tabWidth": 4,
+    "proseWrap": "always"
+}

Dockerfile

@@ -4,8 +4,6 @@
 # compile on Alpine musl (off64_t is a glibc type).
 FROM golangci/golangci-lint:v2.12.2@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240 AS lint
 
-RUN apt-get update && apt-get install -y --no-install-recommends make && rm -rf /var/lib/apt/lists/*
-
 WORKDIR /src
 
 # Copy go mod files first for better layer caching
@@ -19,12 +17,14 @@ RUN go mod download
 # .dockerignore.
 COPY . .
 
-# Run formatting check and linter. golangci-lint is invoked directly rather
-# than through `make lint`: this stage is already the pinned linter image, and
-# script/lint is a wrapper that builds Dockerfile.lint, so calling it here
-# would need a docker daemon inside the build. Keep these steps in step with
-# Dockerfile.lint, including --network=none (see its header for why).
-RUN make fmt-check
+# Run the Go formatting check and the linter. gofmt and golangci-lint are
+# invoked directly rather than through `make fmt-check` and `make lint`: this
+# stage is already the pinned linter image, and both scripts build docker
+# stages, so calling them here would need a docker daemon inside the build.
+# The Markdown half of `make fmt-check` is the markdown-check stage below.
+# Keep the golangci-lint steps in step with Dockerfile.lint, including
+# --network=none (see its header for why).
+RUN if [ -n "$(gofmt -s -l .)" ]; then echo "gofmt needed on:"; gofmt -s -l .; exit 1; fi
 RUN script/assets
 RUN --network=none golangci-lint config verify --config .golangci.yml
 RUN --network=none golangci-lint run --config .golangci.yml --build-tags browser ./...
@@ -66,10 +66,11 @@ RUN sed 's/}/}\n/g' static/css/tailwind.css > /tmp/committed.css \
     }
 
 # JavaScript lint stages: ESLint, at the version package.json and yarn.lock
-# pin, checks static/js/ against eslint.config.mjs. js-deps installs it and
-# stays cached until those two files change. script/lint forces only js-lint
-# to re-run, and the build stage below runs it too. COPY . . brings in the CI
-# cache barrier described in the lint stage above.
+# pin, checks static/js/ against eslint.config.mjs. js-deps installs it, and
+# prettier for the Markdown stages below, and stays cached until those two
+# files change. script/lint forces only js-lint to re-run, and the build stage
+# below runs it too. COPY . . brings in the CI cache barrier described in the
+# lint stage above.
 # node:24.21.0-alpine (LTS, with yarn 1.22.22), 2026-09-18
 FROM node:24.21.0-alpine@sha256:ebfe2f90462722a7a4de65e91990e97fe0d401c70e0e762c5b53302f905ec1c1 AS js-deps
 WORKDIR /src
@@ -80,16 +81,36 @@ FROM js-deps AS js-lint
 COPY . .
 RUN --network=none node_modules/.bin/eslint static/js
 
+# Markdown stages: prettier, at the version package.json and yarn.lock pin,
+# formats every Markdown file in the tree with the settings in .prettierrc.
+# `make fmt` (script/fmt) writes the formatted files out from markdown-output.
+# markdown-check fails on any file prettier would change; `make fmt-check`
+# runs it, and so does the build stage below.
+FROM js-deps AS markdown
+COPY . .
+RUN --network=none node_modules/.bin/prettier --write '**/*.md' \
+    && mkdir /out \
+    && find . -name '*.md' ! -path './node_modules/*' -exec cp -p --parents {} /out \;
+
+FROM scratch AS markdown-output
+COPY --from=markdown /out /
+
+FROM js-deps AS markdown-check
+COPY . .
+RUN --network=none node_modules/.bin/prettier --check '**/*.md'
+
 # Build stage
 # golang:1.26.1-bookworm (Debian-based), 2026-03-17
 # Using Debian-based image because gorm.io/driver/sqlite pulls in
 # mattn/go-sqlite3 (CGO), which does not compile on Alpine musl.
 FROM golang:1.26.1-bookworm@sha256:4465644228bc2857a954b092167e12aa59c006a3492282a6c820bf4755fd64a4 AS builder
 
-# Depend on the lint, stylesheet check and JavaScript lint stages passing
+# Depend on the lint, stylesheet check, JavaScript lint and Markdown check
+# stages passing
 COPY --from=lint /src/go.sum /dev/null
 COPY --from=css-check /out/tailwind.css /dev/null
 COPY --from=js-lint /src/yarn.lock /dev/null
+COPY --from=markdown-check /src/yarn.lock /dev/null
 
 # jq is a runtime dependency of script/ci-mark-superseded, which the test
 # suite executes. git is what script/version derives the version with.

TODO.md

@@ -2,403 +2,367 @@
 
 One issue per unit of work, one branch and one PR per issue:
 
-* ensure a tracked issue exists with a definition of done
-* branch from `next` (never from `main`)
-* do the work; open a PR based on `next` (never on `main`)
-* pass an independent review, then the manager squash-merges into `next`
-* push; nothing stays local-only
+- ensure a tracked issue exists with a definition of done
+- branch from `next` (never from `main`)
+- do the work; open a PR based on `next` (never on `main`)
+- pass an independent review, then the manager squash-merges into `next`
+- push; nothing stays local-only
 
-`next` is the branch for the next milestone and must stay green and
-mergeable to `main` without notice. One `next` -> `main` PR accumulates
-the milestone; releases are cut from `main` separately.
+`next` is the branch for the next milestone and must stay green and mergeable to
+`main` without notice. One `next` -> `main` PR accumulates the milestone;
+releases are cut from `main` separately.
 
-Issue branches do NOT touch this file — the manager maintains it on
-`next`. Every branch editing `TODO.md` conflicts with every other
-(#112).
+Issue branches do NOT touch this file — the manager maintains it on `next`.
+Every branch editing `TODO.md` conflicts with every other (#112).
 
 # Status
 
 The milestone (https://git.eeqj.de/sneak/webhooker/milestone/9) is the
-authoritative list, and the only place to read a count or a state of
-play from. This file records where the project is, not what is in
-flight: a sentence whose truth depends on a branch being unmerged is
-wrong the moment it merges, and this file has been wrong that way
-before.
+authoritative list, and the only place to read a count or a state of play from.
+This file records where the project is, not what is in flight: a sentence whose
+truth depends on a branch being unmerged is wrong the moment it merges, and this
+file has been wrong that way before.
 
 The durability defect that held the tag has landed
-(https://git.eeqj.de/sneak/webhooker/issues/256, commit `8d64259`).
-Every SQLite handle opens with WAL journaling and a busy timeout, a
-bookkeeping write that fails leaves its delivery in a recoverable
-state rather than a lying one, and recovery skips a delivery that
-already has a successful result row. Final pre-tag verification
-exercised it and confirmed it holds. Whatever the milestone still
-shows open is what remains before `v1.0.0`.
+(https://git.eeqj.de/sneak/webhooker/issues/256, commit `8d64259`). Every SQLite
+handle opens with WAL journaling and a busy timeout, a bookkeeping write that
+fails leaves its delivery in a recoverable state rather than a lying one, and
+recovery skips a delivery that already has a successful result row. Final
+pre-tag verification exercised it and confirmed it holds. Whatever the milestone
+still shows open is what remains before `v1.0.0`.
 
-Delivery is at-least-once by design, not by accident: a send whose
-result row does not land is attempted again, so a receiver can see a
-duplicate. That is deliberate — the alternative is a silent lost
-delivery — and the README says so under Rationale. It is not a defect
-to re-file.
+Delivery is at-least-once by design, not by accident: a send whose result row
+does not land is attempted again, so a receiver can see a duplicate. That is
+deliberate — the alternative is a silent lost delivery — and the README says so
+under Rationale. It is not a defect to re-file.
 
 # Next Step
 
 Clear the rest of the open 1.0.0 milestone
-(https://git.eeqj.de/sneak/webhooker/milestone/9) and tag `v1.0.0`.
-Merging `next` into `main` is a separate act from tagging and waits on
-neither of those: `next` is kept mergeable at all times, which is the
-point of the branch.
+(https://git.eeqj.de/sneak/webhooker/milestone/9) and tag `v1.0.0`. Merging
+`next` into `main` is a separate act from tagging and waits on neither of those:
+`next` is kept mergeable at all times, which is the point of the branch.
 
 # Completed Steps
 
-- 2026-08-24 Bind the plaintext HTTP listener deliberately, via
-  `BIND_ADDRESS` defaulting to `127.0.0.1`, and document the
-  reverse-proxy deployment. A hostname, an empty value or a value
-  carrying a port is a startup error, and the `Dockerfile` sets
-  `0.0.0.0` because a loopback bind inside a container is unreachable
-  (https://git.eeqj.de/sneak/webhooker/issues/268). The same commit
-  removed the shutdown race: `httpServer` is built in the constructor
-  rather than assigned from the serving goroutine, which orders the
-  write before every fx hook and rules out the nil dereference a
-  SIGTERM arriving first would have caused, and `sentryEnabled` is an
-  `atomic.Bool` (https://git.eeqj.de/sneak/webhooker/issues/226)
-- 2026-08-24 Remove inbound request signature verification. The
-  entrypoint UUID is the authentication secret, so the per-entrypoint
-  shared secret, the `internal/signature` package, the receiver check,
-  the model fields and the forms are all gone. This reverses the
-  feature that landed earlier in the same milestone
-  (https://git.eeqj.de/sneak/webhooker/issues/67,
+- 2026-08-24 Bind the plaintext HTTP listener deliberately, via `BIND_ADDRESS`
+  defaulting to `127.0.0.1`, and document the reverse-proxy deployment. A
+  hostname, an empty value or a value carrying a port is a startup error, and
+  the `Dockerfile` sets `0.0.0.0` because a loopback bind inside a container is
+  unreachable (https://git.eeqj.de/sneak/webhooker/issues/268). The same commit
+  removed the shutdown race: `httpServer` is built in the constructor rather
+  than assigned from the serving goroutine, which orders the write before every
+  fx hook and rules out the nil dereference a SIGTERM arriving first would have
+  caused, and `sentryEnabled` is an `atomic.Bool`
+  (https://git.eeqj.de/sneak/webhooker/issues/226)
+- 2026-08-24 Remove inbound request signature verification. The entrypoint UUID
+  is the authentication secret, so the per-entrypoint shared secret, the
+  `internal/signature` package, the receiver check, the model fields and the
+  forms are all gone. This reverses the feature that landed earlier in the same
+  milestone (https://git.eeqj.de/sneak/webhooker/issues/67,
   https://git.eeqj.de/sneak/webhooker/issues/279)
-- 2026-08-24 Stamp the build version into the binary and render it in
-  the UI footer. `script/version` is the single source — `$VERSION`,
-  else `git describe --tags --always --dirty`, else `unknown` — so a
-  `make build` binary and a `make docker` image from one checkout
-  report the same thing, and nothing in it varies between two builds
-  of the same commit, which the release gate's byte-identical
-  assertion would catch
+- 2026-08-24 Stamp the build version into the binary and render it in the UI
+  footer. `script/version` is the single source — `$VERSION`, else
+  `git describe --tags --always --dirty`, else `unknown` — so a `make build`
+  binary and a `make docker` image from one checkout report the same thing, and
+  nothing in it varies between two builds of the same commit, which the release
+  gate's byte-identical assertion would catch
   (https://git.eeqj.de/sneak/webhooker/issues/253)
-- 2026-08-24 Derive cookie `Secure` and CSRF strictness from the
-  request transport rather than from `WEBHOOKER_ENVIRONMENT`. Behind a
-  real TLS proxy with the environment left at its `dev` default, the
-  session cookie silently lost `Secure` while the CSRF cookie on the
-  same response kept it. `X-Forwarded-Proto` is now matched
-  case-insensitively on its first comma-separated element, so `HTTPS`
-  and `https, http` no longer fall to the relaxed CSRF path
-  (https://git.eeqj.de/sneak/webhooker/issues/269)
-- 2026-08-24 Roll back a failed webhook deletion instead of committing
-  it. A failing delete committed whatever had already succeeded,
-  hard-deleted the per-webhook event database anyway, and redirected as
-  though it had worked — orphaned config plus permanently destroyed
-  history, reported as success. All three delete positions now roll
-  back with the event database intact
+- 2026-08-24 Derive cookie `Secure` and CSRF strictness from the request
+  transport rather than from `WEBHOOKER_ENVIRONMENT`. Behind a real TLS proxy
+  with the environment left at its `dev` default, the session cookie silently
+  lost `Secure` while the CSRF cookie on the same response kept it.
+  `X-Forwarded-Proto` is now matched case-insensitively on its first
+  comma-separated element, so `HTTPS` and `https, http` no longer fall to the
+  relaxed CSRF path (https://git.eeqj.de/sneak/webhooker/issues/269)
+- 2026-08-24 Roll back a failed webhook deletion instead of committing it. A
+  failing delete committed whatever had already succeeded, hard-deleted the
+  per-webhook event database anyway, and redirected as though it had worked —
+  orphaned config plus permanently destroyed history, reported as success. All
+  three delete positions now roll back with the event database intact
   (https://git.eeqj.de/sneak/webhooker/issues/262)
 - 2026-08-24 Name a deleted target on its historical deliveries, marked
-  `(deleted)`, rather than leaving the event log unable to say where a
-  delivery went. A deleted target's credentials stay masked exactly as
-  a live one's, and it cannot become deliverable again through the
-  receiver, resubmit, replay, the edit form or the toggle
-  (https://git.eeqj.de/sneak/webhooker/issues/211)
-- 2026-08-24 Bound both request-controlled `/metrics` label dimensions,
-  so the unauthenticated receiver is no longer a memory-exhaustion
-  vector: `handler` carries the chi route pattern, and `method` folds
-  anything chi cannot route onto a single `(unmatched)` sentinel. Both
-  were reproduced before the fix — 300 random method tokens took the
-  series count from 106 to 7,631, and path flooding reached 62,532 —
-  and a label audit across a live scrape found no third unbounded
-  dimension (https://git.eeqj.de/sneak/webhooker/issues/254,
+  `(deleted)`, rather than leaving the event log unable to say where a delivery
+  went. A deleted target's credentials stay masked exactly as a live one's, and
+  it cannot become deliverable again through the receiver, resubmit, replay, the
+  edit form or the toggle (https://git.eeqj.de/sneak/webhooker/issues/211)
+- 2026-08-24 Bound both request-controlled `/metrics` label dimensions, so the
+  unauthenticated receiver is no longer a memory-exhaustion vector: `handler`
+  carries the chi route pattern, and `method` folds anything chi cannot route
+  onto a single `(unmatched)` sentinel. Both were reproduced before the fix —
+  300 random method tokens took the series count from 106 to 7,631, and path
+  flooding reached 62,532 — and a label audit across a live scrape found no
+  third unbounded dimension (https://git.eeqj.de/sneak/webhooker/issues/254,
   https://git.eeqj.de/sneak/webhooker/issues/261)
-- 2026-08-24 Validate `max_retries` on both target forms. `abc`, `2.7`
-  and `-5` silently became 0 — fire-and-forget — including on the edit
-  path, where it destroyed a working value, and `999999999` stored
-  verbatim. The ceiling of 20 is the `max` both templates already
-  declared (https://git.eeqj.de/sneak/webhooker/issues/221)
-- 2026-08-24 Resubmit a stored event as a new undelivered event, so a
-  backend under development can be tested against real captured
-  traffic. Per-delivery replay cannot serve that: it re-sends one
-  finished delivery to its own original target, and a target created
-  for a dev backend has no prior delivery to replay. Resubmit
-  re-injects the stored event at the top of the receiver path and fans
-  it out to whatever targets are active now
+- 2026-08-24 Validate `max_retries` on both target forms. `abc`, `2.7` and `-5`
+  silently became 0 — fire-and-forget — including on the edit path, where it
+  destroyed a working value, and `999999999` stored verbatim. The ceiling of 20
+  is the `max` both templates already declared
+  (https://git.eeqj.de/sneak/webhooker/issues/221)
+- 2026-08-24 Resubmit a stored event as a new undelivered event, so a backend
+  under development can be tested against real captured traffic. Per-delivery
+  replay cannot serve that: it re-sends one finished delivery to its own
+  original target, and a target created for a dev backend has no prior delivery
+  to replay. Resubmit re-injects the stored event at the top of the receiver
+  path and fans it out to whatever targets are active now
   (https://git.eeqj.de/sneak/webhooker/issues/250)
-- 2026-08-20 Take an exclusive lock on `DATA_DIR` at startup, so two
-  instances on one directory cannot both deliver
+- 2026-08-20 Take an exclusive lock on `DATA_DIR` at startup, so two instances
+  on one directory cannot both deliver
   (https://git.eeqj.de/sneak/webhooker/issues/201)
-- 2026-08-20 Shut down the app when the HTTP listener fails. The
-  `OnStart` hook returned as soon as the serving goroutine was
-  spawned, so a failed listen left fx reporting RUNNING and a live
-  process with nothing bound — invisible to systemd and Docker restart
-  policies (https://git.eeqj.de/sneak/webhooker/issues/200)
+- 2026-08-20 Shut down the app when the HTTP listener fails. The `OnStart` hook
+  returned as soon as the serving goroutine was spawned, so a failed listen left
+  fx reporting RUNNING and a live process with nothing bound — invisible to
+  systemd and Docker restart policies
+  (https://git.eeqj.de/sneak/webhooker/issues/200)
 - 2026-08-20 Stop target credentials leaking into the per-webhook event
-  databases (https://git.eeqj.de/sneak/webhooker/issues/206), log SQL
-  with placeholders rather than bound values
-  (https://git.eeqj.de/sneak/webhooker/issues/207), and fail loudly on
-  half-set metrics auth credentials
-  (https://git.eeqj.de/sneak/webhooker/issues/205)
-- 2026-08-20 Read queue depths with `Find`, not `Scan`. `Scan` swaps
-  GORM's own trace recorder in for the logging adapter, and that
-  recorder does not implement `gorm.ParamsFilter`, so those statements
-  logged their bound values interpolated and bypassed the suppression
-  above. The two units gated green against a `next` that lacked the
-  other, and `next` went red when both landed
+  databases (https://git.eeqj.de/sneak/webhooker/issues/206), log SQL with
+  placeholders rather than bound values
+  (https://git.eeqj.de/sneak/webhooker/issues/207), and fail loudly on half-set
+  metrics auth credentials (https://git.eeqj.de/sneak/webhooker/issues/205)
+- 2026-08-20 Read queue depths with `Find`, not `Scan`. `Scan` swaps GORM's own
+  trace recorder in for the logging adapter, and that recorder does not
+  implement `gorm.ParamsFilter`, so those statements logged their bound values
+  interpolated and bypassed the suppression above. The two units gated green
+  against a `next` that lacked the other, and `next` went red when both landed
   (https://git.eeqj.de/sneak/webhooker/issues/234)
 - 2026-08-20 Render per-attempt delivery detail in the event log
   (https://git.eeqj.de/sneak/webhooker/issues/202) and add replay of a
-  terminally failed delivery
-  (https://git.eeqj.de/sneak/webhooker/issues/203)
+  terminally failed delivery (https://git.eeqj.de/sneak/webhooker/issues/203)
 - 2026-08-20 Expose delivery metrics on `/metrics`
-  (https://git.eeqj.de/sneak/webhooker/issues/209) and document the
-  backup, restore and upgrade procedures
+  (https://git.eeqj.de/sneak/webhooker/issues/209) and document the backup,
+  restore and upgrade procedures
   (https://git.eeqj.de/sneak/webhooker/issues/210)
-- 2026-08-20 Add a `webhooker resetpw` subcommand and a bootstrap
-  banner. The admin bootstrap password was printed once among roughly
-  45 fx lines, and under `docker run -d` went to container logs subject
-  to rotation; there was no reset path at all, so recovery meant
-  hand-deleting the users row, documented nowhere. The password is read
-  from stdin or generated, never from argv where `/proc` would publish
-  it (https://git.eeqj.de/sneak/webhooker/issues/208)
-- 2026-08-20 Add `ALLOWED_EGRESS_CIDRS`, an allowlist-only escape hatch
-  for the SSRF guard, so a self-hosted proxy can forward into the
-  operator's own network. The guard's always-blocked set cannot be
-  reopened by configuration
+- 2026-08-20 Add a `webhooker resetpw` subcommand and a bootstrap banner. The
+  admin bootstrap password was printed once among roughly 45 fx lines, and under
+  `docker run -d` went to container logs subject to rotation; there was no reset
+  path at all, so recovery meant hand-deleting the users row, documented
+  nowhere. The password is read from stdin or generated, never from argv where
+  `/proc` would publish it (https://git.eeqj.de/sneak/webhooker/issues/208)
+- 2026-08-20 Add `ALLOWED_EGRESS_CIDRS`, an allowlist-only escape hatch for the
+  SSRF guard, so a self-hosted proxy can forward into the operator's own
+  network. The guard's always-blocked set cannot be reopened by configuration
   (https://git.eeqj.de/sneak/webhooker/issues/204)
-- 2026-08-20 Harden operator-set target headers, which were carried
-  unsafely across a redirect
-  (https://git.eeqj.de/sneak/webhooker/issues/233)
+- 2026-08-20 Harden operator-set target headers, which were carried unsafely
+  across a redirect (https://git.eeqj.de/sneak/webhooker/issues/233)
 - 2026-08-20 Add a target edit form with headers and timeout fields
   (https://git.eeqj.de/sneak/webhooker/issues/127)
-- 2026-08-18 Raise `script/test`'s per-package timeout from 30s to 90s,
-  matching the org-wide backstop. `go test` applies `-timeout` per
-  package, and `internal/handlers` had grown past the old budget: a
-  cache-defeated build failed outright at `GOMAXPROCS=4`, and every run
-  under deliberate host load breached 30s. The measurement table lives
-  in the script (#194)
-- 2026-08-18 Re-sync `REPO_POLICIES.md` from `prompts`. The local copy
-  was stale and still mandated a 20s test target with a 30s timeout,
-  which the org replaced with a 60s cap and a 90s backstop. A synced
-  copy is not a source; reading it as one nearly produced a PR against
-  `prompts` proposing a change already merged there (#196)
-- 2026-08-18 Report handler panics through the logger and answer 500.
-  chi v1.5.5's `Recoverer` scans for a `panic(0x` frame the runtime no
-  longer emits, then indexes `pkg[-1:]`, so it panicked inside its own
-  stack printer before writing a byte: the recovery never ran, the
-  client got a dropped connection instead of a 500, and the original
-  panic was lost. A local middleware replaces it, bounded by
-  `MaxPanicLogLineBytes` (#187)
-- 2026-08-18 Route GORM's logger through `slog` and bound it. Every
-  `gorm.Open` left `logger.Default` in place at `Warn` with
-  `IgnoreRecordNotFoundError` false, so **every record-not-found
-  printed the fully interpolated SQL to stdout** — including the
-  client-chosen path on `/webhook/{uuid}` and the submitted username on
-  the login form, at no level the operator set and outside
-  `internal/logger` entirely. Three call sites, not the two the issue
-  named (#178)
-- 2026-08-18 Bound every `slog` line against client-chosen text. Eight
-  sites reachable unauthenticated, found by reading every `slog` call in
-  the tree rather than only the one reported; the budget moved to a
-  shared `internal/logfield` so no second truncation exists. `DEBUG`
-  being off by default is not a bound and is not treated as one (#176)
-- 2026-08-18 Stop a slow host turning a login-guard test into a
-  segfault. A non-fatal `assert` on an acquire result was dereferenced
-  on the next line, so one timing miss killed the whole
-  `internal/middleware` binary and reddened CI for unrelated PRs. The
-  fix also removed a real production race — `acquire` could shed a
-  request with a slot standing free, because Go picks uniformly among
-  ready `select` cases (#186)
-- 2026-08-18 Send the chi route pattern to Sentry rather than the
-  concrete path. The receiver's path carries the entrypoint capability
-  token, so every Sentry event from `/webhook/{uuid}` shipped a live
-  credential to a third party. Request `Data`, `QueryString`, `Cookies`
-  and `Env` are dropped and headers reduced to an allowlist (#179)
-- 2026-08-18 Read form fields from the POST body only. `r.FormValue`
-  merges the query string, so a login could be driven by URL parameters
-  — putting the password somewhere that lands in access logs, proxy
-  logs and browser history (#160)
-- 2026-08-18 Verify login credentials before spending rate-limit
-  budget, so a flood of wrong passwords cannot lock out the account it
-  is guessing at. The manager took this decision rather than stall the
-  queue; it is flagged on the issue for reversal (#150)
-- 2026-08-18 Run all linting in Docker via `Dockerfile.lint`. Host lint
-  was wrong in both directions from version skew and shared caches.
-  `script/lint` asserts the summary line, because `--no-cache-filter`
-  silently ignores a stage name it does not match — the flag that makes
-  the gate meaningful fails open (#109)
-- 2026-08-18 Serve an event's full stored body over HTTP. The list
-  query truncates for rendering, and that truncated value was the only
-  way to read a body, so the full payload was unreachable (#157)
+- 2026-08-18 Raise `script/test`'s per-package timeout from 30s to 90s, matching
+  the org-wide backstop. `go test` applies `-timeout` per package, and
+  `internal/handlers` had grown past the old budget: a cache-defeated build
+  failed outright at `GOMAXPROCS=4`, and every run under deliberate host load
+  breached 30s. The measurement table lives in the script (#194)
+- 2026-08-18 Re-sync `REPO_POLICIES.md` from `prompts`. The local copy was stale
+  and still mandated a 20s test target with a 30s timeout, which the org
+  replaced with a 60s cap and a 90s backstop. A synced copy is not a source;
+  reading it as one nearly produced a PR against `prompts` proposing a change
+  already merged there (#196)
+- 2026-08-18 Report handler panics through the logger and answer 500. chi
+  v1.5.5's `Recoverer` scans for a `panic(0x` frame the runtime no longer emits,
+  then indexes `pkg[-1:]`, so it panicked inside its own stack printer before
+  writing a byte: the recovery never ran, the client got a dropped connection
+  instead of a 500, and the original panic was lost. A local middleware replaces
+  it, bounded by `MaxPanicLogLineBytes` (#187)
+- 2026-08-18 Route GORM's logger through `slog` and bound it. Every `gorm.Open`
+  left `logger.Default` in place at `Warn` with `IgnoreRecordNotFoundError`
+  false, so **every record-not-found printed the fully interpolated SQL to
+  stdout** — including the client-chosen path on `/webhook/{uuid}` and the
+  submitted username on the login form, at no level the operator set and outside
+  `internal/logger` entirely. Three call sites, not the two the issue named
+  (#178)
+- 2026-08-18 Bound every `slog` line against client-chosen text. Eight sites
+  reachable unauthenticated, found by reading every `slog` call in the tree
+  rather than only the one reported; the budget moved to a shared
+  `internal/logfield` so no second truncation exists. `DEBUG` being off by
+  default is not a bound and is not treated as one (#176)
+- 2026-08-18 Stop a slow host turning a login-guard test into a segfault. A
+  non-fatal `assert` on an acquire result was dereferenced on the next line, so
+  one timing miss killed the whole `internal/middleware` binary and reddened CI
+  for unrelated PRs. The fix also removed a real production race — `acquire`
+  could shed a request with a slot standing free, because Go picks uniformly
+  among ready `select` cases (#186)
+- 2026-08-18 Send the chi route pattern to Sentry rather than the concrete path.
+  The receiver's path carries the entrypoint capability token, so every Sentry
+  event from `/webhook/{uuid}` shipped a live credential to a third party.
+  Request `Data`, `QueryString`, `Cookies` and `Env` are dropped and headers
+  reduced to an allowlist (#179)
+- 2026-08-18 Read form fields from the POST body only. `r.FormValue` merges the
+  query string, so a login could be driven by URL parameters — putting the
+  password somewhere that lands in access logs, proxy logs and browser history
+  (#160)
+- 2026-08-18 Verify login credentials before spending rate-limit budget, so a
+  flood of wrong passwords cannot lock out the account it is guessing at. The
+  manager took this decision rather than stall the queue; it is flagged on the
+  issue for reversal (#150)
+- 2026-08-18 Run all linting in Docker via `Dockerfile.lint`. Host lint was
+  wrong in both directions from version skew and shared caches. `script/lint`
+  asserts the summary line, because `--no-cache-filter` silently ignores a stage
+  name it does not match — the flag that makes the gate meaningful fails open
+  (#109)
+- 2026-08-18 Serve an event's full stored body over HTTP. The list query
+  truncates for rendering, and that truncated value was the only way to read a
+  body, so the full payload was unreachable (#157)
 - 2026-08-18 Bound the access log line against client-chosen text.
-  `internal/logfield` budgets by *encoded* bytes, not runes, so a
-  handler's JSON escaping cannot multiply a field past its allowance
-  (#146)
-- 2026-08-18 Mark superseded CI commits `failure` rather than
-  `skipped`. A skipped run rolls up green, so a commit that was never
-  tested reported success (#152)
-- 2026-08-18 Set `fx.StopTimeout` inside the container stop grace, so
-  shutdown hooks are bounded by a deadline the orchestrator will
-  actually honour rather than being killed mid-flush (#134)
-- 2026-08-17 Bucket IPv6 rate-limit keys by `/64`. A single allocation
-  hands out 2^64 addresses, so per-address keying let one client mint
-  unlimited buckets. Manager decision, recorded on the issue (#125)
-- 2026-08-17 Correct release-blocking README and startup-warning
-  inaccuracies, including claims about behaviour the code does not have
-  (#151)
+  `internal/logfield` budgets by _encoded_ bytes, not runes, so a handler's JSON
+  escaping cannot multiply a field past its allowance (#146)
+- 2026-08-18 Mark superseded CI commits `failure` rather than `skipped`. A
+  skipped run rolls up green, so a commit that was never tested reported success
+  (#152)
+- 2026-08-18 Set `fx.StopTimeout` inside the container stop grace, so shutdown
+  hooks are bounded by a deadline the orchestrator will actually honour rather
+  than being killed mid-flush (#134)
+- 2026-08-17 Bucket IPv6 rate-limit keys by `/64`. A single allocation hands out
+  2^64 addresses, so per-address keying let one client mint unlimited buckets.
+  Manager decision, recorded on the issue (#125)
+- 2026-08-17 Correct release-blocking README and startup-warning inaccuracies,
+  including claims about behaviour the code does not have (#151)
 - 2026-08-17 Fetch and verify Alpine.js at build time against
-  `static/vendor.sha256` instead of committing the minified blob, so
-  the dependency is pinned by hash rather than by trust (#145)
-- 2026-08-17 Bound the event log's rendered bodies in the query itself,
-  so a large stored payload cannot be read into memory just to be
-  truncated for display (#135)
-- 2026-08-17 Mask the `http` target's destination URL in the UI: it can
-  carry a bearer credential in its path or query, and was rendered
-  verbatim. Manager decision to mask unconditionally (#115)
-- 2026-08-14 Bound shutdown hooks by their stop context, so a hook that
-  hangs cannot hold the process past its grace period (#102)
-- 2026-08-14 Render templates via a buffer rather than the
-  `ResponseWriter`, so a template error part-way through cannot commit
-  a 200 and then fail — the response is written only once it is whole
-  (#123)
-- 2026-08-14 Align the session codec's max-age with the 7-day absolute
-  cap. The codec accepted cookies the session layer considered expired,
-  so the cap was enforced in one place and not the other (#108)
-- 2026-08-12 Warn when `TRUSTED_PROXIES` is empty in production, where
-  the safe default silently discards forwarded headers and every client
-  rate-limits as the proxy's address (#149)
-- 2026-08-12 Bound the receiver rate limit per client IP across the
-  whole `/webhook/*` route. The existing limiter keyed on the request
-  path and `/webhook/{uuid}` matches any single segment, so a client
-  that invented a fresh path per request minted a fresh bucket per
-  request: the limit on the only unauthenticated endpoint bounded
-  nothing in aggregate, and every request still cost an entrypoint
-  lookup before it 404ed. An outer limiter keyed on the client address
-  alone now bounds that, chained in front of the unchanged
+  `static/vendor.sha256` instead of committing the minified blob, so the
+  dependency is pinned by hash rather than by trust (#145)
+- 2026-08-17 Bound the event log's rendered bodies in the query itself, so a
+  large stored payload cannot be read into memory just to be truncated for
+  display (#135)
+- 2026-08-17 Mask the `http` target's destination URL in the UI: it can carry a
+  bearer credential in its path or query, and was rendered verbatim. Manager
+  decision to mask unconditionally (#115)
+- 2026-08-14 Bound shutdown hooks by their stop context, so a hook that hangs
+  cannot hold the process past its grace period (#102)
+- 2026-08-14 Render templates via a buffer rather than the `ResponseWriter`, so
+  a template error part-way through cannot commit a 200 and then fail — the
+  response is written only once it is whole (#123)
+- 2026-08-14 Align the session codec's max-age with the 7-day absolute cap. The
+  codec accepted cookies the session layer considered expired, so the cap was
+  enforced in one place and not the other (#108)
+- 2026-08-12 Warn when `TRUSTED_PROXIES` is empty in production, where the safe
+  default silently discards forwarded headers and every client rate-limits as
+  the proxy's address (#149)
+- 2026-08-12 Bound the receiver rate limit per client IP across the whole
+  `/webhook/*` route. The existing limiter keyed on the request path and
+  `/webhook/{uuid}` matches any single segment, so a client that invented a
+  fresh path per request minted a fresh bucket per request: the limit on the
+  only unauthenticated endpoint bounded nothing in aggregate, and every request
+  still cost an entrypoint lookup before it 404ed. An outer limiter keyed on the
+  client address alone now bounds that, chained in front of the unchanged
   per-entrypoint limiter (#139)
-- 2026-08-12 Correct release-blocking documentation inaccuracies: the
-  README promised manual redelivery in the present tense in three
-  places when nothing implements it (the same false claim also sat in
-  the doc comment that was its source text), the env table omitted
-  `RETENTION_SWEEP_INTERVAL`, and `TODO.md` itself omitted five landed
-  units (#141)
-- 2026-08-12 Make the CI gate execute the checks it reports on. The
-  workflow now writes a build-context fingerprint before calling
-  `script/cibuild`, so a code commit invalidates the `COPY` layer of
-  the lint and builder stages while a docs-only commit still replays
-  from cache; a superseding run also rewrites the `failure` status
-  Gitea leaves on commits it cancelled and never tested. Verified by
-  pushing a deliberately broken test and watching CI go red (#119)
-- 2026-08-12 Require a positive `RETENTION_SWEEP_INTERVAL`: a
-  non-positive value reached `time.NewTicker` in both the retention
-  reaper and the archive sweeper, panicking two goroutines with no
-  recover after startup had already reported success (#140)
-- 2026-08-12 Bound the `X-Forwarded-For` scan's allocation to the hop
-  cap: the reverse walk cuts entries with `strings.LastIndexByte`
-  instead of joining and splitting, so a 1 MB header allocates 16 bytes
-  rather than 1.6 MB per request on the unauthenticated receiver.
-  Semantics proven unchanged by differential testing against the
-  previous implementation (#133)
+- 2026-08-12 Correct release-blocking documentation inaccuracies: the README
+  promised manual redelivery in the present tense in three places when nothing
+  implements it (the same false claim also sat in the doc comment that was its
+  source text), the env table omitted `RETENTION_SWEEP_INTERVAL`, and `TODO.md`
+  itself omitted five landed units (#141)
+- 2026-08-12 Make the CI gate execute the checks it reports on. The workflow now
+  writes a build-context fingerprint before calling `script/cibuild`, so a code
+  commit invalidates the `COPY` layer of the lint and builder stages while a
+  docs-only commit still replays from cache; a superseding run also rewrites the
+  `failure` status Gitea leaves on commits it cancelled and never tested.
+  Verified by pushing a deliberately broken test and watching CI go red (#119)
+- 2026-08-12 Require a positive `RETENTION_SWEEP_INTERVAL`: a non-positive value
+  reached `time.NewTicker` in both the retention reaper and the archive sweeper,
+  panicking two goroutines with no recover after startup had already reported
+  success (#140)
+- 2026-08-12 Bound the `X-Forwarded-For` scan's allocation to the hop cap: the
+  reverse walk cuts entries with `strings.LastIndexByte` instead of joining and
+  splitting, so a 1 MB header allocates 16 bytes rather than 1.6 MB per request
+  on the unauthenticated receiver. Semantics proven unchanged by differential
+  testing against the previous implementation (#133)
 - 2026-08-12 Cap the `X-Forwarded-For` hop walk at 64 entries, so an
-  attacker-supplied chain cannot burn unbounded CPU in the rate-limit
-  key function; running off the end falls back to the peer address
-  (#124)
-- 2026-08-12 Gate forwarded-header trust behind a `TRUSTED_PROXIES` CIDR
-  list: all three rate limiters key on the connection's own address
-  unless the direct peer is a configured proxy, in which case
-  `X-Forwarded-For` is walked right to left for the first non-proxy hop.
-  Default trusts nothing, and a set-but-unparseable value aborts
-  startup. Before this, any client could mint a fresh bucket or drain
-  another's by rotating a spoofed header (#88)
-- 2026-08-11 Web UI cleanup: nav terminology unified on Webhooks, the
-  Profile settings placeholder removed, a progressive-enhancement copy
-  button for the entrypoint URL, and retention form copy that states the
-  actual policy (deletion by the reaper, 0 retains forever) (#57)
-- 2026-08-11 Mask the webhook credential in delivery errors and logs:
-  Go embeds the request URL in `*url.Error`, so every transport failure
-  persisted the full Slack webhook URL into the per-webhook event
-  database via `DeliveryResult.Error`, a field a future REST API would
-  have served. `maskURLError` drops path, query and userinfo while
-  preserving the wrapped cause, so `errors.Is`/`As` and `Timeout()`
-  still work and DNS, TLS and timeout failures still read differently
-  (#118)
+  attacker-supplied chain cannot burn unbounded CPU in the rate-limit key
+  function; running off the end falls back to the peer address (#124)
+- 2026-08-12 Gate forwarded-header trust behind a `TRUSTED_PROXIES` CIDR list:
+  all three rate limiters key on the connection's own address unless the direct
+  peer is a configured proxy, in which case `X-Forwarded-For` is walked right to
+  left for the first non-proxy hop. Default trusts nothing, and a
+  set-but-unparseable value aborts startup. Before this, any client could mint a
+  fresh bucket or drain another's by rotating a spoofed header (#88)
+- 2026-08-11 Web UI cleanup: nav terminology unified on Webhooks, the Profile
+  settings placeholder removed, a progressive-enhancement copy button for the
+  entrypoint URL, and retention form copy that states the actual policy
+  (deletion by the reaper, 0 retains forever) (#57)
+- 2026-08-11 Mask the webhook credential in delivery errors and logs: Go embeds
+  the request URL in `*url.Error`, so every transport failure persisted the full
+  Slack webhook URL into the per-webhook event database via
+  `DeliveryResult.Error`, a field a future REST API would have served.
+  `maskURLError` drops path, query and userinfo while preserving the wrapped
+  cause, so `errors.Is`/`As` and `Timeout()` still work and DNS, TLS and timeout
+  failures still read differently (#118)
 - 2026-08-11 Rate-limit the public webhook receiver endpoint
-  (`RECEIVER_RATE_LIMIT`, default 120/min), keyed on client IP plus
-  entrypoint path so one entrypoint cannot exhaust another's budget;
-  over-limit requests get 429 with `Retry-After`. It was the one
-  unauthenticated, internet-facing endpoint with no limit at all (#64)
+  (`RECEIVER_RATE_LIMIT`, default 120/min), keyed on client IP plus entrypoint
+  path so one entrypoint cannot exhaust another's budget; over-limit requests
+  get 429 with `Retry-After`. It was the one unauthenticated, internet-facing
+  endpoint with no limit at all (#64)
 - 2026-08-11 Enforce the body size limit before CSRF parses the form:
-  `MaxBodySize` is now first in all four form-parsing route groups, so
-  an oversized request is rejected with 413 instead of being read in
-  full by the CSRF middleware before any cap applied (#90)
-- 2026-08-11 Mask target config on the source detail page, which
-  rendered the stored blob verbatim and so exposed the Slack
-  incoming-webhook URL — a bearer credential that cannot be revoked
-  per-holder. Config reaches the template only as a `TargetView` of
-  labelled fields, and header values are rendered as a count (#113)
-- 2026-08-11 Allow `retention_days` of 0 to mean retain forever, via a
-  sentinel written in `BeforeSave` so the GORM column default cannot
-  win the race. Also bounds the reaper's cutoff arithmetic: day counts
-  above 106751 overflowed `time.Duration` and wrapped the cutoff into
-  the future, where every row matched and the sweep deleted everything
-  (#79)
+  `MaxBodySize` is now first in all four form-parsing route groups, so an
+  oversized request is rejected with 413 instead of being read in full by the
+  CSRF middleware before any cap applied (#90)
+- 2026-08-11 Mask target config on the source detail page, which rendered the
+  stored blob verbatim and so exposed the Slack incoming-webhook URL — a bearer
+  credential that cannot be revoked per-holder. Config reaches the template only
+  as a `TargetView` of labelled fields, and header values are rendered as a
+  count (#113)
+- 2026-08-11 Allow `retention_days` of 0 to mean retain forever, via a sentinel
+  written in `BeforeSave` so the GORM column default cannot win the race. Also
+  bounds the reaper's cutoff arithmetic: day counts above 106751 overflowed
+  `time.Duration` and wrapped the cutoff into the future, where every row
+  matched and the sweep deleted everything (#79)
 - 2026-08-09 Inactivity-based session timeout: sliding idle expiry
-  (`SESSION_IDLE_TIMEOUT`, default `24h`) refreshed on authenticated
-  requests, with the 7-day absolute cap kept as an independent
-  backstop that activity never extends (#66)
+  (`SESSION_IDLE_TIMEOUT`, default `24h`) refreshed on authenticated requests,
+  with the 7-day absolute cap kept as an independent backstop that activity
+  never extends (#66)
 - 2026-08-09 Restart recovery and the 60s retry sweep terminally fail an
-  orphaned `retrying` delivery whose target type no longer supports
-  retries, recording a `DeliveryResult` with the reason instead of
-  leaving the delivery stuck forever (#82)
-- 2026-08-09 Root the delivery engine's worker pool and the retention
-  reaper's sweep loop at `context.Background()` rather than the fx
-  `OnStart` hook context (#97), which carries fx's 15s start timeout and
-  killed both roughly fifteen seconds after boot: the proxy silently
-  stopped delivering webhooks entirely, and the reaper never ran a
-  single sweep under its default one-hour interval
-- 2026-08-09 Archive writer lifecycle (#89): deleting a webhook (or its
-  last `database` target) evicts the cached archive writer and closes
-  its handle while deliberately leaving `archive-{webhookID}.db` on
-  disk, and a new `ArchiveSweeper` prunes idle archives on the existing
+  orphaned `retrying` delivery whose target type no longer supports retries,
+  recording a `DeliveryResult` with the reason instead of leaving the delivery
+  stuck forever (#82)
+- 2026-08-09 Root the delivery engine's worker pool and the retention reaper's
+  sweep loop at `context.Background()` rather than the fx `OnStart` hook context
+  (#97), which carries fx's 15s start timeout and killed both roughly fifteen
+  seconds after boot: the proxy silently stopped delivering webhooks entirely,
+  and the reaper never ran a single sweep under its default one-hour interval
+- 2026-08-09 Archive writer lifecycle (#89): deleting a webhook (or its last
+  `database` target) evicts the cached archive writer and closes its handle
+  while deliberately leaving `archive-{webhookID}.db` on disk, and a new
+  `ArchiveSweeper` prunes idle archives on the existing
   `RETENTION_SWEEP_INTERVAL` without ever creating an archive file
 - 2026-08-09 Configuration parsing fails loudly on set-but-unparseable
-  environment values: `envInt` removed in favour of `envPositiveInt`
-  plus a `PORT` range check, `envBool` now parses with
-  `strconv.ParseBool`, and defaults apply only to unset variables (#80)
-- 2026-08-07 Automatic event retention cleanup based on
-  `retention_days`, deleting expired events, deliveries, and delivery
-  results from each per-webhook event database (#63)
+  environment values: `envInt` removed in favour of `envPositiveInt` plus a
+  `PORT` range check, `envBool` now parses with `strconv.ParseBool`, and
+  defaults apply only to unset variables (#80)
+- 2026-08-07 Automatic event retention cleanup based on `retention_days`,
+  deleting expired events, deliveries, and delivery results from each
+  per-webhook event database (#63)
 - 2026-08-07 Update golangci-lint to v2.12.2 (Docker image digest in
-  `Dockerfile`, release-archive sha256 pins in `script/bootstrap`),
-  adopt the canonical `.golangci.yml` (v2 `linters.settings` layout so
-  `lll`/`funlen`/`cyclop`/`dupl` thresholds actually apply), and fix
-  all newly surfaced lint findings
-- 2026-07-07 Adopted scripts-to-rule-them-all: `script/` entrypoints,
-  Makefile shims, README Entrypoints section
+  `Dockerfile`, release-archive sha256 pins in `script/bootstrap`), adopt the
+  canonical `.golangci.yml` (v2 `linters.settings` layout so
+  `lll`/`funlen`/`cyclop`/`dupl` thresholds actually apply), and fix all newly
+  surfaced lint findings
+- 2026-07-07 Adopted scripts-to-rule-them-all: `script/` entrypoints, Makefile
+  shims, README Entrypoints section
 - 2026-03-25 pin golangci-lint Docker image for linting (#55)
-- 2026-03-18 CSRF middleware detects TLS per-request, fixing login over
-  plain HTTP and behind reverse proxies (#54)
+- 2026-03-18 CSRF middleware detects TLS per-request, fixing login over plain
+  HTTP and behind reverse proxies (#54)
 - 2026-03-17 root path redirects based on auth state (#52)
-- 2026-03-17 CSRF protection, SSRF prevention for HTTP delivery targets
-  with DNS rebinding defense, and per-IP login rate limiting (#42)
+- 2026-03-17 CSRF protection, SSRF prevention for HTTP delivery targets with DNS
+  rebinding defense, and per-IP login rate limiting (#42)
 - 2026-03-17 Slack target type for incoming webhook notifications (#47)
-- 2026-03-17 Dockerfile absolute paths and static linking (#49);
-  absolute dev DATA_DIR default and clarified env docs (#46)
-- 2026-03-05 security headers middleware, session regeneration on
-  login, request body size limits (#41)
-- 2026-03-04 tests for delivery, middleware, and session packages
-  (#32); removed the build-architecture global (#31)
-- 2026-03-04 1.0 MVP merge: Webhook/Entrypoint/Target rename, core
-  delivery engine with bounded worker pool and circuit breaker,
-  parallel fan-out, per-webhook event databases, management UI (#16)
-- 2026-03-01 repo brought to REPO_POLICIES standards; TODO.md folded
-  into README (#6)
+- 2026-03-17 Dockerfile absolute paths and static linking (#49); absolute dev
+  DATA_DIR default and clarified env docs (#46)
+- 2026-03-05 security headers middleware, session regeneration on login, request
+  body size limits (#41)
+- 2026-03-04 tests for delivery, middleware, and session packages (#32); removed
+  the build-architecture global (#31)
+- 2026-03-04 1.0 MVP merge: Webhook/Entrypoint/Target rename, core delivery
+  engine with bounded worker pool and circuit breaker, parallel fan-out,
+  per-webhook event databases, management UI (#16)
+- 2026-03-01 repo brought to REPO_POLICIES standards; TODO.md folded into README
+  (#6)
 
 # Future Steps
 
-- Delivery status and retry management UI. Replay of a terminally
-  failed delivery and per-attempt detail already landed
+- Delivery status and retry management UI. Replay of a terminally failed
+  delivery and per-attempt detail already landed
   (https://git.eeqj.de/sneak/webhooker/issues/203,
   https://git.eeqj.de/sneak/webhooker/issues/202)
-- Per-webhook rate limiting in the receiver handler (per-webhook config
-  plus handler enforcement; global limits must not apply to receiver
-  endpoints)
-- API key authentication for programmatic access (APIKey model exists;
-  Bearer token middleware does not)
+- Per-webhook rate limiting in the receiver handler (per-webhook config plus
+  handler enforcement; global limits must not apply to receiver endpoints)
+- API key authentication for programmatic access (APIKey model exists; Bearer
+  token middleware does not)
 - REST API v1
     - CRUD for webhooks, entrypoints, targets
     - event viewing and filtering endpoints
@@ -406,9 +370,9 @@ point of the branch.
     - OpenAPI specification
 - Analytics dashboard: success rates, response times, volume
 - A remember-me option at login
-- Password reset flow for a forgotten password over the web. The
-  authenticated password *change* flow already landed, and a lost
-  password is recoverable from the console with `webhooker resetpw`
+- Password reset flow for a forgotten password over the web. The authenticated
+  password _change_ flow already landed, and a lost password is recoverable from
+  the console with `webhooker resetpw`
   (https://git.eeqj.de/sneak/webhooker/issues/208)
 - Later, nice to have
     - email delivery target type

package.json

@@ -1,6 +1,7 @@
 {
     "private": true,
     "devDependencies": {
-        "eslint": "10.11.0"
+        "eslint": "10.11.0",
+        "prettier": "3.9.9"
     }
 }

script/bootstrap

@@ -3,8 +3,8 @@
 # this repo. Idempotent: every install is guarded by a check so already
 # installed tools are skipped. Base tooling comes from nix, apt, brew,
 # or apk (detected in that order); assumes NOTHING is present (not git,
-# make, or go). golangci-lint, node and ESLint are deliberately not
-# installed: linting runs only in docker, via script/lint.
+# make, or go). golangci-lint, node, ESLint and prettier are deliberately
+# not installed: they run only in docker, via script/lint and script/fmt.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
@@ -60,9 +60,10 @@ main() {
     if missing go; then pkg_install go golang go go; fi
 
     # Not installed here: docker is platform-specific and out of scope for a
-    # package-manager bootstrap, but script/lint and script/css need it.
+    # package-manager bootstrap, but script/lint, script/fmt and script/css
+    # need it.
     if missing docker; then
-        echo "bootstrap: docker not found; script/lint and script/css require it" >&2
+        echo "bootstrap: docker not found; script/lint, script/fmt and script/css require it" >&2
     fi
 
     go mod download

script/cibuild

@@ -1,8 +1,8 @@
 #!/bin/sh
-# script/cibuild: run the CI build. The Dockerfile runs the checks
-# (make fmt-check, lint, test), so a successful build implies a green
-# repo. Generic: needs no adaptation. The Gitea workflow runs this on
-# push.
+# script/cibuild: run the CI build. The Dockerfile runs the checks (the
+# gofmt check, golangci-lint, the stylesheet check, ESLint, the Markdown
+# check, make test), so a successful build implies a green repo. Generic:
+# needs no adaptation. The Gitea workflow runs this on push.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"

script/fmt

@@ -1,5 +1,7 @@
 #!/bin/sh
-# script/fmt: format all files (writes).
+# script/fmt: format all files (writes): the Go code with gofmt and
+# goimports, the Markdown with prettier. prettier is never installed
+# locally: it runs in docker, in the Dockerfile's Markdown stages.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
@@ -10,6 +12,7 @@ main() {
     if command -v goimports >/dev/null 2>&1; then
         goimports -w .
     fi
+    docker build --target markdown-output --output type=local,dest=. .
 }
 
 main "$@"

script/fmt-check

@@ -12,6 +12,7 @@ main() {
         gofmt -s -l .
         exit 1
     fi
+    docker build --target markdown-check --output type=cacheonly .
 }
 
 main "$@"

yarn.lock

@@ -470,6 +470,11 @@ prelude-ls@^1.2.1:
   resolved "https://registry.yarnpkg.com/prelude-ls/-/prelude-ls-1.2.1.tgz#debc6489d7a6e6b0e7611888cec880337d316396"
   integrity sha512-vkcDPrRZo1QZLbn5RLGPpg/WmIQ65qoWWhcGKf/b5eplkkarX0m9z8ppCat4mlOqUsWpyNuYgO3VRyrYHSzX5g==
 
+prettier@3.9.9:
+  version "3.9.9"
+  resolved "https://registry.yarnpkg.com/prettier/-/prettier-3.9.9.tgz#09b826918c91cd4cbc80e0cbd1d2a922ff04f233"
+  integrity sha512-Z/CJHIkdujO/OtN7nXUii0Rf3VT5SRuhjBA82Xvu2XhBUgX3nhP67T0LHceBdQLex7OOFGTox+Q5Yg8Jk2Qivg==
+
 punycode@^2.1.0:
   version "2.3.1"
   resolved "https://registry.yarnpkg.com/punycode/-/punycode-2.3.1.tgz#027422e2faec0b25e1549c3e1bd8309b9133b6e5"