Bind 0.0.0.0 to IPv4 only (closes #528 )

Go listens on any unspecified address with one socket that answers IPv4 and IPv6, so BIND_ADDRESS=0.0.0.0 also bound every IPv6 address, which the README says it does not. The listener now uses tcp4 for an IPv4 address, written plain or IPv4-mapped; :: still binds both. The server's start hook suppresses contextcheck, as the other start hooks do. The image's health check asked for localhost, which wget reached over ::1 only. It now asks for the container's own address: its IPv4 address, or its IPv6 address on an IPv6-only network. A loopback bind answers neither. The README says such a network needs ::, drops the bindv6only condition from :: (Go sets that socket option itself) and names an ss check. Model: opus-5-5
2026-10-15 12:32:04 +00:00
41 changed files with 848 additions and 856 deletions
@@ -274,8 +274,17 @@ EXPOSE 8080
 # port.
 ENV BIND_ADDRESS=0.0.0.0

+# The probe requests the container's own address, not loopback, so a
+# listener that answers only on loopback (an empty or loopback
+# BIND_ADDRESS) fails it. On a network with IPv4, hostname -i prints the
+# container's IPv4 address, which 0.0.0.0 and :: both answer. On an
+# IPv6-only network it prints none, and the probe requests the IPv6
+# address /etc/hosts lists under the container's hostname instead, which
+# only :: answers.
 HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
-    CMD wget --no-verbose --tries=1 --spider http://localhost:8080/.well-known/healthcheck || exit 1
+    CMD addr="$(hostname -i 2>/dev/null | cut -d ' ' -f 1)"; \
+        [ -n "$addr" ] || addr="[$(getent hosts "$(hostname)" | cut -d ' ' -f 1)]"; \
+        wget --no-verbose --tries=1 --spider "http://$addr:8080/.well-known/healthcheck" || exit 1

 ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
 CMD ["/app/webhooker"]
@@ -310,16 +310,17 @@ the namespace, whatever the process bound. Exposure is decided at the publish
 flag instead — `-p 127.0.0.1:8080:8080` rather than `-p 8080:8080` — which is
 the operator's to choose and is what [Running with Docker](#running-with-docker)
 shows. A loopback bind inside a container buys nothing and makes the process
-unreachable through its own published port.
+unreachable through its own published port. A container on an IPv6-only Docker
+network has no IPv4 address for `0.0.0.0` to answer on, so there it needs
+`BIND_ADDRESS=::`.

 The value must be an IP address literal:

 - `127.0.0.1` — loopback only (the binary's default). Use this with a reverse
  proxy on the same host.
- `0.0.0.0` — every IPv4 address. The image's default; on a bare host, only
-  behind a firewall on the port.
- `::` — every address, IPv6 and (on Linux, with the default
-  `net.ipv6.bindv6only=0`) IPv4 as well.
+- `0.0.0.0` — every IPv4 address and no IPv6 address. The image's default; on a
+  bare host, only behind a firewall on the port.
+- `::` — every IPv6 address and every IPv4 address.
 - A specific address such as `10.0.0.5` — that interface only.

 An **empty** value is treated as unset, as everywhere else here, and takes the
@@ -340,7 +341,8 @@ machine that has no such interface — is a valid literal, so it reaches the
 listener and fails there. The process logs the bind error and exits non-zero
 rather than staying up with nothing listening. The effective value is in the
 `bindAddress` field of the startup log line, which is the way to check what a
-running deployment actually bound.
+running deployment actually bound. On a bare host, `ss -ltn` lists the socket
+itself as `0.0.0.0:8080` for a `0.0.0.0` bind and as `*:8080` for `::`.

 #### Metrics credentials

@@ -668,9 +670,9 @@ Either set a literal or leave the variable out entirely.
 Overriding `BIND_ADDRESS` to a loopback address in a container — by that route
 or deliberately — makes the container unreachable from outside its namespace
 even with `-p`. The published port answers nothing, and the health check fails
-too: it requests `http://localhost:8080`, `localhost` resolves to `::1` first,
-and a `127.0.0.1` bind is not listening there. The container then goes
-`unhealthy` about **65 seconds** after start — from
+too: it requests the container's own address (its IPv4 address, or its IPv6
+address on an IPv6-only network), where a loopback bind is not listening. The
+container then goes `unhealthy` about **65 seconds** after start — from
 `HEALTHCHECK --start-period=5s --interval=30s --retries=3`, so failing probes at
 5s, 35s and 65s, and `unhealthy` on the third. (Docker's probe cadence during
 the start period has changed between versions; re-derive from those three values
@@ -726,8 +728,8 @@ the credentials.
      address (directly, or through anything that can rewrite source addresses,
      such as NAT or a published container port). The `remoteIP` field of the
      `http request` log line for a request that came through the proxy shows
-      that address; the health check's own lines show `::1`. See
-      [Trusted proxies](#trusted-proxies).
+      that address; the health check's own lines show the container's own
+      address. See [Trusted proxies](#trusted-proxies).
    - Leave `BIND_ADDRESS` and `DATA_DIR` unset: the image sets `BIND_ADDRESS`
      to `0.0.0.0`, and `DATA_DIR` defaults to `/var/lib/webhooker`.
    - Everything else is optional; see [Configuration](#configuration).
@@ -1568,27 +1570,29 @@ did not arrive on the URL and counts in neither.
 A delivery destination for events. Each target defines where and how events
 should be forwarded.

-| Field          | Type       | Description                                                                                                                                                                             |
-| -------------- | ---------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `id`           | UUID       | Primary key                                                                                                                                                                             |
-| `webhook_id`   | UUID       | Foreign key → Webhook                                                                                                                                                                   |
-| `name`         | string     | Human-readable name                                                                                                                                                                     |
-| `type`         | TargetType | One of: `http`, `slack`, `database`, `log`                                                                                                                                              |
-| `active`       | boolean    | Whether deliveries are enabled (default: true)                                                                                                                                          |
-| `config`       | JSON text  | Type-specific configuration                                                                                                                                                             |
-| `max_attempts` | integer    | How many times an `http` or `slack` target attempts each delivery in all: at least 1, and 1 by default. Ignored by `database` and `log` targets. The web UI labels it Delivery attempts |
+| Field         | Type       | Description                                                                                                                                                                                                                                                                                                                                                 |
+| ------------- | ---------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `id`          | UUID       | Primary key                                                                                                                                                                                                                                                                                                                                                 |
+| `webhook_id`  | UUID       | Foreign key → Webhook                                                                                                                                                                                                                                                                                                                                       |
+| `name`        | string     | Human-readable name                                                                                                                                                                                                                                                                                                                                         |
+| `type`        | TargetType | One of: `http`, `slack`, `database`, `log`                                                                                                                                                                                                                                                                                                                  |
+| `active`      | boolean    | Whether deliveries are enabled (default: true)                                                                                                                                                                                                                                                                                                              |
+| `config`      | JSON text  | Type-specific configuration                                                                                                                                                                                                                                                                                                                                 |
+| `max_retries` | integer    | Total delivery attempts for `http` and `slack` targets, not retries on top of the first: 0 is a single fire-and-forget attempt with no retries and no circuit breaker, and a value of N makes N attempts in all, with exponential backoff and a per-target circuit breaker. Ignored by `database` and `log` targets. The web UI labels it Delivery attempts |

 **Relations:** Belongs to Webhook. Has many Deliveries.

 **Target types:**

- **`http`** — Forward the event as an HTTP POST to a configured URL. With
-  `max_attempts` at 1 the target makes a single attempt; above 1 it retries a
-  failed delivery with exponential backoff, up to that many attempts in all,
-  behind a per-target circuit breaker.
+- **`http`** — Forward the event as an HTTP POST to a configured URL.
+  `max_retries` is the total number of delivery attempts, not retries on top of
+  the first: when `max_retries` is 0 (the default), the target operates in
+  fire-and-forget mode, a single attempt with no retries and no circuit breaker;
+  a value of N makes up to N attempts in all, retrying failed deliveries with
+  exponential backoff and protecting them with a per-target circuit breaker.
 - **`slack`** — Post the event as a formatted message to a Slack-compatible
  incoming webhook URL (`webhookUrl` in `config`). It is built on the same HTTP
-  core as `http` and honours `max_attempts` identically, circuit breaker
+  core as `http` and honours `max_retries` identically, circuit breaker
  included. See the Slack target section under "Per-Webhook Event Databases" for
  the message format.
 - **`database`** — Archive the full event as a row into the target's own archive
@@ -2163,11 +2167,11 @@ External Service
                              ▼                ▼                    ▼
                       ┌────────────┐   ┌────────────┐      ┌────────────┐
                       │ HTTP Target│   │ HTTP Target│      │ Log Target │
-                       │max_attempts│   │max_attempts│      │ (stdout)   │
-                       │   == 1,    │   │   > 1,     │      └────────────┘
-                       │ one attempt│   │ backoff +  │
+                       │(max_retries│   │(max_retries│      │ (stdout)   │
+                       │   == 0)    │   │   > 0,     │      └────────────┘
+                       │ fire+forget│   │ backoff +  │
                       └────────────┘   │ circuit    │
-                                        │ breaker    │
+                                        │ breaker)   │
                                        └────────────┘
 ```

@@ -2244,7 +2248,7 @@ re-inject it to every currently active target.

 ### Circuit Breaker (HTTP and Slack Targets with Retries)

-`http` and `slack` targets with `max_attempts` > 1 are protected by a
+`http` and `slack` targets with `max_retries` > 0 are protected by a
 **per-target circuit breaker** that prevents hammering a down target with
 repeated failed delivery attempts. The circuit breaker is in-memory only and
 resets on restart (which is fine — startup recovery rescans the database
@@ -2285,10 +2289,10 @@ anyway).
 - **Cooldown:** 30 seconds in open state before probing

 **Scope:** Circuit breakers apply to **`http` and `slack` targets with
-`max_attempts` > 1**. The Slack target is built on the same HTTP core and hands
-its own `max_attempts` to the same retry path, so it gets a breaker with the
-same 5-failure / 30-second defaults. Single-attempt targets of either type
-(`max_attempts` == 1), database targets (local operations), and log targets
+`max_retries` > 0**. The Slack target is built on the same HTTP core and hands
+its own `max_retries` to the same retry path, so it gets a breaker with the same
+5-failure / 30-second defaults. Fire-and-forget targets of either type
+(`max_retries` == 0), database targets (local operations), and log targets
 (stdout) do not use circuit breakers.

 When a circuit is open and a new delivery arrives, the engine marks the delivery
@@ -29,11 +29,9 @@ type Target struct {
 	// handler that marshals the model itself.
 	Config string `gorm:"type:text" json:"-"` // JSON configuration

-	// MaxAttempts is how many times an HTTP or Slack target attempts
-	// each delivery in all, at least 1. 1 is a single attempt with no
-	// circuit breaker; above 1, a failed attempt is retried with
-	// backoff behind the breaker.
-	MaxAttempts int `json:"maxAttempts,omitempty"`
+	// For HTTP targets (max_retries=0 means fire-and-forget,
+	// >0 enables retries with backoff)
+	MaxRetries int `json:"maxRetries,omitempty"`

 	// Relations. No model marshals the record it belongs to:
 	// Webhook.Targets leads back here, and the JSON could loop.
@@ -87,13 +87,13 @@ func TestMainSchemaHoldsEveryModel(t *testing.T) {
 		Active:      true,
 	})
 	assertRoundTrip(t, db, &database.Target{
-		BaseModel:   newBaseModel(),
-		WebhookID:   uuid.New().String(),
-		Name:        "target",
-		Type:        database.TargetTypeHTTP,
-		Active:      true,
-		Config:      `{"url":"https://example.com/"}`,
-		MaxAttempts: 3,
+		BaseModel:  newBaseModel(),
+		WebhookID:  uuid.New().String(),
+		Name:       "target",
+		Type:       database.TargetTypeHTTP,
+		Active:     true,
+		Config:     `{"url":"https://example.com/"}`,
+		MaxRetries: 3,
 	})
 }

@@ -80,7 +80,7 @@ CREATE TABLE targets (
    type text NOT NULL,
    active numeric DEFAULT true,
    config text,
-    max_attempts integer,
+    max_retries integer,
    PRIMARY KEY (id),
    CONSTRAINT fk_webhooks_targets
        FOREIGN KEY (webhook_id) REFERENCES webhooks (id)
@@ -107,7 +107,7 @@ type Task struct {
 	TargetName   string
 	TargetType   database.TargetType
 	TargetConfig string
-	MaxAttempts  int
+	MaxRetries   int

 	Method      string
 	RawQuery    string
@@ -1769,10 +1769,10 @@ func buildEventFromTask(task *Task) database.Event {

 func buildTargetFromTask(task *Task) database.Target {
 	target := database.Target{
-		Name:        task.TargetName,
-		Type:        task.TargetType,
-		Config:      task.TargetConfig,
-		MaxAttempts: task.MaxAttempts,
+		Name:       task.TargetName,
+		Type:       task.TargetType,
+		Config:     task.TargetConfig,
+		MaxRetries: task.MaxRetries,
 	}

 	target.ID = task.TargetID
@@ -2028,7 +2028,7 @@ func (e *Engine) countAttemptsBatch(
 	// One delivery id per recorded attempt, tallied here rather than
 	// grouped in SQL: internal/gormlog forbids (*gorm.DB).Scan, which
 	// a GROUP BY into a struct would need, and an attempt row per
-	// delivery is bounded by the target's MaxAttempts.
+	// delivery is bounded by the target's MaxRetries.
 	var attemptIDs []string

 	err := webhookDB.
@@ -2106,7 +2106,7 @@ func buildRecoveryTask(
 		TargetName:   target.Name,
 		TargetType:   target.Type,
 		TargetConfig: target.Config,
-		MaxAttempts:  target.MaxAttempts,
+		MaxRetries:   target.MaxRetries,
 		Method:       event.Method,
 		RawQuery:     event.RawQuery,
 		Headers:      event.Headers,
@@ -170,7 +170,7 @@ func iTask(
 	d database.Delivery,
 	event database.Event,
 	webhookID, targetID, name, config string,
-	maxAttempts, attemptNum int,
+	maxRetries, attemptNum int,
 	body *string,
 ) delivery.Task {
 	return delivery.Task{
@@ -181,7 +181,7 @@ func iTask(
 		TargetName:   name,
 		TargetType:   database.TargetTypeHTTP,
 		TargetConfig: config,
-		MaxAttempts:  maxAttempts,
+		MaxRetries:   maxRetries,
 		Method:       event.Method,
 		Headers:      event.Headers,
 		ContentType:  event.ContentType,
@@ -242,7 +242,7 @@ func TestProcessNewTask_InlineBody(t *testing.T) {
 	cfg := iHTTPConfig(ts.URL)
 	task := iTask(
 		d, event, s.WebhookID, targetID,
-		"test-target", cfg, 1, 1, &bodyStr,
+		"test-target", cfg, 0, 1, &bodyStr,
 	)

 	s.Engine.ExportProcessNewTask(
@@ -293,7 +293,7 @@ func TestProcessNewTask_LargeBody_FetchFromDB(
 	cfg := iHTTPConfig(ts.URL)
 	task := iTask(
 		d, event, s.WebhookID, targetID,
-		"test-large", cfg, 1, 1, nil,
+		"test-large", cfg, 0, 1, nil,
 	)

 	s.Engine.ExportProcessNewTask(
@@ -320,7 +320,7 @@ func TestProcessNewTask_InvalidWebhookID(t *testing.T) {
 		TargetName:   "test",
 		TargetType:   database.TargetTypeHTTP,
 		TargetConfig: iHTTPConfig("http://localhost:9999"),
-		MaxAttempts:  1,
+		MaxRetries:   0,
 		Body:         nil,
 		AttemptNum:   1,
 	}
@@ -645,7 +645,7 @@ func TestRecoverPendingDeliveries(t *testing.T) {

 	iCreateTarget(t, s.MainDB, targetID,
 		s.WebhookID, "recovery-target",
-		database.TargetTypeLog, "", 1,
+		database.TargetTypeLog, "", 0,
 	)

 	iSeedPendingDeliveries(
@@ -686,17 +686,17 @@ func iCreateTarget(
 	targetID, webhookID, name string,
 	targetType database.TargetType,
 	config string,
-	maxAttempts int,
+	maxRetries int,
 ) {
 	t.Helper()

 	target := database.Target{
-		WebhookID:   webhookID,
-		Name:        name,
-		Type:        targetType,
-		Active:      true,
-		Config:      config,
-		MaxAttempts: maxAttempts,
+		WebhookID:  webhookID,
+		Name:       name,
+		Type:       targetType,
+		Active:     true,
+		Config:     config,
+		MaxRetries: maxRetries,
 	}
 	target.ID = targetID

@@ -1077,7 +1077,7 @@ func TestRecoverInFlight_WithPendingDeliveries(

 	iCreateTarget(t, s.MainDB, targetID,
 		s.WebhookID, "recover-target",
-		database.TargetTypeLog, "", 1,
+		database.TargetTypeLog, "", 0,
 	)

 	event := iSeedEvent(
@@ -1232,7 +1232,7 @@ func TestDeliverHTTP_CustomTargetHeaders(t *testing.T) {
 	task := iTask(
 		d, event, s.WebhookID, targetID,
 		"auth-target", string(cfgJSON),
-		1, 1, &bodyStr,
+		0, 1, &bodyStr,
 	)

 	s.Engine.ExportProcessNewTask(
@@ -1277,7 +1277,7 @@ func TestDeliverHTTP_TargetTimeout(t *testing.T) {

 	task, d := iHTTPTaskAndDelivery(
 		event, del, "timeout-target",
-		string(cfgJSON), 1, 1,
+		string(cfgJSON), 0, 1,
 	)

 	e.ExportDeliverHTTP(context.TODO(), db, d, task)
@@ -1339,7 +1339,7 @@ func TestDeliverHTTP_CutsStoredResponseAtMaxBodyLog(
 	bodyStr := event.Body
 	task := iTask(
 		del, event, s.WebhookID, targetID,
-		"cut-target", cfgJSON, 1, 1, &bodyStr,
+		"cut-target", cfgJSON, 0, 1, &bodyStr,
 	)

 	s.Engine.ExportProcessNewTask(context.TODO(), &task)
@@ -1403,7 +1403,7 @@ func iHTTPTaskAndDelivery(
 	event database.Event,
 	del database.Delivery,
 	name, config string,
-	maxAttempts, attemptNum int,
+	maxRetries, attemptNum int,
 ) (*delivery.Task, *database.Delivery) {
 	task := &delivery.Task{
 		DeliveryID:   del.ID,
@@ -1413,7 +1413,7 @@ func iHTTPTaskAndDelivery(
 		TargetName:   name,
 		TargetType:   database.TargetTypeHTTP,
 		TargetConfig: config,
-		MaxAttempts:  maxAttempts,
+		MaxRetries:   maxRetries,
 		AttemptNum:   attemptNum,
 	}

@@ -1466,7 +1466,7 @@ func TestDeliverHTTP_InvalidConfig(t *testing.T) {
 	)

 	task, d := iHTTPTaskAndDelivery(
-		event, del, "bad-config", `not-json`, 1, 1,
+		event, del, "bad-config", `not-json`, 0, 1,
 	)

 	e.ExportDeliverHTTP(context.TODO(), db, d, task)
@@ -1490,7 +1490,7 @@ func TestDeliverHTTP_InvalidConfigUnrecordedStaysPending(t *testing.T) {
 	)

 	task, d := iHTTPTaskAndDelivery(
-		event, del, "bad-config", `not-json`, 1, 1,
+		event, del, "bad-config", `not-json`, 0, 1,
 	)

 	require.NoError(t, db.Exec("drop table delivery_results").Error)
@@ -278,7 +278,7 @@ func TestEngine_StopHookHonoursStopTimeout(t *testing.T) {
 }

 // seedHeldDelivery gives the setup's webhook an http target with
-// maxAttempts, pointed at a receiver that keeps every request open until
+// maxRetries, pointed at a receiver that keeps every request open until
 // the client gives up on it, and seeds one delivery to that target at
 // status. It returns the task that sends attempt attemptNum of the
 // delivery, and a channel that is closed when a request reaches the
@@ -286,7 +286,7 @@ func TestEngine_StopHookHonoursStopTimeout(t *testing.T) {
 func seedHeldDelivery(
 	t *testing.T,
 	s iSetup,
-	maxAttempts int,
+	maxRetries int,
 	status database.DeliveryStatus,
 	attemptNum int,
 ) (delivery.Task, <-chan struct{}) {
@@ -315,7 +315,7 @@ func seedHeldDelivery(
 	iCreateWebhook(t, s.MainDB, s.WebhookID, "hook")
 	iCreateTarget(
 		t, s.MainDB, targetID, s.WebhookID, "held",
-		database.TargetTypeHTTP, cfg, maxAttempts,
+		database.TargetTypeHTTP, cfg, maxRetries,
 	)

 	event := iSeedEvent(t, s.WebhookDB, s.WebhookID, `{"held":true}`)
@@ -325,7 +325,7 @@ func seedHeldDelivery(

 	return iTask(
 		d, event, s.WebhookID, targetID, "held", cfg,
-		maxAttempts, attemptNum, &bodyStr,
+		maxRetries, attemptNum, &bodyStr,
 	), arrived
 }

@@ -380,7 +380,7 @@ func TestEngine_StopLeavesFireAndForgetAttemptPending(t *testing.T) {
 	lc := startEngineViaHook(t, s.Engine)

 	task, arrived := seedHeldDelivery(
-		t, s, 1, database.DeliveryStatusPending, 1,
+		t, s, 0, database.DeliveryStatusPending, 1,
 	)

 	s.Engine.Notify([]delivery.Task{task})
@@ -404,13 +404,13 @@ func TestEngine_StopLeavesFireAndForgetAttemptPending(t *testing.T) {
 func TestEngine_StopLeavesLastRetryAttemptRetrying(t *testing.T) {
 	t.Parallel()

-	const maxAttempts = 2
+	const maxRetries = 2

 	s := newISetup(t)
 	lc := startEngineViaHook(t, s.Engine)

 	task, arrived := seedHeldDelivery(
-		t, s, maxAttempts, database.DeliveryStatusRetrying, maxAttempts,
+		t, s, maxRetries, database.DeliveryStatusRetrying, maxRetries,
 	)
 	iSeedFailedResult(t, s.WebhookDB, task.DeliveryID)

@@ -142,7 +142,7 @@ func buildHTTPFixture(
 	dlv database.Delivery,
 	event database.Event,
 	targetID, name, config string,
-	maxAttempts, attemptNum int,
+	maxRetries, attemptNum int,
 ) httpDeliveryFixture {
 	task := &delivery.Task{
 		DeliveryID:   dlv.ID,
@@ -152,7 +152,7 @@ func buildHTTPFixture(
 		TargetName:   name,
 		TargetType:   database.TargetTypeHTTP,
 		TargetConfig: config,
-		MaxAttempts:  maxAttempts,
+		MaxRetries:   maxRetries,
 		AttemptNum:   attemptNum,
 	}

@@ -162,10 +162,10 @@ func buildHTTPFixture(
 		Status:   dlv.Status,
 		Event:    event,
 		Target: database.Target{
-			Name:        name,
-			Type:        database.TargetTypeHTTP,
-			Config:      config,
-			MaxAttempts: maxAttempts,
+			Name:       name,
+			Type:       database.TargetTypeHTTP,
+			Config:     config,
+			MaxRetries: maxRetries,
 		},
 	}
 	d.ID = dlv.ID
@@ -277,7 +277,7 @@ func TestDeliverHTTP_Success(t *testing.T) {

 	cfg := newHTTPTargetConfig(ts.URL)
 	fix := buildHTTPFixture(
-		dlv, event, targetID, "test-http", cfg, 1, 1,
+		dlv, event, targetID, "test-http", cfg, 0, 1,
 	)

 	e.ExportDeliverHTTP(
@@ -324,7 +324,7 @@ func TestDeliverHTTP_Failure(t *testing.T) {
 	cfg := newHTTPTargetConfig(ts.URL)
 	fix := buildHTTPFixture(
 		dlv, event, targetID,
-		"test-http-fail", cfg, 1, 1,
+		"test-http-fail", cfg, 0, 1,
 	)

 	e.ExportDeliverHTTP(
@@ -473,23 +473,14 @@ func TestDeliverHTTP_WithRetries_Success(t *testing.T) {
 	)
 }

-// TestDeliverHTTP_MaxAttemptsExhausted proves a target with three
-// delivery attempts makes at most three: the first two failures are
-// retried, the third is final, and each attempt goes through the
-// target's circuit breaker.
-func TestDeliverHTTP_MaxAttemptsExhausted(t *testing.T) {
+func TestDeliverHTTP_MaxRetriesExhausted(t *testing.T) {
 	t.Parallel()

-	const maxAttempts = 3
-
 	db := testWebhookDB(t)

-	var requests atomic.Int32
-
 	ts := httptest.NewServer(
 		http.HandlerFunc(
 			func(w http.ResponseWriter, _ *http.Request) {
-				requests.Add(1)
 				w.WriteHeader(http.StatusBadGateway)
 			},
 		),
@@ -498,103 +489,26 @@ func TestDeliverHTTP_MaxAttemptsExhausted(t *testing.T) {

 	e := testEngine(t, 1)
 	targetID := uuid.New().String()
-
-	// It opens on the last failure only if every attempt reached it.
-	cb := delivery.NewTestCircuitBreaker(maxAttempts, time.Minute)
-	e.ExportSetCircuitBreaker(targetID, cb)
-
 	event := seedEvent(t, db, `{"retry":"exhaust"}`)

 	dlv := seedDelivery(
 		t, db, event.ID, targetID,
-		database.DeliveryStatusPending,
-	)
-
-	cfg := newHTTPTargetConfig(ts.URL)
-	sched := &recordingScheduler{}
-
-	for attempt := 1; attempt <= maxAttempts; attempt++ {
-		fix := buildHTTPFixture(
-			dlv, event, targetID,
-			"test-http-exhaust", cfg, maxAttempts, attempt,
-		)
-
-		e.ExportDeliverHTTPWithScheduler(
-			context.TODO(), db, fix.Delivery, fix.Task, sched,
-		)
-	}
-
-	assert.Equal(t, int32(maxAttempts), requests.Load())
-	assert.Len(t, sched.delays, maxAttempts-1,
-		"every failure but the last should be retried",
-	)
-	assertDeliveryStatus(t, db, dlv.ID,
-		database.DeliveryStatusFailed,
-	)
-	assert.Equal(t, delivery.CircuitOpen, cb.State(),
-		"every attempt should be counted by the circuit breaker",
-	)
-}
-
-// TestDeliverHTTP_SingleAttemptSkipsCircuitBreaker proves a target
-// with one delivery attempt makes exactly that attempt, even while
-// its circuit breaker is open, and that a failure is final.
-func TestDeliverHTTP_SingleAttemptSkipsCircuitBreaker(t *testing.T) {
-	t.Parallel()
-
-	db := testWebhookDB(t)
-
-	var requests atomic.Int32
-
-	ts := httptest.NewServer(
-		http.HandlerFunc(
-			func(w http.ResponseWriter, _ *http.Request) {
-				requests.Add(1)
-				w.WriteHeader(http.StatusBadGateway)
-			},
-		),
-	)
-	defer ts.Close()
-
-	e := testEngine(t, 1)
-	targetID := uuid.New().String()
-
-	cb := e.ExportGetCircuitBreaker(targetID)
-
-	for range delivery.ExportDefaultFailureThreshold {
-		cb.RecordFailure()
-	}
-
-	require.Equal(t, delivery.CircuitOpen, cb.State())
-
-	event := seedEvent(t, db, `{"retry":"none"}`)
-
-	dlv := seedDelivery(
-		t, db, event.ID, targetID,
-		database.DeliveryStatusPending,
+		database.DeliveryStatusRetrying,
 	)

 	cfg := newHTTPTargetConfig(ts.URL)
 	fix := buildHTTPFixture(
 		dlv, event, targetID,
-		"test-http-single", cfg, 1, 1,
-	)
-	sched := &recordingScheduler{}
-
-	e.ExportDeliverHTTPWithScheduler(
-		context.TODO(), db, fix.Delivery, fix.Task, sched,
+		"test-http-exhaust", cfg, 3, 3,
 	)

-	assert.Equal(t, int32(1), requests.Load(),
-		"the open circuit breaker should not hold the attempt back",
+	e.ExportDeliverHTTP(
+		context.TODO(), db, fix.Delivery, fix.Task,
 	)
-	assert.Empty(t, sched.delays, "no retry should be scheduled")
+
 	assertDeliveryStatus(t, db, dlv.ID,
 		database.DeliveryStatusFailed,
 	)
-	assertDeliveryResult(
-		t, db, dlv.ID, false, http.StatusBadGateway,
-	)
 }

 func TestDeliverHTTP_SchedulesRetryOnFailure(
@@ -827,7 +741,7 @@ func seedConcurrencyTasks(
 			TargetName:   tasks[i].Target.Name,
 			TargetType:   tasks[i].Target.Type,
 			TargetConfig: tasks[i].Target.Config,
-			MaxAttempts:  1,
+			MaxRetries:   0,
 			AttemptNum:   1,
 		}
 	}
@@ -2137,10 +2051,10 @@ func buildSlackRetryDelivery(
 		Status:   database.DeliveryStatusPending,
 		Event:    event,
 		Target: database.Target{
-			Name:        "test-slack-retry",
-			Type:        database.TargetTypeSlack,
-			Config:      cfg,
-			MaxAttempts: 5,
+			Name:       "test-slack-retry",
+			Type:       database.TargetTypeSlack,
+			Config:     cfg,
+			MaxRetries: 5,
 		},
 	}
 	d.ID = dlv.ID
@@ -2175,11 +2089,11 @@ func TestDeliverSlack_WithRetries_SchedulesRetry(
 	)

 	task := &delivery.Task{
-		DeliveryID:  dlv.ID,
-		TargetID:    targetID,
-		TargetType:  database.TargetTypeSlack,
-		MaxAttempts: 5,
-		AttemptNum:  1,
+		DeliveryID: dlv.ID,
+		TargetID:   targetID,
+		TargetType: database.TargetTypeSlack,
+		MaxRetries: 5,
+		AttemptNum: 1,
 	}

 	e.ExportProcessDelivery(context.TODO(), db, d, task)
@@ -152,7 +152,7 @@ func TestEventDBHoldsNoTargetRowsOnFailedDelivery(t *testing.T) {
 	)
 	task := iTask(
 		d, event, s.WebhookID, targetID,
-		"leaky-target", cfg, 1, 1, &body,
+		"leaky-target", cfg, 0, 1, &body,
 	)

 	s.Engine.ExportProcessNewTask(context.TODO(), &task)
@@ -176,7 +176,7 @@ func tsTask(
 		TargetName:   target.Name,
 		TargetType:   database.TargetTypeSlack,
 		TargetConfig: target.Config,
-		MaxAttempts:  1,
+		MaxRetries:   0,
 		Method:       event.Method,
 		Headers:      event.Headers,
 		ContentType:  event.ContentType,
@@ -229,7 +229,7 @@ func TestOwnershipIsReleasedAfterDelivery(t *testing.T) {

 	iCreateTarget(t, s.MainDB, targetID,
 		s.WebhookID, "released",
-		database.TargetTypeLog, "", 1,
+		database.TargetTypeLog, "", 0,
 	)

 	event := iSeedEvent(
@@ -291,20 +291,20 @@ func TestDeliveryMetrics_CircuitBreakerGauge(t *testing.T) {
 	body := event.Body
 	cfg := iHTTPConfig(ts.URL)

-	// An attempt budget above the failure threshold, so the breaker
+	// A retry budget above the failure threshold, so the breaker
 	// rather than the budget is what stops the delivery.
-	maxAttempts := delivery.ExportDefaultFailureThreshold + 5
+	maxRetries := delivery.ExportDefaultFailureThreshold + 5

 	// The retries below are only run if their target still exists;
 	// see https://git.eeqj.de/sneak/webhooker/issues/107.
 	iCreateTarget(
 		t, s.MainDB, targetID, s.WebhookID, "metrics-trip",
-		database.TargetTypeHTTP, cfg, maxAttempts,
+		database.TargetTypeHTTP, cfg, maxRetries,
 	)

 	first := iTask(
 		d, event, s.WebhookID, targetID,
-		"metrics-trip", cfg, maxAttempts, 1, &body,
+		"metrics-trip", cfg, maxRetries, 1, &body,
 	)

 	s.Engine.ExportProcessNewTask(context.TODO(), &first)
@@ -316,7 +316,7 @@ func TestDeliveryMetrics_CircuitBreakerGauge(t *testing.T) {
 		ExportDefaultFailureThreshold; attempt++ {
 		task := iTask(
 			d, event, s.WebhookID, targetID,
-			"metrics-trip", cfg, maxAttempts, attempt, &body,
+			"metrics-trip", cfg, maxRetries, attempt, &body,
 		)

 		s.Engine.ExportProcessRetryTask(
@@ -364,16 +364,16 @@ func TestDeliveryMetrics_BreakerBlockedIsNotAnAttempt(

 	body := event.Body
 	cfg := iHTTPConfig(ts.URL)
-	maxAttempts := delivery.ExportDefaultFailureThreshold + 5
+	maxRetries := delivery.ExportDefaultFailureThreshold + 5

 	iCreateTarget(
 		t, s.MainDB, targetID, s.WebhookID, "metrics-blocked",
-		database.TargetTypeHTTP, cfg, maxAttempts,
+		database.TargetTypeHTTP, cfg, maxRetries,
 	)

 	first := iTask(
 		d, event, s.WebhookID, targetID,
-		"metrics-blocked", cfg, maxAttempts, 1, &body,
+		"metrics-blocked", cfg, maxRetries, 1, &body,
 	)

 	s.Engine.ExportProcessNewTask(context.TODO(), &first)
@@ -382,7 +382,7 @@ func TestDeliveryMetrics_BreakerBlockedIsNotAnAttempt(
 		ExportDefaultFailureThreshold; attempt++ {
 		task := iTask(
 			d, event, s.WebhookID, targetID,
-			"metrics-blocked", cfg, maxAttempts, attempt, &body,
+			"metrics-blocked", cfg, maxRetries, attempt, &body,
 		)

 		s.Engine.ExportProcessRetryTask(context.TODO(), &task)
@@ -405,7 +405,7 @@ func TestDeliveryMetrics_BreakerBlockedIsNotAnAttempt(

 	blocked := iTask(
 		d, event, s.WebhookID, targetID,
-		"metrics-blocked", cfg, maxAttempts,
+		"metrics-blocked", cfg, maxRetries,
 		delivery.ExportDefaultFailureThreshold+1, &body,
 	)

@@ -66,7 +66,7 @@ func TestRecoverySkipsPendingWithSuccessfulResult(

 	iCreateTarget(t, s.MainDB, targetID,
 		s.WebhookID, "already-delivered",
-		database.TargetTypeLog, "", 1,
+		database.TargetTypeLog, "", 0,
 	)

 	event := iSeedEvent(
@@ -129,7 +129,7 @@ func TestRecoveryContinuesTheAttemptNumbering(t *testing.T) {

 	iCreateTarget(t, s.MainDB, targetID,
 		s.WebhookID, "numbering",
-		database.TargetTypeLog, "", 1,
+		database.TargetTypeLog, "", 0,
 	)

 	event := iSeedEvent(
@@ -444,10 +444,10 @@ func TestFailedResultWriteWithRetriesLeavesDeliveryRecoverable(
 				Status:   database.DeliveryStatusPending,
 				Event:    event,
 				Target: database.Target{
-					Name:        "unwritable",
-					Type:        database.TargetTypeHTTP,
-					Config:      iHTTPConfig(ts.URL),
-					MaxAttempts: 3,
+					Name:       "unwritable",
+					Type:       database.TargetTypeHTTP,
+					Config:     iHTTPConfig(ts.URL),
+					MaxRetries: 3,
 				},
 			}
 			full.ID = d.ID
@@ -120,8 +120,8 @@ func unavailableConfigFields() []ConfigField {
 }

 // slackConfigFields describes a Slack target: its masked
-// webhook URL and its number of delivery attempts. Only the
-// masked URL is shown; the full URL is the credential.
+// webhook URL and its retry count. Only the masked URL is
+// shown; the full URL is the credential.
 func slackConfigFields(t *database.Target) []ConfigField {
 	cfg, err := parseSlackConfig(t.Config)
 	if err != nil {
@@ -131,7 +131,7 @@ func slackConfigFields(t *database.Target) []ConfigField {
 	return []ConfigField{{
 		Label: "Webhook URL",
 		Value: cfg.MaskedWebhookURL(),
-	}, maxAttemptsField(t)}
+	}, maxRetriesField(t)}
 }

 // httpConfigFields describes an HTTP target: its destination
@@ -178,18 +178,23 @@ func httpConfigFields(t *database.Target) []ConfigField {
 		})
 	}

-	fields = append(fields, maxAttemptsField(t))
+	fields = append(fields, maxRetriesField(t))

 	return fields
 }

-// maxAttemptsField describes a target's number of delivery
-// attempts, which lives on the target row rather than in its
-// configuration blob.
-func maxAttemptsField(t *database.Target) ConfigField {
+// maxRetriesField describes a target's retry count, which lives
+// on the target row rather than in its configuration blob. A
+// stored 0 makes a single attempt, so it is shown as 1.
+func maxRetriesField(t *database.Target) ConfigField {
+	attempts := strconv.Itoa(t.MaxRetries)
+	if t.MaxRetries == 0 {
+		attempts = "1 (fire-and-forget: no retries, no circuit breaker)"
+	}
+
 	return ConfigField{
 		Label: "Delivery attempts",
-		Value: strconv.Itoa(t.MaxAttempts),
+		Value: attempts,
 	}
 }

@@ -32,7 +32,7 @@ const (
 	viewMaskedOrigin  = viewExampleOrigin + "/..."
 	viewUnavailable   = "(unavailable)"
 	viewExpiryNever   = "never"
-	viewMaxAttempts   = "Delivery attempts"
+	viewMaxRetries    = "Delivery attempts"
 )

 func TestMaskedWebhookURL(t *testing.T) {
@@ -171,7 +171,6 @@ func slackTarget() database.Target {
 		Active: true,
 		Config: `{"webhookUrl":"` +
 			slackWebhookURL + `"}`,
-		MaxAttempts: 1,
 	}
 }

@@ -190,29 +189,28 @@ func TestNewTargetViews_Slack(t *testing.T) {
 	assert.Equal(
 		t,
 		map[string]string{
-			"Webhook URL":   slackMaskedURL,
-			viewMaxAttempts: "1",
+			"Webhook URL":  slackMaskedURL,
+			viewMaxRetries: "1 (fire-and-forget: no retries, no circuit breaker)",
 		},
 		fieldMap(view.Config),
 	)
 }

-// TestNewTargetViews_SlackAttempts proves a Slack target shows
-// its number of delivery attempts the same way an HTTP target
-// does.
-func TestNewTargetViews_SlackAttempts(t *testing.T) {
+// TestNewTargetViews_SlackRetries proves a Slack target shows
+// its retry count the same way an HTTP target does.
+func TestNewTargetViews_SlackRetries(t *testing.T) {
 	t.Parallel()

 	target := slackTarget()
-	target.MaxAttempts = 2
+	target.MaxRetries = 2

 	view := viewFor(t, target)

 	assert.Equal(
 		t,
 		map[string]string{
-			"Webhook URL":   slackMaskedURL,
-			viewMaxAttempts: "2",
+			"Webhook URL":  slackMaskedURL,
+			viewMaxRetries: "2",
 		},
 		fieldMap(view.Config),
 	)
@@ -227,7 +225,7 @@ func TestNewTargetViews_HTTP(t *testing.T) {
 			`"timeout":30,` +
 			`"headers":{"Authorization":"Bearer sekrit"},` +
 			`"forwardQuery":true}`,
-		MaxAttempts: 5,
+		MaxRetries: 5,
 	})

 	fields := fieldMap(view.Config)
@@ -239,7 +237,7 @@ func TestNewTargetViews_HTTP(t *testing.T) {
 			"Timeout":         "30s",
 			"Headers":         "1 configured",
 			"Query string":    "passed on to this target",
-			viewMaxAttempts:   "5",
+			viewMaxRetries:    "5",
 		},
 		fields,
 	)
@@ -250,22 +248,19 @@ func TestNewTargetViews_HTTP(t *testing.T) {
 	}
 }

-// TestNewTargetViews_HTTPSingleAttempt proves a single attempt is
-// shown as the plain number, like any other.
-func TestNewTargetViews_HTTPSingleAttempt(t *testing.T) {
+func TestNewTargetViews_HTTPFireAndForget(t *testing.T) {
 	t.Parallel()

 	view := viewFor(t, database.Target{
-		Type:        database.TargetTypeHTTP,
-		Config:      `{"url":"` + viewExampleHook + `"}`,
-		MaxAttempts: 1,
+		Type:   database.TargetTypeHTTP,
+		Config: `{"url":"` + viewExampleHook + `"}`,
 	})

 	assert.Equal(
 		t,
 		map[string]string{
 			"Destination URL": viewMaskedOrigin,
-			viewMaxAttempts:   "1",
+			viewMaxRetries:    "1 (fire-and-forget: no retries, no circuit breaker)",
 		},
 		fieldMap(view.Config),
 	)
@@ -53,10 +53,10 @@ type httpCore struct {
 }

 // deliver runs one delivery attempt through the retry core.
-// A maxAttempts of 1 is a single attempt, recorded without
-// consulting a circuit breaker. A higher maxAttempts gates the
-// attempt on the circuit breaker and schedules a backed-off retry
-// on failure, until maxAttempts attempts have been made.
+// A maxRetries of 0 is fire-and-forget: a single attempt is
+// recorded and no circuit breaker is consulted. A positive
+// maxRetries gates the attempt on the circuit breaker and
+// schedules a backed-off retry on failure.
 //
 // ctx is the context attempt sends its request with. Stopping the
 // engine cancels it; see interruptedByStop.
@@ -66,17 +66,17 @@ func (c *httpCore) deliver(
 	d *database.Delivery,
 	task *Task,
 	sched Scheduler,
-	maxAttempts int,
+	maxRetries int,
 	attempt func() attemptResult,
 ) {
-	if maxAttempts <= 1 {
+	if maxRetries == 0 {
 		c.fireAndForget(ctx, webhookDB, d, attempt())

 		return
 	}

 	c.withRetry(
-		ctx, webhookDB, d, task, sched, maxAttempts, attempt,
+		ctx, webhookDB, d, task, sched, maxRetries, attempt,
 	)
 }

@@ -153,7 +153,7 @@ func (c *httpCore) withRetry(
 	d *database.Delivery,
 	task *Task,
 	sched Scheduler,
-	maxAttempts int,
+	maxRetries int,
 	attempt func() attemptResult,
 ) {
 	cb := c.getCircuitBreaker(task.TargetID)
@@ -205,7 +205,7 @@ func (c *httpCore) withRetry(
 	cb.RecordFailure()

 	c.handleRetry(
-		webhookDB, d, task, sched, maxAttempts, attemptNum,
+		webhookDB, d, task, sched, maxRetries, attemptNum,
 	)
 }

@@ -266,10 +266,10 @@ func (c *httpCore) handleRetry(
 	d *database.Delivery,
 	task *Task,
 	sched Scheduler,
-	maxAttempts int,
+	maxRetries int,
 	attemptNum int,
 ) {
-	if attemptNum >= maxAttempts {
+	if attemptNum >= maxRetries {
 		c.eng.settleStatus(
 			webhookDB, d, d.Target.Type,
 			database.DeliveryStatusFailed,
@@ -439,7 +439,7 @@ func (t *httpTarget) Deliver(

 	t.deliver(
 		ctx, webhookDB, d, task, sched,
-		d.Target.MaxAttempts, attempt,
+		d.Target.MaxRetries, attempt,
 	)
 }

@@ -30,8 +30,9 @@ type SlackTargetConfig struct {
 // slackTarget delivers events to Slack incoming webhooks. It
 // formats the event into a Slack message and posts it as
 // JSON. It shares the retry core with the HTTP target: a
-// MaxAttempts of 1 is a single attempt, while a higher one
-// adds backoff and circuit breaking.
+// MaxRetries of 0 stays single-attempt fire-and-forget
+// (preserving existing Slack targets), while a positive
+// MaxRetries adds backoff and circuit breaking.
 type slackTarget struct {
 	*httpCore

@@ -82,7 +83,7 @@ func (t *slackTarget) Deliver(

 	t.deliver(
 		ctx, webhookDB, d, task, sched,
-		d.Target.MaxAttempts, attempt,
+		d.Target.MaxRetries, attempt,
 	)
 }

@@ -743,7 +743,7 @@ func TestSendRecoveredDeliveries_TargetMissingFromMap(

 	iCreateTarget(
 		t, s.MainDB, targetID, s.WebhookID, "found-on-lookup",
-		database.TargetTypeLog, "", 1,
+		database.TargetTypeLog, "", 0,
 	)

 	event := iSeedEvent(
@@ -790,7 +790,7 @@ func TestRecoverPending_TargetUnreadable_LeavesDeliveryAlone(

 	iCreateTarget(
 		t, s.MainDB, targetID, s.WebhookID, "healthy",
-		database.TargetTypeLog, "", 1,
+		database.TargetTypeLog, "", 0,
 	)

 	event := iSeedEvent(
@@ -308,7 +308,7 @@ func createReplayDelivery(
 		TargetName:   target.Name,
 		TargetType:   target.Type,
 		TargetConfig: target.Config,
-		MaxAttempts:  target.MaxAttempts,
+		MaxRetries:   target.MaxRetries,
 		Method:       event.Method,
 		RawQuery:     event.RawQuery,
 		Headers:      event.Headers,
@@ -496,7 +496,7 @@ const deliveryIDChunkSize = 500
 //
 // Each response body is cut by SQLite rather than in Go, for
 // the reason deliveryResultColumns gives. How many attempts a
-// delivery has is bounded by the target's MaxAttempts, which the
+// delivery has is the target's MaxRetries, which the
 // authenticated operator sets; how many of them reach the page
 // is bounded again by maxRenderedAttempts.
 func (h *Handlers) loadDeliveryResults(
@@ -37,10 +37,10 @@ const MaxRenderedResponseBytesForTest = maxRenderedResponseBytes
 // per-delivery attempt ceiling to the handlers_test package.
 const MaxRenderedAttemptsForTest = maxRenderedAttempts

-// MaxTargetAttemptsForTest exposes the target max_attempts ceiling to
+// MaxTargetRetriesForTest exposes the target max_retries ceiling to
 // the handlers_test package, so the tests assert against the constant
 // the handlers enforce rather than a number copied beside it.
-const MaxTargetAttemptsForTest = maxTargetAttempts
+const MaxTargetRetriesForTest = maxTargetRetries

 // EventDBLeftMsgForTest and SidecarLeftMsgForTest expose the two
 // messages the webhook delete handler logs when a file of the event
@@ -1,81 +0,0 @@
-package handlers
-
-import (
-	"errors"
-	"strconv"
-	"strings"
-)
-
-// maxTargetAttempts bounds a target's max_attempts.
-//
-// Both target forms already declare max="20" on the input, so this
-// enforces server-side what the UI has always advertised rather than
-// introducing a new limit.
-//
-// The number is not cosmetic. Every attempt writes a delivery_results
-// row that the event log then loads and renders, and the engine backs
-// off by 2^(n-1) seconds, so attempt 20 is already about six days
-// after the first. A value beyond this buys no additional durability
-// and only costs rows.
-const maxTargetAttempts = 20
-
-// Errors returned when a max_attempts form value cannot be turned into
-// a number of attempts.
-var (
-	// errAttemptsInvalid signals a max_attempts form value that is not
-	// a whole number of at least 1.
-	errAttemptsInvalid = errors.New(
-		"must be a whole number, at least 1",
-	)
-
-	// errAttemptsTooLarge signals a max_attempts form value that is a
-	// whole number but above maxTargetAttempts. It is distinguished
-	// from errAttemptsInvalid so the message can name the ceiling
-	// instead of implying the input was not a number.
-	errAttemptsTooLarge = errors.New("out of range")
-)
-
-// parseMaxAttempts interprets a max_attempts form value.
-//
-// An ABSENT value — the field empty or not submitted — yields
-// fallback, which lets the create path apply its default and the edit
-// path leave the stored value alone. A value that is SET BUT INVALID
-// is an error: unparseable, below 1, or above maxTargetAttempts.
-//
-// The distinction is the whole point of this function. Returning a
-// default for input the operator typed but that did not parse would
-// silently turn retries off on a store-and-forward proxy — and on the
-// edit path destroy a working configuration over a typo. A default
-// answers a question that was not asked; it never answers one that
-// was asked badly.
-func parseMaxAttempts(raw string, fallback int) (int, error) {
-	raw = strings.TrimSpace(raw)
-	if raw == "" {
-		return fallback, nil
-	}
-
-	v, err := strconv.Atoi(raw)
-	if err != nil || v < 1 {
-		return 0, errAttemptsInvalid
-	}
-
-	if v > maxTargetAttempts {
-		return 0, errAttemptsTooLarge
-	}
-
-	return v, nil
-}
-
-// attemptsErrorMessage returns the message the create and edit forms
-// show for a rejected max_attempts value. Any error other than
-// errAttemptsTooLarge falls back to the generic wording, so an
-// unrecognised parse failure still produces a sensible 400.
-func attemptsErrorMessage(err error) string {
-	if errors.Is(err, errAttemptsTooLarge) {
-		return errAttemptsTooLarge.Error() +
-			": at most " + strconv.Itoa(maxTargetAttempts) +
-			" attempts"
-	}
-
-	return errAttemptsInvalid.Error()
-}
@@ -1,429 +0,0 @@
-package handlers_test
-
-import (
-	"net/http"
-	"net/url"
-	"strconv"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"sneak.berlin/go/webhooker/internal/database"
-	"sneak.berlin/go/webhooker/internal/handlers"
-)
-
-// attemptsTargetURL is the destination the attempts-validation targets
-// point at. It is a literal public address rather than a hostname so
-// the SSRF check resolves nothing and a sandbox without DNS cannot
-// make these cases pass or fail for the wrong reason.
-const attemptsTargetURL = "https://93.184.216.34/hooks/attempts"
-
-const (
-	// wayAboveCeiling is the typo'd-extra-zero case from the report.
-	wayAboveCeiling = "999999999"
-
-	// notANumber is the plainest garbage an operator can type, and
-	// the value the report submitted on the edit form.
-	notANumber = "abc"
-
-	// workingAttempts is the number of attempts a seeded target is
-	// already delivering with, which a rejected submission must not
-	// disturb.
-	workingAttempts = 2
-)
-
-// aboveCeiling is the smallest rejected whole number.
-func aboveCeiling() string {
-	return strconv.Itoa(handlers.MaxTargetAttemptsForTest + 1)
-}
-
-// overCeilingAttempts is whole-number input past the limit, which is
-// rejected with the limit named.
-func overCeilingAttempts() []string {
-	return []string{aboveCeiling(), wayAboveCeiling}
-}
-
-// belowOneAttempts is whole-number input under the floor of one
-// attempt, which is rejected with the floor named.
-func belowOneAttempts() []string {
-	return []string{"0", "-5"}
-}
-
-// unparseableAttempts is input an operator can type into the field
-// that is not a number of attempts. Each must be REJECTED: silently
-// reading any of them as a default turns retries off on a
-// store-and-forward proxy without saying so.
-//
-// The twenty-digit case is here because it parses as digits but
-// overflows int, which is the one failure the field's own min/max
-// attributes cannot describe.
-func unparseableAttempts() []string {
-	return []string{
-		notANumber,
-		"2.7",
-		"12345678901234567890",
-		"1e3",
-	}
-}
-
-// createAttemptsForm is a complete, otherwise-valid HTTP target
-// creation, so the only thing any case below varies is max_attempts.
-func createAttemptsForm(attempts string) url.Values {
-	form := url.Values{}
-	form.Set("name", "attempts-target")
-	form.Set("type", string(database.TargetTypeHTTP))
-	form.Set("url", attemptsTargetURL)
-
-	if attempts != absentField {
-		form.Set("max_attempts", attempts)
-	}
-
-	return form
-}
-
-// absentField marks a field the form does not submit at all, which is
-// the case that legitimately takes a default and must stay distinct
-// from a field submitted with garbage in it.
-const absentField = "\x00absent"
-
-// absentAttempts is every way of saying "the operator did not set
-// this", each of which takes the default rather than a 400. Blank and
-// whitespace-only count as absent here because they do in the timeout
-// and retention controls on the same forms; a rule the fields do not
-// share would be its own surprise.
-func absentAttempts() []string {
-	return []string{absentField, "", "  "}
-}
-
-// createWithAttempts posts the target create form for a fresh webhook
-// and returns the webhook and the response.
-func createWithAttempts(
-	t *testing.T,
-	env *sourceTestEnv,
-	attempts string,
-) (database.Webhook, int, string) {
-	t.Helper()
-
-	webhook := seedWebhookWithRetention(t, env.db, 30)
-
-	w := serveTarget(
-		env, http.MethodPost,
-		"/hook/"+webhook.ID+"/targets",
-		createAttemptsForm(attempts),
-	)
-
-	return webhook, w.Code, w.Body.String()
-}
-
-// TestTargetCreate_AttemptsAboveCeilingRejected proves the create form
-// enforces a ceiling at all, and that the 400 names it — a rejection
-// that does not say what the limit is leaves the operator guessing.
-func TestTargetCreate_AttemptsAboveCeilingRejected(t *testing.T) {
-	t.Parallel()
-
-	env := setupSourceTest(t)
-	ceiling := strconv.Itoa(handlers.MaxTargetAttemptsForTest)
-
-	for _, attempts := range overCeilingAttempts() {
-		webhook, code, body := createWithAttempts(t, env, attempts)
-
-		assert.Equal(t, http.StatusBadRequest, code,
-			"max_attempts=%s should be rejected", attempts)
-		assert.Contains(t, body, ceiling,
-			"the rejection for %s should name the ceiling",
-			attempts)
-		assert.Empty(t,
-			targetsForWebhook(t, env.db, webhook.ID),
-			"no target should be created for %s", attempts)
-	}
-}
-
-// TestTargetCreate_AttemptsBelowOneRejected proves the create form
-// refuses 0 and less, naming the floor: every delivery is attempted
-// at least once.
-func TestTargetCreate_AttemptsBelowOneRejected(t *testing.T) {
-	t.Parallel()
-
-	env := setupSourceTest(t)
-
-	for _, attempts := range belowOneAttempts() {
-		webhook, code, body := createWithAttempts(t, env, attempts)
-
-		assert.Equal(t, http.StatusBadRequest, code,
-			"max_attempts=%s should be rejected", attempts)
-		assert.Contains(t, body, "at least 1",
-			"the rejection for %s should name the floor",
-			attempts)
-		assert.Empty(t,
-			targetsForWebhook(t, env.db, webhook.ID),
-			"no target should be created for %s", attempts)
-	}
-}
-
-// TestTargetCreate_UnparseableAttemptsRejected is the core of the
-// defect: each of these was accepted with HTTP 200 and stored as a
-// default.
-func TestTargetCreate_UnparseableAttemptsRejected(t *testing.T) {
-	t.Parallel()
-
-	env := setupSourceTest(t)
-
-	for _, attempts := range unparseableAttempts() {
-		webhook, code, body := createWithAttempts(t, env, attempts)
-
-		assert.Equal(t, http.StatusBadRequest, code,
-			"max_attempts=%q should be rejected, not coerced",
-			attempts)
-		assert.Contains(t, body, "whole number",
-			"the rejection for %q should say why", attempts)
-		assert.Empty(t,
-			targetsForWebhook(t, env.db, webhook.ID),
-			"no target should be created for %q", attempts)
-	}
-}
-
-// TestTargetCreate_ValidAttemptsStored covers the accepting half,
-// including both bounds: a bound that rejects its own limit would
-// make the advertised range unreachable.
-func TestTargetCreate_ValidAttemptsStored(t *testing.T) {
-	t.Parallel()
-
-	env := setupSourceTest(t)
-
-	for _, want := range []int{1, 3, handlers.MaxTargetAttemptsForTest} {
-		webhook, code, body := createWithAttempts(
-			t, env, strconv.Itoa(want),
-		)
-
-		require.Equal(t, http.StatusSeeOther, code, body)
-
-		targets := targetsForWebhook(t, env.db, webhook.ID)
-		require.Len(t, targets, 1)
-		assert.Equal(t, want, targets[0].MaxAttempts)
-	}
-}
-
-// TestTargetCreate_AbsentAttemptsTakesDefault keeps the two cases
-// distinct. An omitted field is not an operator asking for something
-// invalid, so it still gets the default of one attempt rather than a
-// 400 — otherwise the fix above would make the form unusable.
-func TestTargetCreate_AbsentAttemptsTakesDefault(t *testing.T) {
-	t.Parallel()
-
-	env := setupSourceTest(t)
-
-	for _, attempts := range absentAttempts() {
-		webhook, code, body := createWithAttempts(t, env, attempts)
-
-		require.Equal(t, http.StatusSeeOther, code, body)
-
-		targets := targetsForWebhook(t, env.db, webhook.ID)
-		require.Len(t, targets, 1)
-		assert.Equal(t, 1, targets[0].MaxAttempts,
-			"an absent max_attempts should take the default")
-	}
-}
-
-// seedAttemptsTarget creates an HTTP target already delivering with
-// workingAttempts attempts, through the real create handler.
-func seedAttemptsTarget(
-	t *testing.T,
-	env *sourceTestEnv,
-) (database.Webhook, database.Target) {
-	t.Helper()
-
-	webhook, code, body := createWithAttempts(
-		t, env, strconv.Itoa(workingAttempts),
-	)
-	require.Equal(t, http.StatusSeeOther, code, body)
-
-	targets := targetsForWebhook(t, env.db, webhook.ID)
-	require.Len(t, targets, 1)
-	require.Equal(t, workingAttempts, targets[0].MaxAttempts)
-
-	return webhook, targets[0]
-}
-
-// editAttemptsForm is a complete edit submission that changes the
-// target's name as well, so a rejected submission can be shown to
-// have written nothing at all rather than merely to have left
-// max_attempts alone.
-func editAttemptsForm(attempts string) url.Values {
-	form := url.Values{}
-	form.Set("name", "renamed-by-edit")
-	form.Set("url", attemptsTargetURL)
-
-	if attempts != absentField {
-		form.Set("max_attempts", attempts)
-	}
-
-	return form
-}
-
-// assertEditRejectedAndUnchanged submits an edit expected to fail and
-// checks both halves of the requirement: the 400 explains itself, and
-// the target it was submitted against is untouched.
-func assertEditRejectedAndUnchanged(
-	t *testing.T,
-	env *sourceTestEnv,
-	attempts, wantReason string,
-) {
-	t.Helper()
-
-	webhook, target := seedAttemptsTarget(t, env)
-
-	w := submitTargetEdit(
-		env, webhook.ID, target.ID, editAttemptsForm(attempts),
-	)
-
-	assert.Equal(t, http.StatusBadRequest, w.Code,
-		"max_attempts=%q should be rejected on edit", attempts)
-	assert.Contains(t, w.Body.String(), wantReason,
-		"the rejection for %q should say why", attempts)
-
-	stored := storedTarget(t, env, target.ID)
-	assert.Equal(t, workingAttempts, stored.MaxAttempts,
-		"a rejected edit must not destroy the working number "+
-			"of attempts with %q", attempts)
-	assert.Equal(t, "attempts-target", stored.Name,
-		"a rejected edit must write nothing at all")
-}
-
-// TestTargetEdit_UnparseableAttemptsRejected is the damaging half of
-// the defect. A target delivering with retries, re-saved with a typo
-// in the field, returned 200 and was left with retries disabled and
-// nothing said.
-func TestTargetEdit_UnparseableAttemptsRejected(t *testing.T) {
-	t.Parallel()
-
-	env := setupSourceTest(t)
-
-	for _, attempts := range unparseableAttempts() {
-		assertEditRejectedAndUnchanged(
-			t, env, attempts, "whole number",
-		)
-	}
-}
-
-// TestTargetEdit_AttemptsBelowOneRejected proves the floor applies
-// to the edit path too.
-func TestTargetEdit_AttemptsBelowOneRejected(t *testing.T) {
-	t.Parallel()
-
-	env := setupSourceTest(t)
-
-	for _, attempts := range belowOneAttempts() {
-		assertEditRejectedAndUnchanged(t, env, attempts, "at least 1")
-	}
-}
-
-// TestTargetEdit_AttemptsAboveCeilingRejected proves the ceiling
-// applies to the edit path too, naming itself, so the two paths
-// cannot disagree about what is storable.
-func TestTargetEdit_AttemptsAboveCeilingRejected(t *testing.T) {
-	t.Parallel()
-
-	env := setupSourceTest(t)
-	ceiling := strconv.Itoa(handlers.MaxTargetAttemptsForTest)
-
-	for _, attempts := range overCeilingAttempts() {
-		assertEditRejectedAndUnchanged(t, env, attempts, ceiling)
-	}
-}
-
-// TestTargetEdit_ValidAttemptsStored covers the accepting half of the
-// edit path, so the bounds cannot be enforced by simply refusing
-// every submission.
-func TestTargetEdit_ValidAttemptsStored(t *testing.T) {
-	t.Parallel()
-
-	env := setupSourceTest(t)
-
-	for _, want := range []int{1, 9, handlers.MaxTargetAttemptsForTest} {
-		webhook, target := seedAttemptsTarget(t, env)
-
-		w := submitTargetEdit(
-			env, webhook.ID, target.ID,
-			editAttemptsForm(strconv.Itoa(want)),
-		)
-		require.Equal(t,
-			http.StatusSeeOther, w.Code, w.Body.String(),
-		)
-
-		assert.Equal(t, want,
-			storedTarget(t, env, target.ID).MaxAttempts)
-	}
-}
-
-// TestTargetEdit_AbsentAttemptsLeavesStoredValue is the edit path's
-// absent-versus-invalid case. The field is only offered by the forms
-// for types that retry, so a submission without it must leave the
-// stored count alone rather than be rejected or reset.
-func TestTargetEdit_AbsentAttemptsLeavesStoredValue(t *testing.T) {
-	t.Parallel()
-
-	env := setupSourceTest(t)
-
-	for _, attempts := range absentAttempts() {
-		webhook, target := seedAttemptsTarget(t, env)
-
-		w := submitTargetEdit(
-			env, webhook.ID, target.ID,
-			editAttemptsForm(attempts),
-		)
-		require.Equal(t,
-			http.StatusSeeOther, w.Code, w.Body.String(),
-		)
-
-		assert.Equal(t, workingAttempts,
-			storedTarget(t, env, target.ID).MaxAttempts,
-			"an absent max_attempts must leave the stored "+
-				"count alone (%q)", attempts)
-	}
-}
-
-// TestTargetAttempts_CreateAndEditAgreeOnEveryCase proves the two
-// paths cannot disagree, which is what let the create form and the
-// edit form drift apart in the first place. Every input is submitted
-// to both and the accept/reject verdicts are compared.
-func TestTargetAttempts_CreateAndEditAgreeOnEveryCase(t *testing.T) {
-	t.Parallel()
-
-	env := setupSourceTest(t)
-
-	accepted := []string{
-		"1", "2",
-		strconv.Itoa(handlers.MaxTargetAttemptsForTest),
-	}
-	overCeiling := overCeilingAttempts()
-	belowOne := belowOneAttempts()
-	unparseable := unparseableAttempts()
-
-	cases := make(
-		[]string, 0,
-		len(accepted)+len(overCeiling)+len(belowOne)+
-			len(unparseable),
-	)
-	cases = append(cases, accepted...)
-	cases = append(cases, overCeiling...)
-	cases = append(cases, belowOne...)
-	cases = append(cases, unparseable...)
-
-	for _, attempts := range cases {
-		_, createCode, _ := createWithAttempts(t, env, attempts)
-
-		webhook, target := seedAttemptsTarget(t, env)
-		editCode := submitTargetEdit(
-			env, webhook.ID, target.ID,
-			editAttemptsForm(attempts),
-		).Code
-
-		assert.Equal(t,
-			createCode == http.StatusBadRequest,
-			editCode == http.StatusBadRequest,
-			"create and edit must agree on max_attempts=%q "+
-				"(create %d, edit %d)",
-			attempts, createCode, editCode,
-		)
-	}
-}
@@ -102,10 +102,9 @@ func (h *Handlers) newTarget(
 	in targetFormInput,
 ) (*database.Target, string, error) {
 	target := &database.Target{
-		WebhookID:   webhookID,
-		Type:        in.Type,
-		Active:      true,
-		MaxAttempts: 1,
+		WebhookID: webhookID,
+		Type:      in.Type,
+		Active:    true,
 	}

 	errMsg, err := h.setTargetFromForm(ctx, target, in)
@@ -118,10 +117,9 @@ func (h *Handlers) newTarget(

 // setTargetFromForm validates a target form against the target's type
 // and, when it accepts it, sets the target's name, configuration and
-// number of delivery attempts from it. It returns the message the form
-// shows for anything it refuses, an unknown type among them, and then
-// leaves the target unchanged; an error is the server's fault, as for
-// newTarget.
+// retry count from it. It returns the message the form shows for
+// anything it refuses, an unknown type among them, and then leaves the
+// target unchanged; an error is the server's fault, as for newTarget.
 // The add target form and the target edit form both go through here,
 // so the two cannot come to disagree about what a target may be.
 func (h *Handlers) setTargetFromForm(
@@ -138,20 +136,20 @@ func (h *Handlers) setTargetFromForm(
 		return errMsg, err
 	}

-	// An empty max_attempts keeps the target's count: the default of
-	// 1 for a new target, and the stored count for an edited one,
-	// since the forms for target types that do not retry have no such
-	// field. A value that is filled in but invalid is refused rather
-	// than becoming that count, so a typo cannot destroy the count a
-	// target is delivering with.
-	maxAttempts, err := parseMaxAttempts(in.MaxAttempts, target.MaxAttempts)
+	// An empty max_retries keeps the target's count: the
+	// fire-and-forget default of 0 for a new target, and the stored
+	// count for an edited one, since the forms for target types that
+	// do not retry have no such field. A value that is filled in but
+	// invalid is refused rather than becoming that count, so a typo
+	// cannot destroy the count a target is delivering with.
+	maxRetries, err := parseMaxRetries(in.MaxRetries, target.MaxRetries)
 	if err != nil {
-		return "Invalid delivery attempts: " + attemptsErrorMessage(err), nil
+		return "Invalid delivery attempts: " + retriesErrorMessage(err), nil
 	}

 	target.Name = in.Name
 	target.Config = configJSON
-	target.MaxAttempts = maxAttempts
+	target.MaxRetries = maxRetries

 	return "", nil
 }
@@ -178,8 +176,8 @@ type targetFormInput struct {
 	// ForwardQuery is an HTTP target's checkbox that passes each
 	// event's query string on to it.
 	ForwardQuery bool
-	// MaxAttempts is an HTTP or Slack target's max_attempts.
-	MaxAttempts string
+	// MaxRetries is an HTTP or Slack target's max_retries.
+	MaxRetries string
 	// Expiry is a database (archive) target's row expiry.
 	Expiry string
 	// Rotation is a database (archive) target's rotation.
@@ -206,7 +204,7 @@ func targetFormInputFrom(r *http.Request) targetFormInput {
 		Headers:      r.PostFormValue("headers"),
 		Timeout:      r.PostFormValue("timeout"),
 		ForwardQuery: r.PostFormValue("forward_query") != "",
-		MaxAttempts:  r.PostFormValue("max_attempts"),
+		MaxRetries:   r.PostFormValue("max_retries"),
 		Expiry:       r.PostFormValue("expiry"),
 		Rotation:     r.PostFormValue("rotation"),
 	}
@@ -196,7 +196,7 @@ func TestHandleTargetCreate_QueryStringCannotSupplyNameOrType(

 	w, _ := postTargetCreate(
 		t, env, webhook.ID,
-		"name=leaky&type=slack&max_attempts=9&expiry=30d&url="+
+		"name=leaky&type=slack&max_retries=9&expiry=30d&url="+
 			url.QueryEscape(targetSecretURL),
 		url.Values{},
 	)
@@ -21,24 +21,24 @@ func TestHandleTargetCreate_EveryType(t *testing.T) {

 	// fields is the rest of each submission, as a query string.
 	cases := []struct {
-		targetType   database.TargetType
-		fields       string
-		wantConfig   string
-		wantAttempts int
+		targetType  database.TargetType
+		fields      string
+		wantConfig  string
+		wantRetries int
 	}{
 		{
-			database.TargetTypeHTTP, "timeout=12&max_attempts=3",
+			database.TargetTypeHTTP, "timeout=12&max_retries=3",
 			`{"url":"` + editOriginalURL + `","timeout":12}`, 3,
 		},
 		{
-			database.TargetTypeSlack, "max_attempts=4",
+			database.TargetTypeSlack, "max_retries=4",
 			`{"webhookUrl":"` + editOriginalURL + `"}`, 4,
 		},
 		{
 			database.TargetTypeDatabase, "expiry=720h",
-			`{"expiry":"720h"}`, 1,
+			`{"expiry":"720h"}`, 0,
 		},
-		{database.TargetTypeLog, "", "", 1},
+		{database.TargetTypeLog, "", "", 0},
 	}

 	for _, tc := range cases {
@@ -62,7 +62,7 @@ func TestHandleTargetCreate_EveryType(t *testing.T) {
 			targets := targetsForWebhook(t, env.db, webhook.ID)
 			require.Len(t, targets, 1)
 			assert.Equal(t, tc.targetType, targets[0].Type)
-			assert.Equal(t, tc.wantAttempts, targets[0].MaxAttempts)
+			assert.Equal(t, tc.wantRetries, targets[0].MaxRetries)

 			if tc.wantConfig == "" {
 				assert.Empty(t, targets[0].Config)
@@ -90,11 +90,11 @@ func TestHandleTargetCreate_RefusedFormComesBack(t *testing.T) {
 		{
 			database.TargetTypeHTTP,
 			"name=private&url=" + editBlockedURL +
-				"&timeout=12&max_attempts=3",
+				"&timeout=12&max_retries=3",
 			"Invalid target URL",
 		},
 		{
-			database.TargetTypeSlack, "name=no-url&max_attempts=4",
+			database.TargetTypeSlack, "name=no-url&max_retries=4",
 			"Webhook URL is required for Slack targets",
 		},
 		{
@@ -133,8 +133,8 @@ func TestHandleTargetCreate_RefusedFormComesBack(t *testing.T) {
 			assert.Contains(t, page, html.EscapeString(tc.reason))

 			// Each value comes back in a data attribute of the targets
-			// section named after its field (max_attempts as
-			// data-max-attempts), except url, which comes back in
+			// section named after its field (max_retries as
+			// data-max-retries), except url, which comes back in
 			// data-destination; templates/source_detail.html says why.
 			for field := range typed {
 				attr := "data-" + strings.ReplaceAll(field, "_", "-")
@@ -82,7 +82,7 @@ func (h *Handlers) HandleTargetEdit() http.HandlerFunc {
 			Headers:      cfg.Headers,
 			Timeout:      cfg.Timeout,
 			ForwardQuery: cfg.ForwardQuery,
-			MaxAttempts:  strconv.Itoa(target.MaxAttempts),
+			MaxRetries:   strconv.Itoa(target.MaxRetries),
 			Expiry:       cfg.Expiry,
 			Rotation:     cfg.Rotation,
 		}
@@ -117,7 +117,7 @@ func seedHTTPTarget(
 	form.Set("url", editOriginalURL)
 	form.Set("headers", headers)
 	form.Set("timeout", timeout)
-	form.Set("max_attempts", "3")
+	form.Set("max_retries", "3")

 	w := serveTarget(
 		env, http.MethodPost,
@@ -179,7 +179,7 @@ func editForm(targetURL, headers, timeout string) url.Values {
 	form.Set("url", targetURL)
 	form.Set("headers", headers)
 	form.Set("timeout", timeout)
-	form.Set("max_attempts", "5")
+	form.Set("max_retries", "5")

 	return form
 }
@@ -280,9 +280,9 @@ func TestHandleTargetEditSubmit_Saves(t *testing.T) {
 		assertEditClearingRemovesThem(t, env)
 	})

-	t.Run("absent max_attempts is kept", func(t *testing.T) {
+	t.Run("absent max_retries is not zeroed", func(t *testing.T) {
 		t.Parallel()
-		assertEditKeepsAbsentMaxAttempts(t, env)
+		assertEditKeepsAbsentMaxRetries(t, env)
 	})
 }

@@ -307,7 +307,7 @@ func assertEditChangesDestination(

 	reloaded := storedTarget(t, env, target.ID)
 	assert.Equal(t, "edited-name", reloaded.Name)
-	assert.Equal(t, 5, reloaded.MaxAttempts)
+	assert.Equal(t, 5, reloaded.MaxRetries)
 	assert.Equal(
 		t, database.TargetTypeHTTP, reloaded.Type,
 		"the edit form must not change a target's type",
@@ -368,25 +368,25 @@ func assertEditClearingRemovesThem(
 	assert.Zero(t, cfg.Timeout)
 }

-// Delivery attempts are offered only by the forms for target types
-// that retry. An absent field means the form does not edit them, not
-// that retries should be turned off.
-func assertEditKeepsAbsentMaxAttempts(
+// Retries are offered only by the forms for target types that retry.
+// An absent field means the form does not edit retries, not that
+// they should be turned off.
+func assertEditKeepsAbsentMaxRetries(
 	t *testing.T, env *sourceTestEnv,
 ) {
 	t.Helper()

 	webhook, target := seedHTTPTarget(t, env, "", "")
-	require.Equal(t, 3, target.MaxAttempts)
+	require.Equal(t, 3, target.MaxRetries)

 	form := editForm(editOriginalURL, "", "")
-	form.Del("max_attempts")
+	form.Del("max_retries")

 	w := submitTargetEdit(env, webhook.ID, target.ID, form)
 	require.Equal(t, http.StatusSeeOther, w.Code, w.Body.String())

 	assert.Equal(
-		t, 3, storedTarget(t, env, target.ID).MaxAttempts,
+		t, 3, storedTarget(t, env, target.ID).MaxRetries,
 	)
 }

@@ -659,12 +659,12 @@ func TestHandleTargetEditSubmit_RefusedFormComesBack(t *testing.T) {
 		{
 			database.TargetTypeHTTP,
 			"name=edited&url=" + editBlockedURL +
-				"&headers=X-Edited:+kept&timeout=12&max_attempts=3",
+				"&headers=X-Edited:+kept&timeout=12&max_retries=3",
 			"Invalid target URL",
 		},
 		{
 			database.TargetTypeSlack,
-			"name=edited&url=" + editOriginalURL + "&max_attempts=25",
+			"name=edited&url=" + editOriginalURL + "&max_retries=25",
 			"Invalid delivery attempts",
 		},
 		{
@@ -0,0 +1,83 @@
+package handlers
+
+import (
+	"errors"
+	"strconv"
+	"strings"
+)
+
+// maxTargetRetries bounds a target's max_retries.
+//
+// Both target forms already declare max="20" on the input, so this
+// enforces server-side what the UI has always advertised rather than
+// introducing a new limit.
+//
+// The number is not cosmetic. Every attempt writes a delivery_results
+// row that the event log then loads and renders, and the engine backs
+// off by 2^(n-1) seconds, so attempt 20 is already about six days
+// after the first. A value beyond this buys no additional durability
+// and only costs rows.
+const maxTargetRetries = 20
+
+// Errors returned when a max_retries form value cannot be turned into
+// a retry count.
+var (
+	// errRetriesInvalid signals a max_retries form value that is not
+	// a non-negative whole number.
+	errRetriesInvalid = errors.New(
+		"must be a whole number",
+	)
+
+	// errRetriesTooLarge signals a max_retries form value that is a
+	// whole number but above maxTargetRetries. It is distinguished
+	// from errRetriesInvalid so the message can name the ceiling
+	// instead of implying the input was not a number.
+	errRetriesTooLarge = errors.New("out of range")
+)
+
+// parseMaxRetries interprets a max_retries form value.
+//
+// An ABSENT value — the field empty or not submitted — yields
+// fallback, which lets the create path apply its default and the edit
+// path leave the stored value alone. A value that is SET BUT INVALID
+// is an error: unparseable, negative, or above maxTargetRetries.
+//
+// The distinction is the whole point of this function. max_retries=0
+// means fire-and-forget, so returning 0 for input the operator typed
+// but that did not parse silently disables retries on a
+// store-and-forward proxy — and on the edit path it destroys a
+// working retry configuration over a typo. A default answers a
+// question that was not asked; it never answers one that was asked
+// badly.
+func parseMaxRetries(raw string, fallback int) (int, error) {
+	raw = strings.TrimSpace(raw)
+	if raw == "" {
+		return fallback, nil
+	}
+
+	v, err := strconv.Atoi(raw)
+	if err != nil || v < 0 {
+		return 0, errRetriesInvalid
+	}
+
+	if v > maxTargetRetries {
+		return 0, errRetriesTooLarge
+	}
+
+	return v, nil
+}
+
+// retriesErrorMessage returns the message the create and edit forms
+// show for a rejected max_retries value. Any error other than
+// errRetriesTooLarge falls back to the generic wording, so an
+// unrecognised parse failure still produces a sensible 400.
+func retriesErrorMessage(err error) string {
+	if errors.Is(err, errRetriesTooLarge) {
+		return errRetriesTooLarge.Error() +
+			": at most " + strconv.Itoa(maxTargetRetries) +
+			" attempts"
+	}
+
+	return errRetriesInvalid.Error() +
+		", or 0 for fire-and-forget"
+}
@@ -0,0 +1,385 @@
+package handlers_test
+
+import (
+	"net/http"
+	"net/url"
+	"strconv"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"sneak.berlin/go/webhooker/internal/database"
+	"sneak.berlin/go/webhooker/internal/handlers"
+)
+
+// retriesTargetURL is the destination the retry-validation targets
+// point at. It is a literal public address rather than a hostname so
+// the SSRF check resolves nothing and a sandbox without DNS cannot
+// make these cases pass or fail for the wrong reason.
+const retriesTargetURL = "https://93.184.216.34/hooks/retries"
+
+const (
+	// wayAboveCeiling is the typo'd-extra-zero case from the report.
+	wayAboveCeiling = "999999999"
+
+	// notANumber is the plainest garbage an operator can type, and
+	// the value the report submitted on the edit form.
+	notANumber = "abc"
+
+	// workingRetries is the retry count a seeded target is already
+	// delivering with, which a rejected submission must not disturb.
+	workingRetries = 2
+)
+
+// aboveCeiling is the smallest rejected whole number.
+func aboveCeiling() string {
+	return strconv.Itoa(handlers.MaxTargetRetriesForTest + 1)
+}
+
+// overCeilingRetries is whole-number input past the limit, which is
+// rejected with the limit named.
+func overCeilingRetries() []string {
+	return []string{aboveCeiling(), wayAboveCeiling}
+}
+
+// unparseableRetries is input an operator can type into the field
+// that is not a retry count. Each must be REJECTED: silently reading
+// any of them as 0 turns a store-and-forward proxy into
+// fire-and-forget without saying so.
+//
+// The twenty-digit case is here because it parses as digits but
+// overflows int, which is the one failure the field's own min/max
+// attributes cannot describe.
+func unparseableRetries() []string {
+	return []string{
+		notANumber,
+		"2.7",
+		"-5",
+		"12345678901234567890",
+		"1e3",
+	}
+}
+
+// createRetriesForm is a complete, otherwise-valid HTTP target
+// creation, so the only thing any case below varies is max_retries.
+func createRetriesForm(retries string) url.Values {
+	form := url.Values{}
+	form.Set("name", "retries-target")
+	form.Set("type", string(database.TargetTypeHTTP))
+	form.Set("url", retriesTargetURL)
+
+	if retries != absentField {
+		form.Set("max_retries", retries)
+	}
+
+	return form
+}
+
+// absentField marks a field the form does not submit at all, which is
+// the case that legitimately takes a default and must stay distinct
+// from a field submitted with garbage in it.
+const absentField = "\x00absent"
+
+// absentRetries is every way of saying "the operator did not set
+// this", each of which takes the default rather than a 400. Blank and
+// whitespace-only count as absent here because they do in the timeout
+// and retention controls on the same forms; a rule the fields do not
+// share would be its own surprise.
+func absentRetries() []string {
+	return []string{absentField, "", "  "}
+}
+
+// createWithRetries posts the target create form for a fresh webhook
+// and returns the webhook and the response.
+func createWithRetries(
+	t *testing.T,
+	env *sourceTestEnv,
+	retries string,
+) (database.Webhook, int, string) {
+	t.Helper()
+
+	webhook := seedWebhookWithRetention(t, env.db, 30)
+
+	w := serveTarget(
+		env, http.MethodPost,
+		"/hook/"+webhook.ID+"/targets",
+		createRetriesForm(retries),
+	)
+
+	return webhook, w.Code, w.Body.String()
+}
+
+// TestTargetCreate_RetriesAboveCeilingRejected proves the create form
+// enforces a ceiling at all, and that the 400 names it — a rejection
+// that does not say what the limit is leaves the operator guessing.
+func TestTargetCreate_RetriesAboveCeilingRejected(t *testing.T) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+	ceiling := strconv.Itoa(handlers.MaxTargetRetriesForTest)
+
+	for _, retries := range overCeilingRetries() {
+		webhook, code, body := createWithRetries(t, env, retries)
+
+		assert.Equal(t, http.StatusBadRequest, code,
+			"max_retries=%s should be rejected", retries)
+		assert.Contains(t, body, ceiling,
+			"the rejection for %s should name the ceiling",
+			retries)
+		assert.Empty(t,
+			targetsForWebhook(t, env.db, webhook.ID),
+			"no target should be created for %s", retries)
+	}
+}
+
+// TestTargetCreate_UnparseableRetriesRejected is the core of the
+// defect: each of these was accepted with HTTP 200 and stored as 0.
+func TestTargetCreate_UnparseableRetriesRejected(t *testing.T) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+
+	for _, retries := range unparseableRetries() {
+		webhook, code, body := createWithRetries(t, env, retries)
+
+		assert.Equal(t, http.StatusBadRequest, code,
+			"max_retries=%q should be rejected, not coerced",
+			retries)
+		assert.Contains(t, body, "whole number",
+			"the rejection for %q should say why", retries)
+		assert.Empty(t,
+			targetsForWebhook(t, env.db, webhook.ID),
+			"no target should be created for %q", retries)
+	}
+}
+
+// TestTargetCreate_ValidRetriesStored covers the accepting half,
+// including the ceiling itself: a bound that rejects its own limit
+// would make the advertised maximum unreachable.
+func TestTargetCreate_ValidRetriesStored(t *testing.T) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+
+	for _, want := range []int{0, 3, handlers.MaxTargetRetriesForTest} {
+		webhook, code, body := createWithRetries(
+			t, env, strconv.Itoa(want),
+		)
+
+		require.Equal(t, http.StatusSeeOther, code, body)
+
+		targets := targetsForWebhook(t, env.db, webhook.ID)
+		require.Len(t, targets, 1)
+		assert.Equal(t, want, targets[0].MaxRetries)
+	}
+}
+
+// TestTargetCreate_AbsentRetriesTakesDefault keeps the two cases
+// distinct. An omitted field is not an operator asking for something
+// invalid, so it still gets the fire-and-forget default rather than a
+// 400 — otherwise the fix above would make the form unusable.
+func TestTargetCreate_AbsentRetriesTakesDefault(t *testing.T) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+
+	for _, retries := range absentRetries() {
+		webhook, code, body := createWithRetries(t, env, retries)
+
+		require.Equal(t, http.StatusSeeOther, code, body)
+
+		targets := targetsForWebhook(t, env.db, webhook.ID)
+		require.Len(t, targets, 1)
+		assert.Equal(t, 0, targets[0].MaxRetries,
+			"an absent max_retries should take the default")
+	}
+}
+
+// seedRetriesTarget creates an HTTP target already delivering with
+// workingRetries retries, through the real create handler.
+func seedRetriesTarget(
+	t *testing.T,
+	env *sourceTestEnv,
+) (database.Webhook, database.Target) {
+	t.Helper()
+
+	webhook, code, body := createWithRetries(
+		t, env, strconv.Itoa(workingRetries),
+	)
+	require.Equal(t, http.StatusSeeOther, code, body)
+
+	targets := targetsForWebhook(t, env.db, webhook.ID)
+	require.Len(t, targets, 1)
+	require.Equal(t, workingRetries, targets[0].MaxRetries)
+
+	return webhook, targets[0]
+}
+
+// editRetriesForm is a complete edit submission that changes the
+// target's name as well, so a rejected submission can be shown to
+// have written nothing at all rather than merely to have left
+// max_retries alone.
+func editRetriesForm(retries string) url.Values {
+	form := url.Values{}
+	form.Set("name", "renamed-by-edit")
+	form.Set("url", retriesTargetURL)
+
+	if retries != absentField {
+		form.Set("max_retries", retries)
+	}
+
+	return form
+}
+
+// assertEditRejectedAndUnchanged submits an edit expected to fail and
+// checks both halves of the requirement: the 400 explains itself, and
+// the target it was submitted against is untouched.
+func assertEditRejectedAndUnchanged(
+	t *testing.T,
+	env *sourceTestEnv,
+	retries, wantReason string,
+) {
+	t.Helper()
+
+	webhook, target := seedRetriesTarget(t, env)
+
+	w := submitTargetEdit(
+		env, webhook.ID, target.ID, editRetriesForm(retries),
+	)
+
+	assert.Equal(t, http.StatusBadRequest, w.Code,
+		"max_retries=%q should be rejected on edit", retries)
+	assert.Contains(t, w.Body.String(), wantReason,
+		"the rejection for %q should say why", retries)
+
+	stored := storedTarget(t, env, target.ID)
+	assert.Equal(t, workingRetries, stored.MaxRetries,
+		"a rejected edit must not destroy the working retry "+
+			"count with %q", retries)
+	assert.Equal(t, "retries-target", stored.Name,
+		"a rejected edit must write nothing at all")
+}
+
+// TestTargetEdit_UnparseableRetriesRejected is the damaging half of
+// the defect. A target delivering with two retries, re-saved with a
+// typo in the field, returned 200 and was left with retries disabled
+// and nothing said.
+func TestTargetEdit_UnparseableRetriesRejected(t *testing.T) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+
+	for _, retries := range unparseableRetries() {
+		assertEditRejectedAndUnchanged(
+			t, env, retries, "whole number",
+		)
+	}
+}
+
+// TestTargetEdit_RetriesAboveCeilingRejected proves the ceiling
+// applies to the edit path too, naming itself, so the two paths
+// cannot disagree about what is storable.
+func TestTargetEdit_RetriesAboveCeilingRejected(t *testing.T) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+	ceiling := strconv.Itoa(handlers.MaxTargetRetriesForTest)
+
+	for _, retries := range overCeilingRetries() {
+		assertEditRejectedAndUnchanged(t, env, retries, ceiling)
+	}
+}
+
+// TestTargetEdit_ValidRetriesStored covers the accepting half of the
+// edit path, so the ceiling cannot be enforced by simply refusing
+// every submission.
+func TestTargetEdit_ValidRetriesStored(t *testing.T) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+
+	for _, want := range []int{0, 9, handlers.MaxTargetRetriesForTest} {
+		webhook, target := seedRetriesTarget(t, env)
+
+		w := submitTargetEdit(
+			env, webhook.ID, target.ID,
+			editRetriesForm(strconv.Itoa(want)),
+		)
+		require.Equal(t,
+			http.StatusSeeOther, w.Code, w.Body.String(),
+		)
+
+		assert.Equal(t, want,
+			storedTarget(t, env, target.ID).MaxRetries)
+	}
+}
+
+// TestTargetEdit_AbsentRetriesLeavesStoredValue is the edit path's
+// absent-versus-invalid case. Retries are only offered by the forms
+// for types that retry, so a submission without the field must leave
+// the stored count alone rather than be rejected or zeroed.
+func TestTargetEdit_AbsentRetriesLeavesStoredValue(t *testing.T) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+
+	for _, retries := range absentRetries() {
+		webhook, target := seedRetriesTarget(t, env)
+
+		w := submitTargetEdit(
+			env, webhook.ID, target.ID,
+			editRetriesForm(retries),
+		)
+		require.Equal(t,
+			http.StatusSeeOther, w.Code, w.Body.String(),
+		)
+
+		assert.Equal(t, workingRetries,
+			storedTarget(t, env, target.ID).MaxRetries,
+			"an absent max_retries must leave the stored "+
+				"count alone (%q)", retries)
+	}
+}
+
+// TestTargetRetries_CreateAndEditAgreeOnEveryCase proves the two
+// paths cannot disagree, which is what let the create form and the
+// edit form drift apart in the first place. Every input is submitted
+// to both and the accept/reject verdicts are compared.
+func TestTargetRetries_CreateAndEditAgreeOnEveryCase(t *testing.T) {
+	t.Parallel()
+
+	env := setupSourceTest(t)
+
+	accepted := []string{
+		"0", "1",
+		strconv.Itoa(handlers.MaxTargetRetriesForTest),
+	}
+	overCeiling := overCeilingRetries()
+	unparseable := unparseableRetries()
+
+	cases := make(
+		[]string, 0,
+		len(accepted)+len(overCeiling)+len(unparseable),
+	)
+	cases = append(cases, accepted...)
+	cases = append(cases, overCeiling...)
+	cases = append(cases, unparseable...)
+
+	for _, retries := range cases {
+		_, createCode, _ := createWithRetries(t, env, retries)
+
+		webhook, target := seedRetriesTarget(t, env)
+		editCode := submitTargetEdit(
+			env, webhook.ID, target.ID,
+			editRetriesForm(retries),
+		).Code
+
+		assert.Equal(t,
+			createCode == http.StatusBadRequest,
+			editCode == http.StatusBadRequest,
+			"create and edit must agree on max_retries=%q "+
+				"(create %d, edit %d)",
+			retries, createCode, editCode,
+		)
+	}
+}
@@ -59,7 +59,7 @@ func TestHandleTargetToggle_DoesNotUndoAnEdit(t *testing.T) {
 	stored := storedTarget(t, env, tgt.ID)
 	assert.False(t, stored.Active)
 	assert.Equal(t, "edited-name", stored.Name)
-	assert.Equal(t, 5, stored.MaxAttempts)
+	assert.Equal(t, 5, stored.MaxRetries)
 	assert.Equal(
 		t, editReplacedURL, storedHTTPConfig(t, env, tgt.ID).URL,
 	)
@@ -348,19 +348,21 @@ func TestEntrypointCopyButtonIsProgressiveEnhancement(t *testing.T) {
 	)
 }

-// maxAttemptsHelp is the wording both target forms must carry. The
-// delivery core makes max_attempts attempts in total, not that many
+// maxRetriesHelp is the wording both target forms must carry. The
+// delivery core makes max_retries attempts in total, not that many
 // retries on top of a first try (a fresh delivery starts at attempt 1
 // and target_http gives up once the attempt number reaches
-// max_attempts).
-const maxAttemptsHelp = "How many times each delivery is attempted in " +
-	"all, the first attempt included."
+// max_retries), and 0 is special-cased to a single fire-and-forget
+// attempt with no circuit breaker.
+const maxRetriesHelp = "How many times each delivery is attempted in " +
+	"all, the first attempt included. 0 means a single attempt with no " +
+	"retries and no circuit breaker."

-// TestTargetFormMaxAttemptsCopyMatchesBehaviour pins the max_attempts
+// TestTargetFormMaxRetriesCopyMatchesBehaviour pins the max_retries
 // label, "Delivery attempts", and help text on both the create form
 // (the add-target form on the webhook detail page) and the edit form,
 // so the copy cannot drift back to calling the number a retry count.
-func TestTargetFormMaxAttemptsCopyMatchesBehaviour(t *testing.T) {
+func TestTargetFormMaxRetriesCopyMatchesBehaviour(t *testing.T) {
 	t.Parallel()

 	var h *handlers.Handlers
@@ -392,11 +394,11 @@ func TestTargetFormMaxAttemptsCopyMatchesBehaviour(t *testing.T) {

 	assert.Contains(t, createBody, "Delivery attempts:</label>")
 	assert.Contains(
-		t, createBody, maxAttemptsHelp,
-		"the add-target form must explain max_attempts as total attempts",
+		t, createBody, maxRetriesHelp,
+		"the add-target form must explain max_retries as total attempts",
 	)

-	// A slack target exercises the same max_attempts field while needing
+	// A slack target exercises the same max_retries field while needing
 	// only a URL from the edit template, so the test data stays
 	// minimal. The Target and TargetForm keys mirror the field names
 	// the template reads off the handler's values.
@@ -410,8 +412,8 @@ func TestTargetFormMaxAttemptsCopyMatchesBehaviour(t *testing.T) {
 				"Active": true,
 			},
 			"TargetForm": map[string]any{
-				"URL":         "https://hooks.slack.com/services/x",
-				"MaxAttempts": "3",
+				"URL":        "https://hooks.slack.com/services/x",
+				"MaxRetries": "3",
 			},
 			dataKeyError: "",
 		},
@@ -419,8 +421,8 @@ func TestTargetFormMaxAttemptsCopyMatchesBehaviour(t *testing.T) {

 	assert.Contains(t, editBody, `class="label">Delivery attempts</label>`)
 	assert.Contains(
-		t, editBody, maxAttemptsHelp,
-		"the target edit form must explain max_attempts as total attempts",
+		t, editBody, maxRetriesHelp,
+		"the target edit form must explain max_retries as total attempts",
 	)
 }

@@ -442,7 +442,7 @@ func buildDeliveryTasks(
 			TargetName:   targets[i].Name,
 			TargetType:   targets[i].Type,
 			TargetConfig: targets[i].Config,
-			MaxAttempts:  targets[i].MaxAttempts,
+			MaxRetries:   targets[i].MaxRetries,
 			Method:       event.Method,
 			RawQuery:     event.RawQuery,
 			Headers:      event.Headers,
@@ -354,11 +354,11 @@ func checkAddEachTargetType(ctx context.Context, t *testing.T, url string) {
 	}{
 		{
 			"http", "http",
-			"csrf_token name type url headers timeout max_attempts",
+			"csrf_token name type url headers timeout max_retries",
 			map[string]string{"url": publicTargetURL},
 		},
 		{
-			"slack", "slack", "csrf_token name type url max_attempts",
+			"slack", "slack", "csrf_token name type url max_retries",
 			map[string]string{"url": publicTargetURL},
 		},
 		{
@@ -630,11 +630,11 @@ func checkRefusedEdits(
 		values map[string]string
 	}{
 		{page + "/targets/" + targetID + "/edit", map[string]string{
-			"#name":         "edited-target",
-			"#url":          "http://127.0.0.1/hook",
-			"#headers":      "X-Edited: kept",
-			"#timeout":      "12",
-			"#max_attempts": "3",
+			"#name":        "edited-target",
+			"#url":         "http://127.0.0.1/hook",
+			"#headers":     "X-Edited: kept",
+			"#timeout":     "12",
+			"#max_retries": "3",
 		}},
 		{page + "/edit", map[string]string{
 			"#name":           "edited-webhook",
@@ -5,6 +5,7 @@ import (
 	"net"
 	"net/http"
 	"strconv"
+	"syscall"
 	"testing"
 	"time"

@@ -25,6 +26,11 @@ const (
 	// its network namespace even with a published port.
 	wildcardV4 = "0.0.0.0"

+	// loopbackV6 and wildcardV6 are the IPv6 counterparts of the two
+	// above.
+	loopbackV6 = "::1"
+	wildcardV6 = "::"
+
 	// unavailableAddr is a TEST-NET-1 address (RFC 5737). It is a
 	// well-formed literal that no host is assigned, so binding it
 	// fails with EADDRNOTAVAIL rather than succeeding somewhere
@@ -116,6 +122,24 @@ func otherLocalAddr(t *testing.T) string {
 	return ""
 }

+// skipWithoutIPv6 skips the test when this host cannot bind
+// loopbackV6. Without IPv6 there is no second family for a bind to
+// claim or leave alone.
+func skipWithoutIPv6(t *testing.T) {
+	t.Helper()
+
+	var listenCfg net.ListenConfig
+
+	l, err := listenCfg.Listen(
+		t.Context(), "tcp6", net.JoinHostPort(loopbackV6, "0"),
+	)
+	if err != nil {
+		t.Skip("host has no IPv6 loopback to bind")
+	}
+
+	require.NoError(t, l.Close())
+}
+
 // startBoundServer starts the wired app with the given bind address
 // on a free port and returns that port. The app is stopped on
 // cleanup.
@@ -292,6 +316,59 @@ func TestBindAddress_WildcardReachesOtherAddresses(t *testing.T) {
 	requireDialable(t, net.JoinHostPort(other, strconv.Itoa(port)))
 }

+// TestBindAddress_WildcardV4IsIPv4Only pins that 0.0.0.0 answers on
+// IPv4 alone, as the README says, whether it is written as 0.0.0.0 or
+// as the IPv4-mapped ::ffff:0.0.0.0. Go listens on 0.0.0.0 with a
+// socket that answers IPv6 too unless told otherwise, which put the
+// admin UI and the receiver on every IPv6 address of a host whose
+// operator had chosen an IPv4 bind.
+func TestBindAddress_WildcardV4IsIPv4Only(t *testing.T) {
+	t.Parallel()
+
+	skipWithoutIPv6(t)
+
+	for _, bindAddress := range []string{wildcardV4, "::ffff:0.0.0.0"} {
+		t.Run(bindAddress, func(t *testing.T) {
+			t.Parallel()
+
+			port := startBoundServer(t, bindAddress)
+
+			// Positive control: the service really is up, on IPv4.
+			requireDialable(
+				t, net.JoinHostPort(loopbackV4, strconv.Itoa(port)),
+			)
+
+			dialer := net.Dialer{Timeout: dialTimeout}
+
+			conn, err := dialer.DialContext(
+				t.Context(), "tcp",
+				net.JoinHostPort(loopbackV6, strconv.Itoa(port)),
+			)
+			if err == nil {
+				_ = conn.Close()
+			}
+
+			require.ErrorIs(
+				t, err, syscall.ECONNREFUSED,
+				"a %s bind answered on %s", bindAddress, loopbackV6,
+			)
+		})
+	}
+}
+
+// TestBindAddress_WildcardV6ReachesBothFamilies is the counterpart:
+// :: is the value that binds IPv6, and it answers IPv4 as well.
+func TestBindAddress_WildcardV6ReachesBothFamilies(t *testing.T) {
+	t.Parallel()
+
+	skipWithoutIPv6(t)
+
+	port := startBoundServer(t, wildcardV6)
+
+	requireDialable(t, net.JoinHostPort(loopbackV6, strconv.Itoa(port)))
+	requireDialable(t, net.JoinHostPort(loopbackV4, strconv.Itoa(port)))
+}
+
 // TestBindAddress_ServesRequestsOnConfiguredAddress proves the bound
 // listener serves the application rather than merely accepting TCP,
 // so a bind address that is honoured cannot be mistaken for one that
@@ -1,9 +1,11 @@
 package server

 import (
+	"context"
 	"errors"
 	"net"
 	"net/http"
+	"net/netip"
 	"strconv"
 	"time"
 )
@@ -39,6 +41,23 @@ func (s *Server) listenAddr() string {
 	)
 }

+// listenNetwork returns the network the HTTP listener binds on, "tcp4"
+// for an IPv4 BindAddress and "tcp" for any other.
+//
+// On "tcp", Go binds 0.0.0.0 with a socket that answers IPv6 as well,
+// exactly as it binds ::. "tcp4" keeps 0.0.0.0 to IPv4, which is what
+// the README says it means. :: stays on "tcp" and answers both. An
+// IPv4-mapped address such as ::ffff:0.0.0.0 is the IPv4 address it
+// carries to Go's listener, so it gets "tcp4" too.
+func (s *Server) listenNetwork() string {
+	addr, err := netip.ParseAddr(s.params.Config.BindAddress)
+	if err == nil && addr.Unmap().Is4() {
+		return "tcp4"
+	}
+
+	return "tcp"
+}
+
 // newHTTPServer builds the HTTP server for this Server's
 // configuration.
 //
@@ -67,7 +86,17 @@ func (s *Server) serveUntilShutdown() {

 	s.log.Info("http begin listen", "listenaddr", s.httpServer.Addr)

-	err := s.httpServer.ListenAndServe()
+	// ListenAndServe always listens on "tcp", which would undo
+	// listenNetwork.
+	var listenCfg net.ListenConfig
+
+	listener, err := listenCfg.Listen(
+		context.Background(), s.listenNetwork(), s.httpServer.Addr,
+	)
+	if err == nil {
+		err = s.httpServer.Serve(listener)
+	}
+
 	if err != nil && !errors.Is(err, http.ErrServerClosed) {
 		s.log.Error("listen error", "error", err)
 		s.shutdownWithFailure()
@@ -135,6 +135,8 @@ func New(lc fx.Lifecycle, params ServerParams) (*Server, error) {
 	s.httpServer = s.newHTTPServer()

 	lc.Append(fx.Hook{
+		//nolint:contextcheck // The listener outlives this hook, whose
+		// context fx cancels once the app has started.
 		OnStart: func(_ context.Context) error {
 			s.startupTime = time.Now()
 			go s.Run()
@@ -139,7 +139,7 @@ document.addEventListener("alpine:init", function () {
            headers: "",
            timeout: "",
            forwardQuery: false,
-            maxAttempts: "",
+            maxRetries: "",
            expiry: "",
            rotation: "",
            init() {
@@ -153,7 +153,7 @@ document.addEventListener("alpine:init", function () {
                this.timeout = refused.timeout;
                this.forwardQuery =
                    this.$root.hasAttribute("data-forward-query");
-                this.maxAttempts = refused.maxAttempts;
+                this.maxRetries = refused.maxRetries;
                this.expiry = refused.expiry;
                this.rotation = refused.rotation;
            },
@@ -173,7 +173,7 @@ document.addEventListener("alpine:init", function () {
                this.headers = "";
                this.timeout = "";
                this.forwardQuery = false;
-                this.maxAttempts = "";
+                this.maxRetries = "";
                this.expiry = "";
                this.rotation = "";
                this.$refs.form.reset();
@@ -136,7 +136,7 @@
             data-headers="{{.TargetForm.Headers}}"
             data-timeout="{{.TargetForm.Timeout}}"
             {{if .TargetForm.ForwardQuery}}data-forward-query{{end}}
-             data-max-attempts="{{.TargetForm.MaxAttempts}}"
+             data-max-retries="{{.TargetForm.MaxRetries}}"
             data-expiry="{{.TargetForm.Expiry}}"
             data-rotation="{{.TargetForm.Rotation}}">
            <div class="p-4 border-b border-gray-200 flex justify-between items-center">
@@ -194,9 +194,9 @@
                            <div>
                                <div class="flex gap-2 items-center">
                                    <label class="text-sm text-gray-700">Delivery attempts:</label>
-                                    <input type="number" name="max_attempts" :value="maxAttempts" placeholder="1" min="1" max="20" class="input text-sm w-24">
+                                    <input type="number" name="max_retries" :value="maxRetries" placeholder="0" min="0" max="20" class="input text-sm w-24">
                                </div>
-                                <p class="text-xs text-gray-500 mt-1">How many times each delivery is attempted in all, the first attempt included.</p>
+                                <p class="text-xs text-gray-500 mt-1">How many times each delivery is attempted in all, the first attempt included. 0 means a single attempt with no retries and no circuit breaker.</p>
                            </div>
                        </div>
                    </template>
@@ -210,9 +210,9 @@
                            <div>
                                <div class="flex gap-2 items-center">
                                    <label class="text-sm text-gray-700">Delivery attempts:</label>
-                                    <input type="number" name="max_attempts" :value="maxAttempts" placeholder="1" min="1" max="20" class="input text-sm w-24">
+                                    <input type="number" name="max_retries" :value="maxRetries" placeholder="0" min="0" max="20" class="input text-sm w-24">
                                </div>
-                                <p class="text-xs text-gray-500 mt-1">How many times each delivery is attempted in all, the first attempt included.</p>
+                                <p class="text-xs text-gray-500 mt-1">How many times each delivery is attempted in all, the first attempt included. 0 means a single attempt with no retries and no circuit breaker.</p>
                            </div>
                        </div>
                    </template>
@@ -89,9 +89,9 @@

            {{if or (eq .Target.Type "http") (eq .Target.Type "slack")}}
            <div class="form-group">
-                <label for="max_attempts" class="label">Delivery attempts</label>
-                <input type="number" id="max_attempts" name="max_attempts" value="{{.TargetForm.MaxAttempts}}" min="1" max="20" class="input">
-                <p class="text-xs text-gray-500 mt-1">How many times each delivery is attempted in all, the first attempt included.</p>
+                <label for="max_retries" class="label">Delivery attempts</label>
+                <input type="number" id="max_retries" name="max_retries" value="{{.TargetForm.MaxRetries}}" min="0" max="20" class="input">
+                <p class="text-xs text-gray-500 mt-1">How many times each delivery is attempted in all, the first attempt included. 0 means a single attempt with no retries and no circuit breaker.</p>
            </div>
            {{end}}