Root background loops at context.Background() (closes #97 )

The context fx hands an OnStart hook is derived with context.WithTimeout(ctx, StartTimeout) — 15 seconds by default — and is cancelled once the start phase ends. It is a start-phase context, not an application-lifetime one. Two components derived their long-lived loops from it and so stopped running roughly fifteen seconds after boot. Engine.start rooted the entire worker pool, restart recovery, and the retry sweep in it. Every worker returned on ctx.Done() shortly after startup, so the process kept receiving and persisting inbound events while nothing at all forwarded them: deliveryCh filled up and started logging "delivery channel full" with no consumer left. That is the whole purpose of the application. RetentionReaper.start had the same defect. With the default one-hour RETENTION_SWEEP_INTERVAL the loop was cancelled forty-five minutes before its first tick, so the reaper never ran a single sweep and per-webhook event databases grew without bound. Both now derive their loop context from context.Background(). Their lifetime is bounded by OnStop, which already cancels and waits on the WaitGroup, so shutdown is unchanged. Each hook registration moves into a registerHooks method, the OnStart parameter is named _ so the trap cannot be reintroduced by silencing an unused-parameter warning, and a comment at each start explains why the hook context must not be used. This matches the shape of the same fix applied to the archive sweeper. The new lifecycle tests drive the genuine registered hooks with an already-cancelled OnStart context and assert the loops still do work afterwards — a task delivered, an expired event reaped. Reverting either fix makes its pair of tests fail. Each component also gets a shutdown test asserting OnStop cancels the loop and wg.Wait() returns inside a bounded timeout, so the fix does not trade a startup bug for a shutdown hang. iWaitForStatus becomes iWaitForDelivered: every call site waits for the delivered status, and the two added call sites pushed it past unparam's threshold for reporting an always-identical argument.
2026-08-09 05:15:13 +00:00
20 changed files with 579 additions and 1298 deletions
--- a/README.md
+++ b/README.md
@@ -307,29 +307,13 @@ event routing.
 | `user_id`        | UUID    | Foreign key → User |
 | `name`           | string  | Human-readable name |
 | `description`    | string  | Optional description |
-| `retention_days` | integer | Days to retain events (default: 30; 0 means retain forever) |
+| `retention_days` | integer | Days to retain events (default: 30) |
 **Relations:** Belongs to User. Has many Entrypoints. Has many Targets.
 The `retention_days` field controls how long event data is kept in the
 webhook's dedicated database before automatic cleanup.
 Setting `retention_days` to `0` means "retain events forever". Because
 the column carries a default of 30, a literal zero cannot survive an
 insert, so a zero is rewritten on save to a sentinel of `365 * 1000`
 days (`database.RetentionForeverDays`). The retention reaper recognises
 that sentinel and skips the webhook entirely, and the web UI displays
 such a webhook's retention as "forever" rather than as a day count.
 A *finite* retention is capped at `database.MaxFiniteRetentionDays`
 (106751 days, about 292 years), and a larger one is rejected with a
 400. The cap is not arbitrary: the reaper computes its cutoff as a
 `time.Duration`, an int64 nanosecond count, and a longer period
 overflows it. An overflowed cutoff lands in the future, where it
 matches every row, so the sweep would delete every event the webhook
 has instead of none. The reaper also clamps the value it is given, so a
 row written by an older version cannot trigger that either.
 #### Entrypoint
 A receiver URL where external services POST webhook events. Each
@@ -525,7 +509,7 @@ This separation provides:
  DB; the event database file is hard-deleted (permanently removed).
 - **Per-webhook retention** — the `retention_days` field on each webhook
  controls automatic cleanup of old events in that webhook's database
-  only, or disables cleanup entirely when set to `0` (retain forever).
+  only.
 - **Performance** — each webhook's database has its own WAL, its own
  page cache, and its own lock, so concurrent event ingestion across
  webhooks won't contend.
--- a/TODO.md
+++ b/TODO.md
@@ -28,17 +28,12 @@ databases currently grow without bound.
 # Completed Steps
- 2026-08-09 Make retain-forever reachable from the normal create and
+- 2026-08-09 Root the delivery engine's worker pool and the retention
-  edit flows (#79): a `RetentionForeverDays = 365 * 1000` sentinel, a
+  reaper's sweep loop at `context.Background()` rather than the fx
-  `Webhook.BeforeSave` hook rewriting any non-positive `retention_days`
+  `OnStart` hook context (#97), which carries fx's 15s start timeout and
-  to it ahead of GORM's own column defaulting, a reaper that skips such
+  killed both roughly fifteen seconds after boot: the proxy silently
-  webhooks outright, form validation that honours `0` and rejects
+  stopped delivering webhooks entirely, and the reaper never ran a
-  garbage with a 400, and a retention UI that says "forever". Also
+  single sweep under its default one-hour interval
  closes the overflow the same code path exposed: a finite
  `retention_days` above `MaxFiniteRetentionDays` (106751, derived from
  what an int64 `time.Duration` can hold) wrapped the reaper's cutoff
  into the future and deleted every event, so it is now rejected at the
  form and clamped in the reaper
 - 2026-08-07 Update golangci-lint to v2.12.2 (Docker image digest in
  `Dockerfile`, release-archive sha256 pins in `script/bootstrap`),
  adopt the canonical `.golangci.yml` (v2 `linters.settings` layout so
--- a/internal/database/database_test.go
+++ b/internal/database/database_test.go
@@ -18,11 +18,6 @@ const (
 	testVersion = "test"
 	// testContentType is the event content type used in tests.
 	testContentType = "application/json"
 	// testWebhookName is the Webhook.Name used in tests.
 	testWebhookName = "test-webhook"
 	// testForeverLabel is Webhook.RetentionLabel for a retain-forever
 	// webhook.
 	testForeverLabel = "forever"
 )
 func setupTestDB(
--- a/internal/database/export_test.go
+++ b/internal/database/export_test.go
@@ -5,6 +5,8 @@ import (
 	"log/slog"
 	"os"
 	"time"
 	"go.uber.org/fx"
 )
 // NewTestRetentionReaper builds a RetentionReaper backed by the given
@@ -29,3 +31,26 @@ func NewTestRetentionReaper(
 func (r *RetentionReaper) ExportSweep(ctx context.Context) {
 	r.sweep(ctx)
 }
 // ExportRegisterHooks registers the reaper's real fx lifecycle hooks
 // on a lifecycle supplied by a test, so a test can drive the exact
 // OnStart/OnStop functions the application runs and hand OnStart the
 // kind of context fx actually supplies.
 func (r *RetentionReaper) ExportRegisterHooks(lc fx.Lifecycle) {
 	r.registerHooks(lc)
 }
 // ExportStart starts the reaper's background loop for tests.
 func (r *RetentionReaper) ExportStart() {
 	r.start()
 }
 // ExportStop stops the reaper's background loop for tests.
 func (r *RetentionReaper) ExportStop() {
 	r.stop()
 }
 // ExportSetInterval overrides the sweep interval for tests.
 func (r *RetentionReaper) ExportSetInterval(d time.Duration) {
 	r.interval = d
 }
--- a/internal/database/model_webhook.go
+++ b/internal/database/model_webhook.go
@@ -1,59 +1,6 @@
 package database
 import (
 	"math"
 	"strconv"
 	"time"
 	"gorm.io/gorm"
 )
 const (
 	// DefaultRetentionDays is the event retention period applied to a
 	// webhook created without an explicit retention value. It is the
 	// single source of truth for that policy and must stay in sync
 	// with the `gorm:"default:30"` column default on
 	// Webhook.RetentionDays below; a struct tag cannot reference a
 	// constant, so a test asserts the two agree.
 	DefaultRetentionDays = 30
 	// RetentionForeverDays is the sentinel RetentionDays value meaning
 	// "retain events forever". Users express that intent as 0, which
 	// Webhook.BeforeSave rewrites to this value: the column default
 	// substitutes DefaultRetentionDays for a zero value at insert
 	// time, so a zero can never survive a round trip to the database.
 	// Nothing outside this file may hardcode the number.
 	RetentionForeverDays = 365 * 1000
 	// MaxFiniteRetentionDays is the largest finite retention period the
 	// reaper's cutoff arithmetic can represent, and therefore the
 	// largest one a caller may request. It is derived from that
 	// arithmetic rather than picked: retentionCutoff computes
 	// retentionDays * hoursPerDay * time.Hour, and a time.Duration is
 	// an int64 nanosecond count, so math.MaxInt64 nanoseconds divided
 	// by an hour and then by a day is the exact ceiling — 106751 days,
 	// a little over 292 years.
 	//
 	// One day more overflows int64, wraps the product negative, and
 	// turns the cutoff into a timestamp in the far future that matches
 	// every row in the webhook's database. That is why this bound is
 	// enforced on input and why retentionCutoff saturates underneath
 	// it. Note that RetentionForeverDays deliberately sits above this
 	// ceiling: such webhooks are skipped before any cutoff is
 	// computed, and never reach the arithmetic at all.
 	MaxFiniteRetentionDays = int(
 		math.MaxInt64 / int64(time.Hour) / hoursPerDay,
 	)
 )
 // Webhook represents a webhook processing unit that groups entrypoints and targets
 //
 // Every method below takes a pointer receiver. BeforeSave has to,
 // because it mutates the record and GORM only invokes hooks declared
 // that way; the display helpers follow suit so the receiver kinds do
 // not mix. Handlers therefore put a *Webhook into template data:
 // html/template cannot call a pointer method on a value held in a map,
 // because a map element is not addressable.
 type Webhook struct {
 	BaseModel
@@ -61,9 +8,7 @@ type Webhook struct {
 	Name        string `gorm:"not null"           json:"name"`
 	Description string `json:"description"`
-	// RetentionDays is the number of days to retain events. A value of
+	// RetentionDays is the number of days to retain events.
 	// RetentionForeverDays means retain forever. The column default
 	// must equal DefaultRetentionDays.
 	RetentionDays int `gorm:"default:30" json:"retentionDays"`
 	// Relations
@@ -71,55 +16,3 @@ type Webhook struct {
 	Entrypoints []Entrypoint `json:"entrypoints,omitempty"`
 	Targets     []Target     `json:"targets,omitempty"`
 }
 // BeforeSave normalises RetentionDays on every insert and update. A
 // non-positive value is the user's way of asking for "retain forever",
 // which is stored as the RetentionForeverDays sentinel.
 //
 // This has to happen in a hook rather than at the call sites. GORM
 // substitutes the column default (DefaultRetentionDays) for a zero
 // value while building the insert statement, which runs after
 // BeforeSave; rewriting any later than this loses that race and the
 // row lands at 30 days. Living on the model also means a future call
 // site — a REST API, a fixture, a migration — cannot bypass it.
 func (w *Webhook) BeforeSave(_ *gorm.DB) error {
 	if w.RetentionDays <= 0 {
 		w.RetentionDays = RetentionForeverDays
 	}
 	return nil
 }
 // retainsForever reports whether a stored RetentionDays value means
 // "keep events indefinitely". It is the single definition of that
 // question, shared by Webhook.RetainsForever and by the reaper's
 // cutoff computation so the two cannot disagree about which webhooks
 // are exempt from reaping.
 //
 // It accepts the RetentionForeverDays sentinel written by BeforeSave
 // and, defensively, the non-positive values that rows written before
 // the sentinel existed may still carry.
 func retainsForever(retentionDays int) bool {
 	return retentionDays <= 0 ||
 		retentionDays >= RetentionForeverDays
 }
 // RetainsForever reports whether this webhook's events are kept
 // indefinitely.
 func (w *Webhook) RetainsForever() bool {
 	return retainsForever(w.RetentionDays)
 }
 // RetentionLabel returns the webhook's retention policy as display
 // text, so that no template has to know about the sentinel value.
 func (w *Webhook) RetentionLabel() string {
 	if w.RetainsForever() {
 		return "forever"
 	}
 	if w.RetentionDays == 1 {
 		return "1 day"
 	}
 	return strconv.Itoa(w.RetentionDays) + " days"
 }
--- a/internal/database/model_webhook_test.go
+++ b/internal/database/model_webhook_test.go
@@ -1,222 +0,0 @@
 package database_test
 import (
 	"context"
 	"reflect"
 	"strconv"
 	"testing"
 	"time"
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"gorm.io/gorm"
 	"gorm.io/gorm/clause"
 	"sneak.berlin/go/webhooker/internal/database"
 )
 // startedTestDB returns a started main database for model-level tests.
 func startedTestDB(t *testing.T) *gorm.DB {
 	t.Helper()
 	db, lc := setupTestDB(t)
 	ctx := context.Background()
 	require.NoError(t, lc.Start(ctx))
 	t.Cleanup(func() { require.NoError(t, lc.Stop(ctx)) })
 	return db.DB()
 }
 // storedRetention reads the retention_days column straight out of the
 // row, so the assertion is about what was persisted rather than about
 // whatever the in-memory struct happens to hold.
 func storedRetention(t *testing.T, db *gorm.DB, id string) int {
 	t.Helper()
 	var got int
 	require.NoError(
 		t,
 		db.Model(&database.Webhook{}).
 			Where("id = ?", id).
 			Pluck("retention_days", &got).Error,
 	)
 	return got
 }
 // newWebhookWithRetention creates a webhook through the ordinary Create
 // path, so the BeforeSave hook and the GORM column default both apply
 // exactly as they do in production.
 func newWebhookWithRetention(
 	t *testing.T,
 	db *gorm.DB,
 	wh *database.Webhook,
 ) string {
 	t.Helper()
 	wh.UserID = uuid.New().String()
 	wh.Name = testWebhookName
 	require.NoError(
 		t,
 		db.Omit(clause.Associations).Create(wh).Error,
 	)
 	return wh.ID
 }
 func TestWebhookBeforeSave_ZeroBecomesForeverSentinel(t *testing.T) {
 	t.Parallel()
 	db := startedTestDB(t)
 	wh := &database.Webhook{RetentionDays: 0}
 	id := newWebhookWithRetention(t, db, wh)
 	assert.Equal(
 		t,
 		database.RetentionForeverDays,
 		storedRetention(t, db, id),
 		"a zero retention must be stored as the sentinel, "+
 			"not replaced by the column default",
 	)
 }
 func TestWebhookBeforeSave_NegativeBecomesForeverSentinel(t *testing.T) {
 	t.Parallel()
 	db := startedTestDB(t)
 	wh := &database.Webhook{RetentionDays: -5}
 	id := newWebhookWithRetention(t, db, wh)
 	assert.Equal(
 		t,
 		database.RetentionForeverDays,
 		storedRetention(t, db, id),
 	)
 }
 func TestWebhookBeforeSave_PositiveIsPreserved(t *testing.T) {
 	t.Parallel()
 	db := startedTestDB(t)
 	wh := &database.Webhook{RetentionDays: 7}
 	id := newWebhookWithRetention(t, db, wh)
 	assert.Equal(t, 7, storedRetention(t, db, id))
 }
 // TestWebhookBeforeSave_UpdateToZeroBecomesSentinel proves the hook
 // fires on update as well as insert, via the same Save call the edit
 // handler makes.
 func TestWebhookBeforeSave_UpdateToZeroBecomesSentinel(t *testing.T) {
 	t.Parallel()
 	db := startedTestDB(t)
 	wh := &database.Webhook{RetentionDays: 30}
 	id := newWebhookWithRetention(t, db, wh)
 	require.Equal(t, 30, storedRetention(t, db, id))
 	wh.RetentionDays = 0
 	require.NoError(t, db.Omit(clause.Associations).Save(wh).Error)
 	assert.Equal(
 		t,
 		database.RetentionForeverDays,
 		storedRetention(t, db, id),
 	)
 }
 // TestWebhookRetentionColumnDefaultMatchesConstant guards the one place
 // the default lives twice: a struct tag cannot reference a constant, so
 // this asserts the tag and DefaultRetentionDays agree.
 func TestWebhookRetentionColumnDefaultMatchesConstant(t *testing.T) {
 	t.Parallel()
 	field, ok := reflect.TypeFor[database.Webhook]().
 		FieldByName("RetentionDays")
 	require.True(t, ok, "Webhook.RetentionDays must exist")
 	assert.Equal(
 		t,
 		"default:"+strconv.Itoa(database.DefaultRetentionDays),
 		field.Tag.Get("gorm"),
 	)
 }
 // TestMaxFiniteRetentionDaysIsTheOverflowCeiling asserts that the
 // constant is exactly where the cutoff arithmetic stops working, which
 // is what makes it a derived bound rather than a round number someone
 // liked. One day more wraps the int64 nanosecond count negative, and a
 // negative span is precisely what turned a cutoff into a future
 // timestamp that matched — and deleted — every row.
 //
 // The multiplications are done through variables on purpose: as
 // constant expressions the overflowing one would not compile.
 func TestMaxFiniteRetentionDaysIsTheOverflowCeiling(t *testing.T) {
 	t.Parallel()
 	const hoursPerDay = 24
 	atCeiling := database.MaxFiniteRetentionDays
 	overCeiling := database.MaxFiniteRetentionDays + 1
 	assert.Positive(
 		t,
 		time.Duration(atCeiling*hoursPerDay)*time.Hour,
 		"the ceiling itself must still be representable",
 	)
 	assert.Negative(
 		t,
 		time.Duration(overCeiling*hoursPerDay)*time.Hour,
 		"one day past the ceiling must overflow",
 	)
 	assert.Less(
 		t,
 		database.MaxFiniteRetentionDays,
 		database.RetentionForeverDays,
 		"the sentinel sits above the ceiling and is only safe "+
 			"because retain-forever webhooks skip the arithmetic",
 	)
 }
 func TestWebhookRetainsForeverAndLabel(t *testing.T) {
 	t.Parallel()
 	cases := []struct {
 		name    string
 		days    int
 		forever bool
 		label   string
 	}{
 		{
 			"sentinel",
 			database.RetentionForeverDays, true, testForeverLabel,
 		},
 		{
 			"above sentinel",
 			database.RetentionForeverDays + 1, true, testForeverLabel,
 		},
 		{"legacy zero", 0, true, testForeverLabel},
 		{"legacy negative", -1, true, testForeverLabel},
 		{"default", database.DefaultRetentionDays, false, "30 days"},
 		{"one day", 1, false, "1 day"},
 	}
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 			wh := database.Webhook{RetentionDays: tc.days}
 			assert.Equal(t, tc.forever, wh.RetainsForever())
 			assert.Equal(t, tc.label, wh.RetentionLabel())
 		})
 	}
 }
--- a/internal/database/retention.go
+++ b/internal/database/retention.go
@@ -56,9 +56,20 @@ func NewRetentionReaper(
 		interval:  params.Config.RetentionSweepInterval,
 	}
 	r.registerHooks(lc)
 	return r
 }
 // registerHooks wires the reaper's start and stop into the fx
 // lifecycle. The start hook's context is deliberately ignored: see
 // start for why the sweep loop must not inherit it.
 func (r *RetentionReaper) registerHooks(lc fx.Lifecycle) {
 	lc.Append(fx.Hook{
-		OnStart: func(ctx context.Context) error {
+		//nolint:contextcheck // Not inheriting the hook context is
-			r.start(ctx)
+		// the point: see start.
 		OnStart: func(_ context.Context) error {
 			r.start()
 			return nil
 		},
@@ -68,12 +79,20 @@ func NewRetentionReaper(
 			return nil
 		},
 	})
 	return r
 }
-func (r *RetentionReaper) start(ctx context.Context) {
+// start launches the background sweep loop.
-	ctx, cancel := context.WithCancel(ctx)
+//
 // The loop's context is derived from context.Background(), NOT from
 // the fx OnStart hook context. The hook context carries fx's start
 // timeout (15s by default) and is cancelled once the start phase
 // completes, so a loop derived from it dies 45 minutes before its
 // first tick under the default one-hour sweep interval, leaving a
 // reaper that never reaps. A long-lived goroutine must outlive the
 // startup phase, so its lifetime is bounded by OnStop instead: stop
 // cancels this context and waits on the WaitGroup.
 func (r *RetentionReaper) start() {
 	ctx, cancel := context.WithCancel(context.Background())
 	r.cancel = cancel
 	r.wg.Add(1)
@@ -114,8 +133,7 @@ func (r *RetentionReaper) run(ctx context.Context) {
 }
 // sweep lists every webhook from the main database and reaps expired
-// rows from each per-webhook database that has a finite retention
+// rows from each per-webhook database whose RetentionDays is positive.
 // policy. Webhooks set to retain forever are skipped entirely.
 func (r *RetentionReaper) sweep(ctx context.Context) {
 	var webhooks []Webhook
@@ -140,13 +158,8 @@ func (r *RetentionReaper) sweep(ctx context.Context) {
 		wh := webhooks[i]
-		// Skip retain-forever webhooks before building any query.
+		// RetentionDays of zero or less means retain forever.
-		// RetainsForever covers both the RetentionForeverDays
+		if wh.RetentionDays <= 0 {
 		// sentinel and the non-positive values that predate it: the
 		// sentinel is a positive number, so without this the reaper
 		// would compute a cutoff a thousand years in the past and
 		// issue a DELETE matching nothing on every single sweep.
 		if wh.RetainsForever() {
 			continue
 		}
@@ -177,10 +190,9 @@ func (r *RetentionReaper) reapWebhook(
 		return
 	}
-	cutoff, ok := retentionCutoff(time.Now(), retentionDays)
+	cutoff := time.Now().Add(
-	if !ok {
+		-time.Duration(retentionDays*hoursPerDay) * time.Hour,
-		return
+	)
 	}
 	deleted, err := reapExpired(db, cutoff)
 	if err != nil {
@@ -203,37 +215,6 @@ func (r *RetentionReaper) reapWebhook(
 	}
 }
 // retentionCutoff returns the timestamp before which a webhook's
 // events have expired, and whether any cutoff applies at all. It
 // reports false for a retain-forever policy, so no DELETE is issued.
 //
 // The day count is clamped to MaxFiniteRetentionDays first. This is
 // defense in depth rather than decoration: a time.Duration is an int64
 // nanosecond count, so an unclamped multiplication overflows above
 // that ceiling and wraps the span negative. Subtracting a negative
 // span moves the cutoff into the far future, where it matches every
 // row in the database: the sweep then deletes every event, delivery,
 // and delivery result, including ones created seconds ago. Rejecting
 // out-of-range input at the form is the primary guard; saturating here
 // means an old row, a migration, or a future call site cannot turn a
 // too-large retention into total data loss.
 func retentionCutoff(
 	now time.Time,
 	retentionDays int,
 ) (time.Time, bool) {
 	if retainsForever(retentionDays) {
 		return time.Time{}, false
 	}
 	if retentionDays > MaxFiniteRetentionDays {
 		retentionDays = MaxFiniteRetentionDays
 	}
 	return now.Add(
 		-time.Duration(retentionDays*hoursPerDay) * time.Hour,
 	), true
 }
 // reapExpired hard-deletes, in foreign-key-safe order, the delivery
 // results, deliveries, and events associated with events older than
 // cutoff. Deletes are unscoped so rows are physically removed rather
--- a/internal/database/retention_lifecycle_test.go
+++ b/internal/database/retention_lifecycle_test.go
@@ -0,0 +1,209 @@
 package database_test
 import (
 	"context"
 	"testing"
 	"time"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"go.uber.org/fx"
 	"gorm.io/gorm"
 	"sneak.berlin/go/webhooker/internal/database"
 )
 const (
 	// reaperTestInterval is the sweep interval a lifecycle test
 	// runs the reaper at, so a loop that survives startup produces
 	// an observable sweep quickly.
 	reaperTestInterval = 10 * time.Millisecond
 	// reaperStopTimeout bounds how long a lifecycle test waits for
 	// the reaper's OnStop hook to return before declaring the
 	// shutdown hung.
 	reaperStopTimeout = 10 * time.Second
 	// reaperTestRetentionDays is the retention policy the lifecycle
 	// tests give their webhook.
 	reaperTestRetentionDays = 30
 )
 // recordingLifecycle is a minimal fx.Lifecycle that records the
 // hooks a component registers, so a test can invoke the real
 // OnStart/OnStop functions with a context of its choosing.
 type recordingLifecycle struct {
 	hooks []fx.Hook
 }
 func (l *recordingLifecycle) Append(h fx.Hook) {
 	l.hooks = append(l.hooks, h)
 }
 // startReaperViaHook drives the genuine fx hooks the application
 // registers for the reaper, handing OnStart a context that is
 // already done. It returns the recorded lifecycle so the caller
 // can drive OnStop too.
 func startReaperViaHook(
 	t *testing.T, r *database.RetentionReaper,
 ) *recordingLifecycle {
 	t.Helper()
 	lc := &recordingLifecycle{}
 	r.ExportRegisterHooks(lc)
 	require.Len(t, lc.hooks, 1)
 	// fx hands OnStart a context carrying the application start
 	// timeout, and cancels it when the start phase ends. An
 	// already-cancelled context is that same defect taken to its
 	// limit, and unlike a plain context.Background() it actually
 	// distinguishes a correctly rooted loop from a broken one.
 	hookCtx, cancel := context.WithCancel(context.Background())
 	cancel()
 	require.NoError(t, lc.hooks[0].OnStart(hookCtx))
 	return lc
 }
 // eventGone reports whether an event row has been removed. It
 // takes no *testing.T because it is polled from an
 // assert.Eventually condition, which runs off the test goroutine
 // where testify assertions must not be used.
 func eventGone(db *gorm.DB, eventID string) bool {
 	var n int64
 	err := db.Unscoped().Model(&database.Event{}).
 		Where("id = ?", eventID).Count(&n).Error
 	if err != nil {
 		return false
 	}
 	return n == 0
 }
 // seedExpiredWebhook creates a webhook with a finite retention
 // policy plus one long-expired event chain, and returns the
 // webhook's database and the chain's event ID.
 func seedExpiredWebhook(
 	t *testing.T, env *retentionTestEnv,
 ) (*gorm.DB, string) {
 	t.Helper()
 	webhookID := createWebhook(
 		t, env.mainDB.DB(), reaperTestRetentionDays,
 	)
 	db, err := env.mgr.GetDB(webhookID)
 	require.NoError(t, err)
 	chain := seedEventChain(
 		t, db, webhookID,
 		time.Now().Add(-365*24*time.Hour),
 	)
 	return db, chain.eventID
 }
 // TestRetentionReaper_LoopOutlivesStartHookContext is the
 // regression test for a reaper that never reaped. fx calls
 // OnStart with a context carrying the application's start timeout
 // (15s by default) and cancels it when the start phase ends, so a
 // sweep loop rooted in it is dead three quarters of an hour
 // before its first tick under the default one-hour interval, and
 // per-webhook event databases grow without bound exactly as they
 // did before retention existed.
 //
 // Driving OnStart with an already-cancelled context is that
 // defect taken to its limit: a loop that inherits the hook
 // context never ticks once, while a correctly rooted loop keeps
 // sweeping for as long as the process lives.
 func TestRetentionReaper_LoopOutlivesStartHookContext(
 	t *testing.T,
 ) {
 	t.Parallel()
 	env := setupRetentionTest(t)
 	db, eventID := seedExpiredWebhook(t, env)
 	env.reaper.ExportSetInterval(reaperTestInterval)
 	lc := startReaperViaHook(t, env.reaper)
 	t.Cleanup(func() {
 		_ = lc.hooks[0].OnStop(context.Background())
 	})
 	assert.Eventually(
 		t,
 		func() bool { return eventGone(db, eventID) },
 		5*time.Second,
 		reaperTestInterval,
 		"the sweep loop must keep running after the start "+
 			"hook's context is done; it reaped nothing, so it "+
 			"inherited the hook context and died",
 	)
 }
 // TestRetentionReaper_StopHookStopsLoop proves the fix did not
 // trade a startup bug for a shutdown hang: now that the sweep
 // loop no longer observes the start hook's cancellation, OnStop
 // is the only thing that can stop it, and it must both return
 // promptly and actually leave the loop stopped.
 func TestRetentionReaper_StopHookStopsLoop(t *testing.T) {
 	t.Parallel()
 	env := setupRetentionTest(t)
 	db, eventID := seedExpiredWebhook(t, env)
 	env.reaper.ExportSetInterval(reaperTestInterval)
 	lc := startReaperViaHook(t, env.reaper)
 	// Let the loop prove it is running before stopping it, so a
 	// fast OnStop cannot pass by stopping something already dead.
 	require.Eventually(
 		t,
 		func() bool { return eventGone(db, eventID) },
 		5*time.Second,
 		reaperTestInterval,
 	)
 	var stopErr error
 	stopped := make(chan struct{})
 	go func() {
 		defer close(stopped)
 		// stop blocks on the loop's WaitGroup, so returning at all
 		// proves the goroutine observed the cancellation.
 		stopErr = lc.hooks[0].OnStop(context.Background())
 	}()
 	select {
 	case <-stopped:
 	case <-time.After(reaperStopTimeout):
 		t.Fatal(
 			"OnStop did not return: the retention reaper's " +
 				"WaitGroup is still waiting on a loop that never " +
 				"observed cancellation",
 		)
 	}
 	require.NoError(t, stopErr)
 	// With the loop gone, a newly expired chain must survive.
 	survivor := seedEventChain(
 		t, db, "stopped-webhook",
 		time.Now().Add(-365*24*time.Hour),
 	)
 	time.Sleep(20 * reaperTestInterval)
 	assert.False(
 		t,
 		eventGone(db, survivor.eventID),
 		"a stopped reaper must not sweep anything",
 	)
 }
--- a/internal/database/retention_test.go
+++ b/internal/database/retention_test.go
@@ -77,7 +77,7 @@ func createWebhook(
 	wh := &database.Webhook{
 		UserID:        uuid.New().String(),
-		Name:          testWebhookName,
+		Name:          "test-webhook",
 		RetentionDays: retentionDays,
 	}
 	require.NoError(
@@ -85,11 +85,10 @@ func createWebhook(
 		db.Omit(clause.Associations).Create(wh).Error,
 	)
-	// Webhook.BeforeSave rewrites a non-positive RetentionDays to the
+	// The RetentionDays column carries a GORM default of 30, so a
-	// retain-forever sentinel, and the column's GORM default would
+	// zero (or negative) value passed to Create is replaced by that
-	// otherwise substitute 30. Force the requested value with a
+	// default. Force the requested value explicitly so the
-	// column-level update so tests can plant legacy rows that predate
+	// retain-forever (<= 0) path can be exercised.
 	// the sentinel and still carry a literal 0 or negative value.
 	require.NoError(
 		t,
 		db.Model(wh).
@@ -99,30 +98,6 @@ func createWebhook(
 	return wh.ID
 }
 // createWebhookNormally inserts a webhook through the ordinary Create
 // path, with no column-level forcing, so Webhook.BeforeSave applies
 // exactly as it does in production. Passing 0 therefore yields a row
 // holding the RetentionForeverDays sentinel.
 func createWebhookNormally(
 	t *testing.T,
 	db *gorm.DB,
 	retentionDays int,
 ) string {
 	t.Helper()
 	wh := &database.Webhook{
 		UserID:        uuid.New().String(),
 		Name:          testWebhookName,
 		RetentionDays: retentionDays,
 	}
 	require.NoError(
 		t,
 		db.Omit(clause.Associations).Create(wh).Error,
 	)
 	return wh.ID
 }
 // eventChain is the set of row IDs seeded for a single event.
 type eventChain struct {
 	eventID    string
@@ -281,111 +256,12 @@ func TestRetentionReaper_ReapsExpiredKeepsRecent(t *testing.T) {
 	assertChainPresent(t, db, recent)
 }
 // TestRetentionReaper_SkipsSentinelReapsFiniteInSameSweep covers the
 // end-to-end retain-forever path: a webhook created the normal way with
 // a requested retention of 0 lands on the RetentionForeverDays
 // sentinel, and the reaper leaves its ancient events alone while still
 // reaping a finite-retention webhook in the very same sweep.
 func TestRetentionReaper_SkipsSentinelReapsFiniteInSameSweep(
 	t *testing.T,
 ) {
 	t.Parallel()
 	env := setupRetentionTest(t)
 	foreverID := createWebhookNormally(t, env.mainDB.DB(), 0)
 	var stored database.Webhook
 	require.NoError(
 		t,
 		env.mainDB.DB().Where("id = ?", foreverID).
 			First(&stored).Error,
 	)
 	require.Equal(
 		t,
 		database.RetentionForeverDays,
 		stored.RetentionDays,
 		"a requested retention of 0 must persist as the sentinel",
 	)
 	finiteID := createWebhookNormally(t, env.mainDB.DB(), 30)
 	foreverDB, err := env.mgr.GetDB(foreverID)
 	require.NoError(t, err)
 	finiteDB, err := env.mgr.GetDB(finiteID)
 	require.NoError(t, err)
 	ancient := time.Now().Add(-365 * 24 * time.Hour)
 	kept := seedEventChain(t, foreverDB, foreverID, ancient)
 	doomed := seedEventChain(t, finiteDB, finiteID, ancient)
 	env.reaper.ExportSweep(context.Background())
 	assertChainPresent(t, foreverDB, kept)
 	assertChainGone(t, finiteDB, doomed)
 }
 // TestRetentionReaper_HugeFiniteRetentionRetainsRecentEvents pins the
 // overflow that made a large finite retention destroy everything.
 //
 // The cutoff is a time.Duration, an int64 nanosecond count. A day
 // count above MaxFiniteRetentionDays multiplied out unclamped wraps
 // negative, so subtracting it moves the cutoff into the far future,
 // where "created_at < cutoff" matches every row: an event created a
 // moment ago, and its delivery and delivery result, were all deleted
 // on the first sweep. 200000 is inside that band and below the
 // retain-forever sentinel, so it is treated as a finite policy and
 // really does reach the arithmetic.
 //
 // The row is planted at the column level because such a value can no
 // longer be submitted through the form; the point of the test is that
 // a row from an older version, or a future call site, still cannot
 // trigger the wipe.
 func TestRetentionReaper_HugeFiniteRetentionRetainsRecentEvents(
 	t *testing.T,
 ) {
 	t.Parallel()
 	env := setupRetentionTest(t)
 	const overflowingRetentionDays = 200000
 	require.Greater(
 		t,
 		overflowingRetentionDays,
 		database.MaxFiniteRetentionDays,
 		"the test value must exceed what the cutoff can represent",
 	)
 	require.Less(
 		t,
 		overflowingRetentionDays,
 		database.RetentionForeverDays,
 		"the test value must not be rescued by the forever skip",
 	)
 	webhookID := createWebhook(
 		t, env.mainDB.DB(), overflowingRetentionDays,
 	)
 	db, err := env.mgr.GetDB(webhookID)
 	require.NoError(t, err)
 	fresh := seedEventChain(t, db, webhookID, time.Now())
 	env.reaper.ExportSweep(context.Background())
 	assertChainPresent(t, db, fresh)
 }
 func TestRetentionReaper_RetainsForeverWhenNonPositive(t *testing.T) {
 	t.Parallel()
 	env := setupRetentionTest(t)
-	// A legacy row written before the sentinel existed still carries a
+	// RetentionDays of zero means retain forever.
 	// literal 0; the <= 0 guard must keep honouring it.
 	webhookID := createWebhook(t, env.mainDB.DB(), 0)
 	db, err := env.mgr.GetDB(webhookID)
--- a/internal/delivery/engine.go
+++ b/internal/delivery/engine.go
@@ -149,18 +149,7 @@ func New(
 		Transport: NewSSRFSafeTransport(),
 	})
-	lc.Append(fx.Hook{
+	e.registerHooks(lc)
 		OnStart: func(ctx context.Context) error {
 			e.start(ctx)
 			return nil
 		},
 		OnStop: func(_ context.Context) error {
 			e.stop()
 			return nil
 		},
 	})
 	return e
 }
@@ -210,8 +199,40 @@ func (e *Engine) ScheduleRetry(
 	})
 }
-func (e *Engine) start(ctx context.Context) {
+// registerHooks wires the engine's start and stop into the fx
-	ctx, cancel := context.WithCancel(ctx)
+// lifecycle. The start hook's context is deliberately ignored:
 // see start for why the worker pool must not inherit it.
 func (e *Engine) registerHooks(lc fx.Lifecycle) {
 	lc.Append(fx.Hook{
 		//nolint:contextcheck // Not inheriting the hook context
 		// is the point: see start.
 		OnStart: func(_ context.Context) error {
 			e.start()
 			return nil
 		},
 		OnStop: func(_ context.Context) error {
 			e.stop()
 			return nil
 		},
 	})
 }
 // start launches the worker pool, restart recovery, and the
 // periodic retry sweep.
 //
 // Their context is derived from context.Background(), NOT from
 // the fx OnStart hook context. The hook context carries fx's
 // start timeout (15s by default) and is cancelled once the start
 // phase completes, so goroutines derived from it stop a few
 // seconds into the process: every worker would return and the
 // engine would silently stop delivering webhooks entirely. A
 // long-lived goroutine must outlive the startup phase, so its
 // lifetime is bounded by OnStop instead: stop cancels this
 // context and waits on the WaitGroup.
 func (e *Engine) start() {
 	ctx, cancel := context.WithCancel(context.Background())
 	e.cancel = cancel
 	for range e.workers {
--- a/internal/delivery/engine_integration_test.go
+++ b/internal/delivery/engine_integration_test.go
@@ -476,7 +476,7 @@ func TestWorkerLifecycle_StartStop(t *testing.T) {
 	t.Parallel()
 	s := newISetup(t)
-	s.Engine.ExportStart(context.Background())
+	s.Engine.ExportStart()
 	event := iSeedEvent(
 		t, s.WebhookDB, s.WebhookID,
@@ -499,21 +499,17 @@ func TestWorkerLifecycle_StartStop(t *testing.T) {
 	s.Engine.Notify([]delivery.Task{task})
-	iWaitForStatus(
+	iWaitForDelivered(t, s.WebhookDB, d.ID)
 		t, s.WebhookDB, d.ID,
 		database.DeliveryStatusDelivered,
 	)
 	s.Engine.ExportStop()
 }
-// iWaitForStatus polls until the delivery reaches the
+// iWaitForDelivered polls until the delivery reaches the
-// expected status.
+// delivered status.
-func iWaitForStatus(
+func iWaitForDelivered(
 	t *testing.T,
 	db *gorm.DB,
 	deliveryID string,
 	expected database.DeliveryStatus,
 ) {
 	t.Helper()
@@ -527,7 +523,7 @@ func iWaitForStatus(
 			return false
 		}
-		return d.Status == expected
+		return d.Status == database.DeliveryStatusDelivered
 	}, 5*time.Second, 50*time.Millisecond)
 }
@@ -558,7 +554,7 @@ func TestWorkerLifecycle_ProcessesRetryChannel(
 		database.DeliveryStatusRetrying,
 	)
-	s.Engine.ExportStart(context.Background())
+	s.Engine.ExportStart()
 	bodyStr := event.Body
 	cfg := iHTTPConfig(ts.URL)
@@ -569,10 +565,7 @@ func TestWorkerLifecycle_ProcessesRetryChannel(
 	s.Engine.ExportRetryCh() <- task
-	iWaitForStatus(
+	iWaitForDelivered(t, s.WebhookDB, d.ID)
 		t, s.WebhookDB, d.ID,
 		database.DeliveryStatusDelivered,
 	)
 	s.Engine.ExportStop()
 }
--- a/internal/delivery/engine_lifecycle_test.go
+++ b/internal/delivery/engine_lifecycle_test.go
@@ -0,0 +1,199 @@
 package delivery_test
 import (
 	"context"
 	"testing"
 	"time"
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/require"
 	"go.uber.org/fx"
 	"sneak.berlin/go/webhooker/internal/database"
 	"sneak.berlin/go/webhooker/internal/delivery"
 )
 const (
 	// hookStopTimeout bounds how long a lifecycle test waits for
 	// the engine's OnStop hook to return before declaring the
 	// shutdown hung.
 	hookStopTimeout = 10 * time.Second
 	// hookSettleDelay is how long startEngineViaHook waits after
 	// OnStart before the caller may enqueue work. A worker pool
 	// wrongly rooted in the already-done hook context has nothing
 	// but ctx.Done() ready in its select, so it is deterministically
 	// gone by the end of this window. Without the wait, Notify would
 	// race the pool's very first select, in which a ready ctx.Done()
 	// and a ready deliveryCh are chosen between at random and a
 	// doomed pool still delivers.
 	hookSettleDelay = 250 * time.Millisecond
 )
 // recordingLifecycle is a minimal fx.Lifecycle that records the
 // hooks a component registers, so a test can invoke the real
 // OnStart/OnStop functions with a context of its choosing.
 type recordingLifecycle struct {
 	hooks []fx.Hook
 }
 func (l *recordingLifecycle) Append(h fx.Hook) {
 	l.hooks = append(l.hooks, h)
 }
 // startEngineViaHook drives the genuine fx hooks the application
 // registers for the engine, handing OnStart a context that is
 // already done, and returns only once a pool that inherited that
 // context would have exited. It returns the recorded lifecycle so
 // the caller can drive OnStop too.
 //
 // Callers must not seed pending or retrying deliveries before
 // calling this: restart recovery enqueues those during startup,
 // which would put work in the queue while the pool is still
 // racing its first select.
 func startEngineViaHook(
 	t *testing.T, eng *delivery.Engine,
 ) *recordingLifecycle {
 	t.Helper()
 	lc := &recordingLifecycle{}
 	eng.ExportRegisterHooks(lc)
 	require.Len(t, lc.hooks, 1)
 	// fx hands OnStart a context carrying the application start
 	// timeout, and cancels it when the start phase ends. An
 	// already-cancelled context is that same defect taken to its
 	// limit, and unlike a plain context.Background() it actually
 	// distinguishes a correctly rooted loop from a broken one.
 	hookCtx, cancel := context.WithCancel(context.Background())
 	cancel()
 	require.NoError(t, lc.hooks[0].OnStart(hookCtx))
 	time.Sleep(hookSettleDelay)
 	return lc
 }
 // seedLogTask seeds a pending delivery for a log target and
 // returns its ID together with the task that drives it. The log
 // target needs no network, so a delivery completing proves only
 // that a worker picked the task up.
 func seedLogTask(
 	t *testing.T, s iSetup,
 ) (string, delivery.Task) {
 	t.Helper()
 	event := iSeedEvent(
 		t, s.WebhookDB, s.WebhookID,
 		`{"lifecycle":"hook-context"}`,
 	)
 	targetID := uuid.New().String()
 	d := iSeedDelivery(
 		t, s.WebhookDB, event.ID, targetID,
 		database.DeliveryStatusPending,
 	)
 	bodyStr := event.Body
 	task := iTask(
 		d, event, s.WebhookID, targetID,
 		"hook-context-test", "", 0, 1, &bodyStr,
 	)
 	task.TargetType = database.TargetTypeLog
 	return d.ID, task
 }
 // TestEngine_WorkersOutliveStartHookContext is the regression
 // test for a delivery engine that stopped delivering roughly
 // fifteen seconds after boot. fx calls OnStart with a context
 // carrying the application's start timeout (15s by default) and
 // cancels it when the start phase ends, so a worker pool rooted
 // in it exits shortly after startup: the process keeps accepting
 // and persisting events while nothing at all forwards them.
 //
 // Driving OnStart with an already-cancelled context is that
 // defect taken to its limit. A pool that inherits the hook
 // context is gone before the task is even enqueued; a correctly
 // rooted pool keeps working for as long as the process lives.
 func TestEngine_WorkersOutliveStartHookContext(t *testing.T) {
 	t.Parallel()
 	s := newISetup(t)
 	lc := startEngineViaHook(t, s.Engine)
 	t.Cleanup(func() {
 		_ = lc.hooks[0].OnStop(context.Background())
 	})
 	// Seeded only after the pool has settled, so restart recovery
 	// cannot enqueue it during startup.
 	deliveryID, task := seedLogTask(t, s)
 	s.Engine.Notify([]delivery.Task{task})
 	iWaitForDelivered(t, s.WebhookDB, deliveryID)
 }
 // TestEngine_StopHookStopsWorkers proves the fix did not trade a
 // startup bug for a shutdown hang: now that the worker pool no
 // longer observes the start hook's cancellation, OnStop is the
 // only thing that can stop it, and it must both return promptly
 // and actually leave the pool drained.
 func TestEngine_StopHookStopsWorkers(t *testing.T) {
 	t.Parallel()
 	s := newISetup(t)
 	lc := startEngineViaHook(t, s.Engine)
 	// Let the pool prove it is running before stopping it, so a
 	// fast OnStop cannot pass by stopping something already dead.
 	firstID, firstTask := seedLogTask(t, s)
 	s.Engine.Notify([]delivery.Task{firstTask})
 	iWaitForDelivered(t, s.WebhookDB, firstID)
 	var stopErr error
 	stopped := make(chan struct{})
 	go func() {
 		defer close(stopped)
 		// stop blocks on the workers' WaitGroup, so returning at
 		// all proves every goroutine observed the cancellation.
 		stopErr = lc.hooks[0].OnStop(context.Background())
 	}()
 	select {
 	case <-stopped:
 	case <-time.After(hookStopTimeout):
 		t.Fatal(
 			"OnStop did not return: the delivery engine's " +
 				"WaitGroup is still waiting on a goroutine that " +
 				"never observed cancellation",
 		)
 	}
 	require.NoError(t, stopErr)
 	// With every worker gone, a freshly notified task must sit
 	// untouched in the queue rather than being delivered.
 	secondID, secondTask := seedLogTask(t, s)
 	s.Engine.Notify([]delivery.Task{secondTask})
 	time.Sleep(200 * time.Millisecond)
 	var after database.Delivery
 	require.NoError(
 		t,
 		s.WebhookDB.First(&after, "id = ?", secondID).Error,
 	)
 	require.Equal(
 		t,
 		database.DeliveryStatusPending,
 		after.Status,
 		"a stopped engine must not deliver anything",
 	)
 }
--- a/internal/delivery/export_test.go
+++ b/internal/delivery/export_test.go
@@ -7,6 +7,7 @@ import (
 	"net/http"
 	"time"
 	"go.uber.org/fx"
 	"gorm.io/gorm"
 	"sneak.berlin/go/webhooker/internal/database"
 )
@@ -189,8 +190,16 @@ func (e *Engine) ExportRecoverInFlight(
 }
 // ExportStart exposes start for testing.
-func (e *Engine) ExportStart(ctx context.Context) {
+func (e *Engine) ExportStart() {
-	e.start(ctx)
+	e.start()
 }
 // ExportRegisterHooks registers the engine's real fx lifecycle
 // hooks on a lifecycle supplied by a test, so a test can drive
 // the exact OnStart/OnStop functions the application runs and
 // hand OnStart the kind of context fx actually supplies.
 func (e *Engine) ExportRegisterHooks(lc fx.Lifecycle) {
 	e.registerHooks(lc)
 }
 // ExportStop exposes stop for testing.
--- a/internal/handlers/handlers.go
+++ b/internal/handlers/handlers.go
@@ -26,6 +26,8 @@ const (
 	maxBodyShift = 20
 	// recentEventLimit is the number of recent events to show.
 	recentEventLimit = 20
 	// defaultRetentionDays is the default event retention period.
 	defaultRetentionDays = 30
 	// paginationPerPage is the number of items per page.
 	paginationPerPage = 25
--- a/internal/handlers/source_management.go
+++ b/internal/handlers/source_management.go
@@ -25,73 +25,6 @@ type WebhookListItem struct {
 // errMissingURL signals that a required URL was not provided.
 var errMissingURL = errors.New("missing URL")
 // errInvalidRetention signals a retention_days form value that is not
 // a non-negative whole number.
 var errInvalidRetention = errors.New("invalid retention days")
 // errRetentionTooLarge signals a retention_days form value that is a
 // whole number but larger than the reaper's cutoff arithmetic can
 // represent. It is distinguished from errInvalidRetention so the form
 // can tell the user the actual ceiling instead of implying their input
 // was not a number.
 var errRetentionTooLarge = errors.New("retention days out of range")
 // retentionErrorMessage returns the message the create and edit forms
 // show the user for a rejected retention_days value. Any error other
 // than errRetentionTooLarge falls back to the generic wording, so an
 // unrecognised parse failure still produces a sensible 400 rather than
 // an empty alert.
 func retentionErrorMessage(err error) string {
 	if errors.Is(err, errRetentionTooLarge) {
 		return "Retention must be at most " +
 			strconv.Itoa(database.MaxFiniteRetentionDays) +
 			" days, or 0 to retain events forever."
 	}
 	return "Retention must be a whole number of days, or 0 to " +
 		"retain events forever."
 }
 // parseRetentionDays interprets a retention_days form value.
 //
 // An empty value yields fallback, which lets the create path apply the
 // default and the edit path leave the stored value unchanged. A value
 // of 0 is returned as 0 and is rewritten to the retain-forever
 // sentinel by database.Webhook's BeforeSave hook. Anything unparseable
 // or negative is an error rather than a silently substituted default.
 //
 // The upper bound is not cosmetic. The reaper computes its cutoff as a
 // time.Duration, an int64 nanosecond count, so a day count above
 // database.MaxFiniteRetentionDays overflows, puts the cutoff in the
 // future, and deletes every event the webhook has. A finite value
 // above that ceiling is therefore a 400.
 //
 // A value at or above the retain-forever sentinel is not out of range:
 // it is what the edit form pre-fills for a retain-forever webhook, so
 // submitting the form back unchanged has to keep meaning "forever"
 // rather than being rejected.
 func parseRetentionDays(raw string, fallback int) (int, error) {
 	raw = strings.TrimSpace(raw)
 	if raw == "" {
 		return fallback, nil
 	}
 	v, err := strconv.Atoi(raw)
 	if err != nil || v < 0 {
 		return 0, errInvalidRetention
 	}
 	if v >= database.RetentionForeverDays {
 		return database.RetentionForeverDays, nil
 	}
 	if v > database.MaxFiniteRetentionDays {
 		return 0, errRetentionTooLarge
 	}
 	return v, nil
 }
 // EventWithDeliveries holds an event and its deliveries.
 type EventWithDeliveries struct {
 	database.Event
@@ -173,30 +106,11 @@ func (h *Handlers) buildWebhookListItems(
 // HandleSourceCreate shows the form to create a new webhook.
 func (h *Handlers) HandleSourceCreate() http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		h.renderTemplate(
+		data := map[string]any{
-			w, r, "sources_new.html",
+			tmplKeyError: "",
 			newSourceFormData("", "", ""),
 		)
 		}
 }
-// newSourceFormData builds the template data for the webhook creation
+		h.renderTemplate(w, r, "sources_new.html", data)
 // form.
 //
 // It carries the retention default so the pre-filled value comes from
 // database.DefaultRetentionDays rather than being a third hardcoded
 // copy of the same policy, and it carries the submitted name and
 // description so that re-rendering the form after a validation failure
 // gives the user their input back instead of a blank form. The edit
 // form already behaves that way; create now matches it.
 func newSourceFormData(
 	errMsg, name, description string,
 ) map[string]any {
 	return map[string]any{
 		tmplKeyError:           errMsg,
 		"Name":                 name,
 		"Description":          description,
 		"DefaultRetentionDays": database.DefaultRetentionDays,
 	}
 }
@@ -231,31 +145,23 @@ func (h *Handlers) HandleSourceCreateSubmit() http.HandlerFunc {
 		retentionStr := r.FormValue("retention_days")
 		if name == "" {
 			data := map[string]any{
 				tmplKeyError: "Name is required",
 			}
 			w.WriteHeader(http.StatusBadRequest)
-			h.renderTemplate(
+			h.renderTemplate(w, r, "sources_new.html", data)
 				w, r, "sources_new.html",
 				newSourceFormData(
 					"Name is required", name, description,
 				),
 			)
 			return
 		}
-		retentionDays, retErr := parseRetentionDays(
+		retentionDays := defaultRetentionDays
 			retentionStr, database.DefaultRetentionDays,
 		)
 		if retErr != nil {
 			w.WriteHeader(http.StatusBadRequest)
 			h.renderTemplate(
 				w, r, "sources_new.html",
 				newSourceFormData(
 					retentionErrorMessage(retErr),
 					name, description,
 				),
 			)
-			return
+		if retentionStr != "" {
 			v, convErr := strconv.Atoi(retentionStr)
 			if convErr == nil && v > 0 {
 				retentionDays = v
 			}
 		}
 		h.createWebhookWithEntrypoint(
@@ -409,10 +315,8 @@ func (h *Handlers) renderSourceDetail(
 		scheme = fwdProto
 	}
 	// The template calls Webhook methods, which take pointer
 	// receivers; html/template cannot address a value stored in a map.
 	data := map[string]any{
-		tmplKeyWebhook: &webhook,
+		tmplKeyWebhook: webhook,
 		"Entrypoints":  entrypoints,
 		"Targets":      targets,
 		"Events":       events,
@@ -448,7 +352,7 @@ func (h *Handlers) HandleSourceEdit() http.HandlerFunc {
 		}
 		data := map[string]any{
-			tmplKeyWebhook: &webhook,
+			tmplKeyWebhook: webhook,
 			tmplKeyError:   "",
 		}
@@ -512,7 +416,7 @@ func (h *Handlers) applyWebhookEdit(
 	name := r.FormValue("name")
 	if name == "" {
 		data := map[string]any{
-			tmplKeyWebhook: webhook,
+			tmplKeyWebhook: *webhook,
 			tmplKeyError:   "Name is required",
 		}
@@ -524,25 +428,7 @@ func (h *Handlers) applyWebhookEdit(
 	webhook.Name = name
 	webhook.Description = r.FormValue("description")
-
+	h.parseRetention(r, webhook)
 	// An empty field falls back to the stored value, so submitting the
 	// form without touching retention leaves the policy alone.
 	retentionDays, retErr := parseRetentionDays(
 		r.FormValue("retention_days"), webhook.RetentionDays,
 	)
 	if retErr != nil {
 		data := map[string]any{
 			tmplKeyWebhook: webhook,
 			tmplKeyError:   retentionErrorMessage(retErr),
 		}
 		w.WriteHeader(http.StatusBadRequest)
 		h.renderTemplate(w, r, "source_edit.html", data)
 		return
 	}
 	webhook.RetentionDays = retentionDays
 	err := h.db.DB().Save(webhook).Error
 	if err != nil {
@@ -556,6 +442,23 @@ func (h *Handlers) applyWebhookEdit(
 	)
 }
 // parseRetention parses and applies retention_days from the
 // form.
 func (h *Handlers) parseRetention(
 	r *http.Request,
 	webhook *database.Webhook,
 ) {
 	retStr := r.FormValue("retention_days")
 	if retStr == "" {
 		return
 	}
 	v, err := strconv.Atoi(retStr)
 	if err == nil && v > 0 {
 		webhook.RetentionDays = v
 	}
 }
 // HandleSourceDelete handles webhook deletion.
 func (h *Handlers) HandleSourceDelete() http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
@@ -687,7 +590,7 @@ func (h *Handlers) HandleSourceLogs() http.HandlerFunc {
 		}
 		data := map[string]any{
-			tmplKeyWebhook: &webhook,
+			tmplKeyWebhook: webhook,
 			"Events":       evts,
 			"Page":         page,
 			"TotalPages":   totalPages,
--- a/internal/handlers/source_management_test.go
+++ b/internal/handlers/source_management_test.go
@@ -1,581 +0,0 @@
 package handlers_test
 import (
 	"context"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
 	"strconv"
 	"strings"
 	"testing"
 	"github.com/go-chi/chi"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"gorm.io/gorm/clause"
 	"sneak.berlin/go/webhooker/internal/database"
 	"sneak.berlin/go/webhooker/internal/handlers"
 	"sneak.berlin/go/webhooker/internal/session"
 )
 const (
 	// sourceTestUserID is the session user id used by the webhook
 	// management tests.
 	sourceTestUserID = "source-test-user"
 	// sourceIDParam is the chi URL parameter naming a webhook.
 	sourceIDParam = "sourceID"
 )
 // formRequest builds an urlencoded POST to path carrying the given
 // cookies, plus any chi URL parameters the handler reads.
 func formRequest(
 	path string,
 	cookies []*http.Cookie,
 	form url.Values,
 	urlParams map[string]string,
 ) *http.Request {
 	req := httptest.NewRequestWithContext(
 		context.Background(),
 		http.MethodPost,
 		path,
 		strings.NewReader(form.Encode()),
 	)
 	req.Header.Set(
 		"Content-Type", "application/x-www-form-urlencoded",
 	)
 	for _, c := range cookies {
 		req.AddCookie(c)
 	}
 	rctx := chi.NewRouteContext()
 	for k, v := range urlParams {
 		rctx.URLParams.Add(k, v)
 	}
 	return req.WithContext(
 		context.WithValue(req.Context(), chi.RouteCtxKey, rctx),
 	)
 }
 // getRequest builds a GET to path carrying the given cookies, plus any
 // chi URL parameters the handler reads.
 func getRequest(
 	t *testing.T,
 	path string,
 	cookies []*http.Cookie,
 	urlParams map[string]string,
 ) *http.Request {
 	t.Helper()
 	req := httptest.NewRequestWithContext(
 		context.Background(), http.MethodGet, path, nil,
 	)
 	for _, c := range cookies {
 		req.AddCookie(c)
 	}
 	rctx := chi.NewRouteContext()
 	for k, v := range urlParams {
 		rctx.URLParams.Add(k, v)
 	}
 	return req.WithContext(
 		context.WithValue(req.Context(), chi.RouteCtxKey, rctx),
 	)
 }
 // submitCreate posts the webhook creation form with the given
 // retention_days value (omitted entirely when retention is nil) and
 // returns the recorder.
 func submitCreate(
 	t *testing.T,
 	h *handlers.Handlers,
 	cookies []*http.Cookie,
 	name string,
 	retention *string,
 ) *httptest.ResponseRecorder {
 	t.Helper()
 	form := url.Values{}
 	form.Set("name", name)
 	if retention != nil {
 		form.Set("retention_days", *retention)
 	}
 	req := formRequest("/sources/new", cookies, form, nil)
 	w := httptest.NewRecorder()
 	h.HandleSourceCreateSubmit().ServeHTTP(w, req)
 	return w
 }
 // onlyWebhook loads the single webhook belonging to the test user.
 func onlyWebhook(
 	t *testing.T,
 	db *database.Database,
 ) database.Webhook {
 	t.Helper()
 	var webhooks []database.Webhook
 	require.NoError(
 		t,
 		db.DB().Where("user_id = ?", sourceTestUserID).
 			Find(&webhooks).Error,
 	)
 	require.Len(t, webhooks, 1)
 	return webhooks[0]
 }
 // seedWebhook inserts a webhook owned by the test user with an exact
 // stored retention value, bypassing Webhook.BeforeSave via a
 // column-level update so that legacy rows can be planted too.
 func seedWebhook(
 	t *testing.T,
 	db *database.Database,
 	retentionDays int,
 ) database.Webhook {
 	t.Helper()
 	wh := &database.Webhook{
 		UserID:        sourceTestUserID,
 		Name:          "seeded",
 		RetentionDays: retentionDays,
 	}
 	require.NoError(
 		t,
 		db.DB().Omit(clause.Associations).Create(wh).Error,
 	)
 	require.NoError(
 		t,
 		db.DB().Model(wh).
 			Update("retention_days", retentionDays).Error,
 	)
 	wh.RetentionDays = retentionDays
 	return *wh
 }
 // storedRetentionDays reads the retention_days column for a webhook.
 func storedRetentionDays(
 	t *testing.T,
 	db *database.Database,
 	id string,
 ) int {
 	t.Helper()
 	var got int
 	require.NoError(
 		t,
 		db.DB().Model(&database.Webhook{}).
 			Where("id = ?", id).
 			Pluck("retention_days", &got).Error,
 	)
 	return got
 }
 // sourceTestEnv bundles the handler, session, and database a webhook
 // management test drives.
 type sourceTestEnv struct {
 	handlers *handlers.Handlers
 	db       *database.Database
 	cookies  []*http.Cookie
 }
 func setupSourceTest(t *testing.T) *sourceTestEnv {
 	t.Helper()
 	var h *handlers.Handlers
 	var sess *session.Session
 	var db *database.Database
 	app := newTestApp(t, &h, &sess, &db)
 	app.RequireStart()
 	t.Cleanup(app.RequireStop)
 	return &sourceTestEnv{
 		handlers: h,
 		db:       db,
 		cookies: authenticatedCookies(
 			t, sess, sourceTestUserID, "sourceuser",
 		),
 	}
 }
 // TestHandleSourceCreateSubmit_ZeroRetentionPersistsForever is the core
 // regression test for the bug: the create form's 0 must reach the
 // database as the retain-forever sentinel rather than being replaced by
 // the column's default of 30.
 func TestHandleSourceCreateSubmit_ZeroRetentionPersistsForever(
 	t *testing.T,
 ) {
 	t.Parallel()
 	env := setupSourceTest(t)
 	zero := "0"
 	w := submitCreate(t, env.handlers, env.cookies, "forever", &zero)
 	require.Equal(t, http.StatusSeeOther, w.Code)
 	wh := onlyWebhook(t, env.db)
 	assert.Equal(
 		t,
 		database.RetentionForeverDays,
 		storedRetentionDays(t, env.db, wh.ID),
 	)
 	assert.True(t, wh.RetainsForever())
 }
 func TestHandleSourceCreateSubmit_OmittedRetentionUsesDefault(
 	t *testing.T,
 ) {
 	t.Parallel()
 	env := setupSourceTest(t)
 	w := submitCreate(t, env.handlers, env.cookies, "defaulted", nil)
 	require.Equal(t, http.StatusSeeOther, w.Code)
 	wh := onlyWebhook(t, env.db)
 	assert.Equal(
 		t,
 		database.DefaultRetentionDays,
 		storedRetentionDays(t, env.db, wh.ID),
 	)
 }
 // TestHandleSourceCreate_PrefillsDefaultFromConstant keeps the create
 // form's pre-filled retention from becoming a third hardcoded copy of
 // the 30-day policy.
 func TestHandleSourceCreate_PrefillsDefaultFromConstant(t *testing.T) {
 	t.Parallel()
 	env := setupSourceTest(t)
 	w := httptest.NewRecorder()
 	env.handlers.HandleSourceCreate().ServeHTTP(
 		w, getRequest(t, "/sources/new", env.cookies, nil),
 	)
 	require.Equal(t, http.StatusOK, w.Code)
 	body := w.Body.String()
 	assert.Contains(
 		t, body,
 		`value="`+strconv.Itoa(database.DefaultRetentionDays)+`"`,
 	)
 	assert.NotContains(
 		t, body, `max="365"`,
 		"a max below the sentinel would block retain-forever",
 	)
 	assert.Contains(t, body, `min="0"`)
 }
 func TestHandleSourceCreateSubmit_InvalidRetentionIsRejected(
 	t *testing.T,
 ) {
 	t.Parallel()
 	for _, raw := range []string{"abc", "-1", "3.5"} {
 		t.Run(raw, func(t *testing.T) {
 			t.Parallel()
 			env := setupSourceTest(t)
 			w := submitCreate(
 				t, env.handlers, env.cookies, "bad", &raw,
 			)
 			assert.Equal(t, http.StatusBadRequest, w.Code)
 			assert.Contains(
 				t, w.Body.String(), "Retention must be",
 			)
 			var count int64
 			require.NoError(
 				t,
 				env.db.DB().Model(&database.Webhook{}).
 					Where("user_id = ?", sourceTestUserID).
 					Count(&count).Error,
 			)
 			assert.Zero(
 				t, count,
 				"no webhook may be created from a rejected form",
 			)
 		})
 	}
 }
 // TestHandleSourceCreateSubmit_OverflowingRetentionIsRejected covers
 // the data-loss path directly: a finite retention above the largest one
 // the reaper's cutoff arithmetic can represent must never reach the
 // database, because the sweep would compute a future cutoff and delete
 // every event the webhook has.
 func TestHandleSourceCreateSubmit_OverflowingRetentionIsRejected(
 	t *testing.T,
 ) {
 	t.Parallel()
 	tooBig := strconv.Itoa(database.MaxFiniteRetentionDays + 1)
 	env := setupSourceTest(t)
 	w := submitCreate(t, env.handlers, env.cookies, "huge", &tooBig)
 	assert.Equal(t, http.StatusBadRequest, w.Code)
 	assert.Contains(
 		t, w.Body.String(),
 		strconv.Itoa(database.MaxFiniteRetentionDays),
 		"the form tells the user the actual ceiling",
 	)
 	var count int64
 	require.NoError(
 		t,
 		env.db.DB().Model(&database.Webhook{}).
 			Where("user_id = ?", sourceTestUserID).
 			Count(&count).Error,
 	)
 	assert.Zero(
 		t, count,
 		"no webhook may be created from a rejected form",
 	)
 }
 // TestHandleSourceCreateSubmit_SentinelIsAcceptedAsForever guards the
 // boundary between "too large to represent" and "retain forever": the
 // sentinel is above MaxFiniteRetentionDays, but it is the value the
 // edit form pre-fills, so it must be accepted rather than rejected as
 // out of range.
 func TestHandleSourceCreateSubmit_SentinelIsAcceptedAsForever(
 	t *testing.T,
 ) {
 	t.Parallel()
 	env := setupSourceTest(t)
 	sentinel := strconv.Itoa(database.RetentionForeverDays)
 	w := submitCreate(t, env.handlers, env.cookies, "forever", &sentinel)
 	require.Equal(t, http.StatusSeeOther, w.Code)
 	wh := onlyWebhook(t, env.db)
 	assert.Equal(
 		t,
 		database.RetentionForeverDays,
 		storedRetentionDays(t, env.db, wh.ID),
 	)
 }
 // TestHandleSourceCreateSubmit_RejectedFormKeepsUserInput checks that a
 // validation failure hands the user's typing back, matching what the
 // edit form already does. Losing a long description to a mistyped
 // retention value is the kind of thing that makes people give up on a
 // form.
 func TestHandleSourceCreateSubmit_RejectedFormKeepsUserInput(
 	t *testing.T,
 ) {
 	t.Parallel()
 	env := setupSourceTest(t)
 	const (
 		name        = "kept-name"
 		description = "a description worth not losing"
 	)
 	form := url.Values{}
 	form.Set("name", name)
 	form.Set("description", description)
 	form.Set("retention_days", "nonsense")
 	req := formRequest("/sources/new", env.cookies, form, nil)
 	w := httptest.NewRecorder()
 	env.handlers.HandleSourceCreateSubmit().ServeHTTP(w, req)
 	require.Equal(t, http.StatusBadRequest, w.Code)
 	body := w.Body.String()
 	assert.Contains(t, body, `value="`+name+`"`)
 	assert.Contains(t, body, description)
 }
 // submitEdit posts the webhook edit form for the given webhook.
 func submitEdit(
 	t *testing.T,
 	env *sourceTestEnv,
 	wh database.Webhook,
 	retention string,
 ) *httptest.ResponseRecorder {
 	t.Helper()
 	form := url.Values{}
 	form.Set("name", wh.Name)
 	form.Set("description", wh.Description)
 	form.Set("retention_days", retention)
 	req := formRequest(
 		"/source/"+wh.ID+"/edit",
 		env.cookies,
 		form,
 		map[string]string{sourceIDParam: wh.ID},
 	)
 	w := httptest.NewRecorder()
 	env.handlers.HandleSourceEditSubmit().ServeHTTP(w, req)
 	return w
 }
 func TestHandleSourceEditSubmit_ZeroRetentionPersistsForever(
 	t *testing.T,
 ) {
 	t.Parallel()
 	env := setupSourceTest(t)
 	wh := seedWebhook(t, env.db, database.DefaultRetentionDays)
 	w := submitEdit(t, env, wh, "0")
 	require.Equal(t, http.StatusSeeOther, w.Code)
 	assert.Equal(
 		t,
 		database.RetentionForeverDays,
 		storedRetentionDays(t, env.db, wh.ID),
 	)
 }
 func TestHandleSourceEditSubmit_InvalidRetentionIsRejected(
 	t *testing.T,
 ) {
 	t.Parallel()
 	env := setupSourceTest(t)
 	wh := seedWebhook(t, env.db, database.DefaultRetentionDays)
 	w := submitEdit(t, env, wh, "not-a-number")
 	assert.Equal(t, http.StatusBadRequest, w.Code)
 	assert.Contains(t, w.Body.String(), "Retention must be")
 	assert.Equal(
 		t,
 		database.DefaultRetentionDays,
 		storedRetentionDays(t, env.db, wh.ID),
 		"a rejected form must not change the stored retention",
 	)
 }
 func TestHandleSourceEditSubmit_EmptyRetentionLeavesValueUnchanged(
 	t *testing.T,
 ) {
 	t.Parallel()
 	env := setupSourceTest(t)
 	wh := seedWebhook(t, env.db, 7)
 	w := submitEdit(t, env, wh, "")
 	require.Equal(t, http.StatusSeeOther, w.Code)
 	assert.Equal(t, 7, storedRetentionDays(t, env.db, wh.ID))
 }
 // TestSourceEditForm_ForeverWebhookRoundTrips walks the exact path that
 // the removed max="365" cap used to break: render the edit form for a
 // retain-forever webhook, confirm the pre-filled sentinel is not capped
 // by browser validation, then submit that pre-filled value straight
 // back and confirm the retention policy survives untouched.
 func TestSourceEditForm_ForeverWebhookRoundTrips(t *testing.T) {
 	t.Parallel()
 	env := setupSourceTest(t)
 	wh := seedWebhook(t, env.db, database.RetentionForeverDays)
 	req := getRequest(
 		t, "/source/"+wh.ID+"/edit", env.cookies,
 		map[string]string{sourceIDParam: wh.ID},
 	)
 	w := httptest.NewRecorder()
 	env.handlers.HandleSourceEdit().ServeHTTP(w, req)
 	require.Equal(t, http.StatusOK, w.Code)
 	sentinel := strconv.Itoa(database.RetentionForeverDays)
 	body := w.Body.String()
 	assert.Contains(
 		t, body, `value="`+sentinel+`"`,
 		"the edit form pre-fills the stored retention",
 	)
 	assert.NotContains(
 		t, body, `max="365"`,
 		"a max below the sentinel would block saving any edit",
 	)
 	// "Currently forever." is the rendered RetentionLabel, not the
 	// static hint below the input, which says "Enter 0 to retain events
 	// forever." A bare Contains of "forever" would pass for any
 	// webhook and would assert nothing about this one.
 	assert.Contains(
 		t, body, "Currently forever.",
 		"the form reports this webhook's policy as forever",
 	)
 	// Submit the pre-filled value back, exactly as a browser would.
 	post := submitEdit(t, env, wh, sentinel)
 	require.Equal(t, http.StatusSeeOther, post.Code)
 	assert.Equal(
 		t,
 		database.RetentionForeverDays,
 		storedRetentionDays(t, env.db, wh.ID),
 	)
 }
 // TestSourceListAndDetail_ShowForeverNotTheSentinelNumber checks that
 // the retain-forever value is never rendered to the user as a raw day
 // count on either read-only view.
 func TestSourceListAndDetail_ShowForeverNotTheSentinelNumber(
 	t *testing.T,
 ) {
 	t.Parallel()
 	env := setupSourceTest(t)
 	wh := seedWebhook(t, env.db, database.RetentionForeverDays)
 	sentinel := strconv.Itoa(database.RetentionForeverDays)
 	listW := httptest.NewRecorder()
 	env.handlers.HandleSourceList().ServeHTTP(
 		listW, getRequest(t, "/sources", env.cookies, nil),
 	)
 	require.Equal(t, http.StatusOK, listW.Code)
 	assert.Contains(t, listW.Body.String(), "Retention: forever")
 	assert.NotContains(t, listW.Body.String(), sentinel)
 	detailW := httptest.NewRecorder()
 	env.handlers.HandleSourceDetail().ServeHTTP(
 		detailW,
 		getRequest(
 			t, "/source/"+wh.ID, env.cookies,
 			map[string]string{sourceIDParam: wh.ID},
 		),
 	)
 	require.Equal(t, http.StatusOK, detailW.Code)
 	assert.Contains(t, detailW.Body.String(), "Retention: forever")
 	assert.NotContains(t, detailW.Body.String(), sentinel)
 }
--- a/templates/source_detail.html
+++ b/templates/source_detail.html
@@ -181,7 +181,7 @@
    <!-- Info -->
    <div class="mt-4 text-sm text-gray-400">
-        <p>Retention: {{.Webhook.RetentionLabel}} &middot; Created: {{.Webhook.CreatedAt.Format "2006-01-02 15:04:05 UTC"}}</p>
+        <p>Retention: {{.Webhook.RetentionDays}} days &middot; Created: {{.Webhook.CreatedAt.Format "2006-01-02 15:04:05 UTC"}}</p>
    </div>
 </div>
 {{end}}
--- a/templates/source_edit.html
+++ b/templates/source_edit.html
@@ -28,8 +28,7 @@
            <div class="form-group">
                <label for="retention_days" class="label">Retention (days)</label>
-                <input type="number" id="retention_days" name="retention_days" value="{{.Webhook.RetentionDays}}" min="0" class="input">
+                <input type="number" id="retention_days" name="retention_days" value="{{.Webhook.RetentionDays}}" min="1" max="365" class="input">
                <p class="text-xs text-gray-500 mt-1">Currently {{.Webhook.RetentionLabel}}. Enter 0 to retain events forever.</p>
            </div>
            <div class="flex gap-3">
--- a/templates/sources_list.html
+++ b/templates/sources_list.html
@@ -25,7 +25,7 @@
                    <p class="text-sm text-gray-500 mt-1">{{.Description}}</p>
                    {{end}}
                </div>
-                <span class="badge-info">Retention: {{.RetentionLabel}}</span>
+                <span class="badge-info">{{.RetentionDays}}d retention</span>
            </div>
            <div class="flex gap-6 mt-4 text-sm text-gray-500">
                <span>{{.EntrypointCount}} entrypoint{{if ne .EntrypointCount 1}}s{{end}}</span>
--- a/templates/sources_new.html
+++ b/templates/sources_new.html
@@ -18,18 +18,18 @@
            <input type="hidden" name="csrf_token" value="{{.CSRFToken}}">
            <div class="form-group">
                <label for="name" class="label">Name</label>
-                <input type="text" id="name" name="name" value="{{.Name}}" required autofocus placeholder="My Webhook" class="input">
+                <input type="text" id="name" name="name" required autofocus placeholder="My Webhook" class="input">
            </div>
            <div class="form-group">
                <label for="description" class="label">Description</label>
-                <textarea id="description" name="description" rows="3" placeholder="Optional description" class="input">{{.Description}}</textarea>
+                <textarea id="description" name="description" rows="3" placeholder="Optional description" class="input"></textarea>
            </div>
            <div class="form-group">
                <label for="retention_days" class="label">Retention (days)</label>
-                <input type="number" id="retention_days" name="retention_days" value="{{.DefaultRetentionDays}}" min="0" class="input">
+                <input type="number" id="retention_days" name="retention_days" value="30" min="1" max="365" class="input">
-                <p class="text-xs text-gray-500 mt-1">How long to keep event data. Enter 0 to retain events forever.</p>
+                <p class="text-xs text-gray-500 mt-1">How long to keep event data.</p>
            </div>
            <div class="flex gap-3">