One-line comments that say why, the host limiter moved out of ssrf.go into webhook.go, and tests for the branches that had none: database errors, jobs a sender cannot send, unreachable receivers, secrets that do not open, and how run routes permanent and Retry-After failures.