ecore: the gaps the third adoption pass found
Five services adopted the new packages today and each hit the same edges.
bearer.IsRefusal: a service's resolver returns more than this package's
vocabulary — the Postgres lookup it had to make, an expired context, a bug —
and StatusFor's default answers those 401, which tells a caller to re-mint a
token that was never the problem. Every service that wrapped the table spelled
out the sentinel list to guard the delegation; now it does not have to.
instconf.Key.Because: three services kept their own hand-written config
checker rather than lose the sentence that says WHY a key is required
("crypto.InitCrypto exits without it"). Require reported the names and nothing
an operator could act on, so nobody used it.
logging.DefaultsWithoutDebugFlag: a migration CLI passes -d to brant, where it
means --dialect and takes a value, so `coversrht-migrate -d postgres` arrived
as a request for debug logging — silently, because the probe sees the flag and
never the value.
assets.DirFS: os.DirFS("") does not mean "no assets", it means "serve the
filesystem root", and it is one unset config key away. dolt wrote the guard;
the other five would each have to see it happen first.
pages.APIMessage: the REST half of every service keeps its 404 body
byte-identical on purpose, so it could not adopt the shared refusal installer,
whose messages are page sentences. The same table now answers in both
registers.
middleware: report panics through slog
The two log.Printf lines were the last stdlib log in ecore, and they printed
a formatted sentence where every service on the instance now emits structured
records — a panic report that cannot be filtered by path or grouped by route
is the one log line an operator most wants to query.
Through slog's default logger rather than one handed to RecoverPanics: a
library has no business choosing a handler. The service installs scribe's at
startup with SetDefault, and these land in the same stream, with the same
masking, as its own lines.