bearer, pages: the refusal table and the form read that must not drift bench wrote the bearer refusal switch three times in one repo — REST, MCP and its resolver — and each copy re-decides the arm that matters: ErrUnavailable is 503, never 401. Reading an unreachable token daemon as "revoked" tells every CI job on the instance its credential is bad for as long as tokens.sr.ht takes to restart. That warning has lived in this repo's README as prose, where it cannot be imported; StatusFor puts it in code, and its default sends an unrecognised failure to 401 so a forgotten arm refuses a request rather than declaring the service unwell. FormValues returns r.PostForm and never r.Form. r.Form merges the query string into the body's values, so a mutation could be driven from a URL somebody was linked to — the one request the same-origin guard cannot fault, because it did come from our own page. The difference between the safe version and the hole is one character in a field name, in a function every service with a form writes for itself.
chrome: a default favicon, optional listing columns, and a table partial Three services asked for a favicon field and bench argued against one: it ships no icon deliberately, and its layout says why — a <link rel="icon"> pointing at an asset the binary does not have is a 404 on every page load, for a file nobody asked for. A default that is a path hands that to every service without a logo, so the default carries its own bytes instead: the brand's ring as a data: URI, which cannot 404 and costs no request. It is a template.URL because html/template rewrites any href whose scheme is not http, https or mailto to "#ZgotmplZ" — the type is how a caller says it meant a data: URI. Updated and Meta are optional for the reason the four listing services could not agree: bench and spec have a modification time, dolt's schema has no timestamp at all, and cover's index is a table of sparklines no shared partial will render. A required column would have pushed dolt back onto a local copy. Updated is a time.Time so the partial renders "3 hours ago" with the exact stamp in the title once, rather than five services spelling it five ways. srht-repo-table is a second partial over the same dot rather than a variadic first one: growing columns on the cards would have made them worse cards for the services that wanted cards. Attach now installs Funcs itself, because the partials call reltime and abstime and an unknown function is a parse error — a caller who had not merged Funcs would have got a startup panic naming a template it never wrote. pages consequently attaches before layering the service's own map on top, which is what keeps a deliberate shadow working.
middleware: report panics through slog The two log.Printf lines were the last stdlib log in ecore, and they printed a formatted sentence where every service on the instance now emits structured records — a panic report that cannot be filtered by path or grouped by route is the one log line an operator most wants to query. Through slog's default logger rather than one handed to RecoverPanics: a library has no business choosing a handler. The service installs scribe's at startup with SetDefault, and these land in the same stream, with the same masking, as its own lines.
pages: the shared page set, buffered render and error page