ecore: the gaps the third adoption pass found

Five services adopted the new packages today and each hit the same edges.

bearer.IsRefusal: a service's resolver returns more than this package's
vocabulary — the Postgres lookup it had to make, an expired context, a bug —
and StatusFor's default answers those 401, which tells a caller to re-mint a
token that was never the problem. Every service that wrapped the table spelled
out the sentinel list to guard the delegation; now it does not have to.

instconf.Key.Because: three services kept their own hand-written config
checker rather than lose the sentence that says WHY a key is required
("crypto.InitCrypto exits without it"). Require reported the names and nothing
an operator could act on, so nobody used it.

logging.DefaultsWithoutDebugFlag: a migration CLI passes -d to brant, where it
means --dialect and takes a value, so `coversrht-migrate -d postgres` arrived
as a request for debug logging — silently, because the probe sees the flag and
never the value.

assets.DirFS: os.DirFS("") does not mean "no assets", it means "serve the
filesystem root", and it is one unset config key away. dolt wrote the guard;
the other five would each have to see it happen first.

pages.APIMessage: the REST half of every service keeps its 404 body
byte-identical on purpose, so it could not adopt the shared refusal installer,
whose messages are page sentences. The same table now answers in both
registers.

bearer: mint the internal authorization through internalauth

This package assembled the header by hand — json.Marshal of an auth.InternalAuth
plus "Internal " and a fernet seal — two files away from the package whose whole
purpose is to hold both ends of that handshake. It is the same drift internalauth
was hoisted to end, sitting inside the library that hoisted it: a change to the
payload shape here would have gone unnoticed by every Guard on the instance until
a revocation check started failing.

README: the packages of the third uplift

chimw: the chi-shaped helpers of the custom services

GetHead registers a read route under GET and HEAD both, which cover, bench
and tokens had each spelled out — five copies of three lines, under three
names. RenderRefusals points chi's NotFound and MethodNotAllowed at the
service's own error page, which spec and dolt install neither of, so a
mistyped URL there is the one refusal on the instance that answers in
plain text. RequestLogger is a chi LogFormatter emitting slog records, in
place of chi's colourised stdlib line on stdout — the highest-volume line
a service writes and the only one that was neither structured nor on
stderr.

It is a second middleware package and not a wing of the first because
sr-ht-ecore/middleware needs nothing but net/http and that rule is worth
keeping; the boundary is whether the helper has to know what a route is.

A request line is Info, a 5xx is Error, and 499 stays Info by being below
500, which is what that code was chosen for. Skipping probe noise is the
caller's call, through a predicate. The logger goes outside RecoverPanics
so the line reports the error page that was rendered rather than the
nothing an unwinding stack has written.

internalauth: both ends of the Internal authorization

core-go implements this check unexported inside auth.Middleware, so a
service that wants the guard without the session resolution behind it
writes it again: dolt.sr.ht did, in web/handlers_internal.go, and the
caller minting the header for it is a different program in the same
repository (cmd/dolt-git-hook) that spells the payload out by hand.

Copies drifting is the smaller half. The two ends of one protocol shared
no type, no constant and no test, so a change to the payload shape, the
scheme or the expiry breaks nothing at build time and stops provisioning
at the next push. They are two functions over one struct here.

The check stays core-go's: source address inside [sr.ht]internal-ipnet
AND a fernet token sealed with [sr.ht]network-key, at most 30s old, both
required. Three deliberate departures. The caller may be pinned to a
client and node id, which upstream only checks are non-empty; a payload
that decrypts but is not an internal auth is a 403 rather than a panic,
as is a RemoteAddr that does not parse; and the refusals are sentinels,
so "not internal at all" is distinguishable from "internal but wrong
client" without parsing an error string.

login: the one decoder of the unified-login cookie

Six services decode sr.ht.unified-login.v1 independently, and each of them
makes the same five decisions: DecryptWithoutExpiration rather than a decrypt
with a service-side TTL, unmarshal into auth.AuthCookie, strip the leading '~',
treat every failure as anonymity rather than an error, and validate the name
before it reaches a path, a log line or a SQL parameter. Two of the six had
already dropped the last one.

The middleware is split into Optional and Required because that is where the
copies diverged: every donor folded its own gating policy into a single
middleware — never refuse (public clones), never 401 (visibility decided
downstream), always send the viewer to meta's login page — so one middleware
here would force most services to write the other half again.

ValidName ships as the default rather than being required: the grammar is
meta.sr.ht's and therefore instance-wide, and requiring a validator would put
the safe path behind an extra argument that the services validating nothing
today would go on not passing. WithValidator narrows it; a nil validator
restores the default, so "accept anything" has no spelling in the API.

Mirroring meta's profile into a service's own user row stays in each service:
that touches its own schema.

logging: the instance's slog policy, without the handler

middleware.RecoverPanics reports panics through slog's default logger, so
ecore already depends on every service installing a compatible handler and
had no way to say so. A service that forgets slog.SetDefault prints its
panic reports in Go's plain format, unlevelled and unmasked, into a journal
where everything else is tinted.

Six services (compare, spec, dolt, cover, bench, tokens) had each written
the same level parser, the same os.Stderr.Stat colour probe, the same -d
scan of os.Args, and their own copy of the credential mask list. The copies
had drifted into three key sets and four patterns: only spec masked the
config private keys, only tokens-migrate knew a DSN carries a password, and
only dolt masked pubkey and credential. What is redacted — the unified-login
cookie, tokens.sr.ht working tokens, the Authorization header they ride in —
is a fact about the instance, so it is maintained once.

Defaults() resolves the policy and Install() sets the default logger; the
handler stays with the caller, because ecore is a small SourceHut library
and auxilia is a large general one, and a service that wants a JSON handler
for a log shipper should not link a tinting one to share a mask list.
Options.ReplaceAttr applies the same masking through stdlib slog alone, so
the split costs a non-scribe service nothing. tokens.sr.ht's partial mask is
exported but not defaulted: six characters of a live working token is still
six characters of a live working token.

Level: -d, then $LOG_LEVEL, then [section]log-level, then info; an
unreadable value falls through to the next source rather than refusing to
boot.

instconf: one reading of the instance config origins

Five services and this library each grew a copy of the same three lines
that turn config.ini into an origin, and the copies drifted. Two donors
canonicalized with TrimRight and TrimSuffix respectively, so a config
carrying "https://x//" produced two different strings in two daemons
that must produce the same one when comparing against an Origin header.
One repo held two origin-to-host extractors that disagreed about a
malformed origin: one returned an error, the other answered "localhost".
A third copy feeds the DNS-rebinding guard of an MCP endpoint, where an
empty host disables the guard.

CanonicalOrigin takes the strict reading (TrimSpace, then every trailing
slash). ExternalOrigin and InternalOrigin are two names rather than one
GetOrigin with a bool, because a flipped flag is invisible until a
browser is redirected to an address only the daemon can reach.
OriginHost returns a host name and OriginAuthority a host[:port], the
two things the disagreeing donors each needed, and neither invents a
host for an origin that names none. InternalAPIOrigin walks the four-key
ladder and reports absence as a bool instead of core-go's panic, and
Require reports every missing key in one error so an operator fixes the
config in one pass rather than one restart per key.

bearer, pages: the refusal table and the form read that must not drift

bench wrote the bearer refusal switch three times in one repo — REST, MCP and
its resolver — and each copy re-decides the arm that matters: ErrUnavailable
is 503, never 401. Reading an unreachable token daemon as "revoked" tells
every CI job on the instance its credential is bad for as long as tokens.sr.ht
takes to restart. That warning has lived in this repo's README as prose, where
it cannot be imported; StatusFor puts it in code, and its default sends an
unrecognised failure to 401 so a forgotten arm refuses a request rather than
declaring the service unwell.

FormValues returns r.PostForm and never r.Form. r.Form merges the query string
into the body's values, so a mutation could be driven from a URL somebody was
linked to — the one request the same-origin guard cannot fault, because it did
come from our own page. The difference between the safe version and the hole
is one character in a field name, in a function every service with a form
writes for itself.

chrome: a default favicon, optional listing columns, and a table partial

Three services asked for a favicon field and bench argued against one: it
ships no icon deliberately, and its layout says why — a <link rel="icon">
pointing at an asset the binary does not have is a 404 on every page load, for
a file nobody asked for. A default that is a path hands that to every service
without a logo, so the default carries its own bytes instead: the brand's ring
as a data: URI, which cannot 404 and costs no request. It is a template.URL
because html/template rewrites any href whose scheme is not http, https or
mailto to "#ZgotmplZ" — the type is how a caller says it meant a data: URI.

Updated and Meta are optional for the reason the four listing services could
not agree: bench and spec have a modification time, dolt's schema has no
timestamp at all, and cover's index is a table of sparklines no shared partial
will render. A required column would have pushed dolt back onto a local copy.
Updated is a time.Time so the partial renders "3 hours ago" with the exact
stamp in the title once, rather than five services spelling it five ways.

srht-repo-table is a second partial over the same dot rather than a variadic
first one: growing columns on the cards would have made them worse cards for
the services that wanted cards.

Attach now installs Funcs itself, because the partials call reltime and
abstime and an unknown function is a parse error — a caller who had not merged
Funcs would have got a startup panic naming a template it never wrote. pages
consequently attaches before layering the service's own map on top, which is
what keeps a deliberate shadow working.

middleware: report panics through slog

The two log.Printf lines were the last stdlib log in ecore, and they printed
a formatted sentence where every service on the instance now emits structured
records — a panic report that cannot be filtered by path or grouped by route
is the one log line an operator most wants to query.

Through slog's default logger rather than one handed to RecoverPanics: a
library has no business choosing a handler. The service installs scribe's at
startup with SetDefault, and these land in the same stream, with the same
masking, as its own lines.

chrome: carry the service's extra hashed assets

bench and cover each grew a pair of UplotCSSHref/UplotJSHref fields beside
the embedded Page, compare a BundleHref, and all three wrote the same
justification next to it: the hash in the name is a property of the binary
rather than of a page, so a page handed its own asset URLs is one that can be
written without them and silently render nothing where the chart was. That
argument is about the chrome, so the slot belongs to the chrome.

A map rather than named fields because ecore has no business knowing that
this instance vendors uPlot; the service names its own artefacts and its
layout reads them back with index, guarded on emptiness the way StyleHref is.

README: the web-tier packages

pages: the shared page set, buffered render and error page

middleware: the shared cache and panic handling

ecoretest: the shared instance config and crypto bootstrap for tests

csrf: the shared same-origin guard

Five services carried their own copy of the Origin/Referer check and the
copies had drifted, not only in wording: tokens, cover and bench apply it
as router-wide middleware, while dolt and specs call a predicate from
individual handlers, so a form added to either of those goes out
unguarded. Require is therefore the API this package leads with, and
SameOrigin is the escape hatch for a service migrating one route at a
time.

assets: the shared hashed-asset discovery and cache policy

gitignore the in-repo git worktree directories

chrome: give the brand both halves, and share the login URL and time helpers

The brand was upstream's minus its hub link: core.sr.ht points the whole
brand at hub when the instance has one and drops the red service label,
while this package kept the label and pointed at the service root. Hub is
excluded from the switcher, so that left the chrome with no route to hub at
all. Split the brand in two — the site name to hub (to the service root on
an instance without one), the label to the service root — and neither half
has to lose. The label keeps its own <span class="text-danger"> because the
theme colours ".navbar-light .navbar-brand a", which outranks .text-danger
and would repaint a red <a> white in dark mode.

LoginURLFor exports the line Page already computed. A handler that gates a
page behind login was building an entire Page to read one field off it.

RelTime/AbsTime come up from the services, where the copies had already
drifted over what to print for a future instant: "in 3 hours" on one
service, "just now" on the next, for the same timestamp.