v0.24.0 cli long and short options, http sink viewer and new logo

doc/todo.md

@@ -178,3 +178,40 @@ identity, and both skeletons download the tagged source.
 5. Shell completion for bash, zsh and fish, installed by `make install`.
 6. A packaging CI job: build the AUR package in an Arch container and the port
    in a FreeBSD VM, run `lw --version` and `make image-check`.
+
+## 3. Follow-ups
+
+Smaller items found along the way; each is independent of the ACL.
+
+1. Chain sinks at the end of a finite input. The `tcp_chain` sink's `Stop`
+   closes its loop without draining its queue, and the `http_chain` sink makes
+   one best-effort flush, so `seq 1 N | lw --preset edge,...` may lose the
+   tail. Verify with a finite stdin into each and an aggregator counting lines;
+   give both a bounded drain like `sink.FlushBound`.
+2. A late browser sees no backlog: the `http` sink keeps none, so the viewer
+   shows entries from when it connects. A bounded replay (a `replay_lines`
+   option, sent after `event: connected`) would fill it. The viewer also hides
+   a `503` from `max_connections` behind "retrying"; the status JSON it already
+   fetches could name it.
+3. Level detection. `source.ExtractLogLevel` needs a delimiter after the name
+   (`ERROR:`, `[WARN]`, ` INFO `), so `warning disk full` or `DBG x` get no
+   level, hence no color. Match the names as words, as the console sink's
+   painter does, with one table for both.
+4. Command line:
+   - a positional word at the top level (`lw tail`, `lw -t FILE`) still reaches
+     config with an unclear message; name it ("unexpected argument X; the file
+     is -c FILE");
+   - Go's flag errors keep single dashes ("flag needs an argument: -u");
+   - an unknown `--key` only warns and then runs the stdin pipe; consider an
+     error when stdin is a terminal;
+   - `lw tls cert --host` could become `--hosts` (keeping `--host`), to match
+     `tls.hosts` and the preset key;
+   - top-level usage errors exit 1, subcommand ones 2.
+5. `GET /favicon.ico` answers 404; the logo could serve as the icon once the
+   pages' CSP allows `img-src 'self'`.
+6. TLS: the generated-certificate key is one per process, so a pin taken from a
+   `self_signed` listener also matches an `issuer` listener of the same
+   process; document it or key per listener. Pins are checked in
+   `VerifyPeerCertificate`, which Go skips on resumption: guard it if a dialer
+   ever keeps a `ClientSessionCache`.
+7. `core.ShutdownTimeout` is unused.