v0.26.2 http sink backlog for late streams, web updates

doc/todo.md

@@ -65,16 +65,11 @@ identity, and both skeletons download the tagged source.
 
 Smaller items found along the way, each independent of the others.
 
-1. A late browser sees no backlog: the `http` sink keeps none, so the viewer
-   shows entries from when it connects. A bounded replay (a `replay_lines`
-   option, sent after `event: connected`) would fill it. The viewer also hides
-   a `503` from `max_connections` behind "retrying"; the status JSON it already
-   fetches could name it.
-2. Level detection. `source.ExtractLogLevel` needs a delimiter after the name
+1. Level detection. `source.ExtractLogLevel` needs a delimiter after the name
    (`ERROR:`, `[WARN]`, ` INFO `), so `warning disk full` or `DBG x` get no
    level, hence no color. Match the names as words, as the console sink's
    painter does, with one table for both.
-3. Command line:
+2. Command line:
    - a positional word at the top level (`lw tail`, `lw -t FILE`) still reaches
      config with an unclear message; name it ("unexpected argument X; the file
      is -c FILE");
@@ -84,11 +79,9 @@ Smaller items found along the way, each independent of the others.
    - `lw tls cert --host` could become `--hosts` (keeping `--host`), to match
      `tls.hosts` and the preset key;
    - top-level usage errors exit 1, subcommand ones 2.
-4. `GET /favicon.ico` answers 404; the logo could serve as the icon once the
-   pages' CSP allows `img-src 'self'`.
-5. TLS: the generated-certificate key is one per process, so a pin taken from a
+3. TLS: the generated-certificate key is one per process, so a pin taken from a
    `self_signed` listener also matches an `issuer` listener of the same
    process; document it or key per listener. Pins are checked in
    `VerifyPeerCertificate`, which Go skips on resumption: guard it if a dialer
    ever keeps a `ClientSessionCache`.
-6. `core.ShutdownTimeout` is unused.
+4. `core.ShutdownTimeout` is unused.