Negotiation table (Sec-Fetch-Mode, X-Requested-With, Accept q values, the
32-range cap, /api, /_ and admin paths), byte equality with the
http.error_pages.enabled false router for curl, fetch, XHR and JSON
clients, page content and headers for every covered status, details
gating and escaping, renderer override and fallbacks, the admin prefix
and the uploads route.
A browser navigation (Sec-Fetch-Mode navigate, or GET/HEAD without it; no
X-Requested-With; Accept naming text/html above every JSON type; not /api,
/_<name> or the admin prefix) that hits a framework-generated 404, 405 or
500 gets a self-contained SummerCMS page: unmatched routes and wrong
methods at the ServeMux, failed Where/WhereIn constraints, overlap-family
misses, the unpublished uploads route and recovered panics. Every other
request keeps the exact stdlib text, wire's opaque JSON 500 or the bare
raw-group 500.
Details (method, path, X-Request-Id) only with app.debug or outside
production. Applications replace the page with a published
surf.ErrorPageRenderer; http.error_pages.enabled false turns it off.
