[alexeygrigorev]

Root cause

/sponsor-docs/:id imports sponsor-doc-guest-schedule.js and sponsor-doc-event-time.js (added in 6e73ba0), but the anonymous asset allowlist did not include them. Anonymous visitors got a 302 to /login for those modules, so the ES module graph failed, the page script never ran, and the header stayed on "Checking access…". This affected every doc served by this page (sponsor, podcast, guest, webinar, workshop).

Changes

• Allowlist the two missing modules.
• Shared guarded-fetch helper: 20s timeout, visible "what failed + what to do" message, and a report to a new anonymous, throttled POST /api/client-errors that writes a structured client_check_failed ERROR log line (query strings stripped, fixed fields only).
• Inline fallback in each standalone page: if the page script never starts within 10s, show an error and report it.
• Applied to sponsor-doc, contract-sign, newsletter-preview and document-review pages.
• Found and fixed two more breakages on the contract signing page: a syntax error (fetch(/work, {) and core/html.js missing from its allowlist.
• Regression tests walk each page's import graph against its anonymous allowlist and syntax-check every module.