fix(docs): address PR review — robust version guard + bounded observer

- github.ts: require a 'vX' tag (reject empty/garbage so the badge can't render
  blank), and add a 5s fetch timeout to both build-time fetches so a hung
  connection falls back instead of stalling the build.
- Search.astro: bound the empty-state MutationObserver with a 10s timeout +
  dev-only warning, so it can't watch the whole body forever if Pagefind never
  mounts (dev) or selectors change upstream. Mark decorative icons aria-hidden.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: vishr

site/src/components/Search.astro

@@ -11,15 +11,15 @@ import Default from '@astrojs/starlight/components/Search.astro';
     <div class="echo-search-empty">
       <div class="ess-group">
         <div class="ess-label">Start here</div>
-        <a class="ess-link" href="/guide/quickstart/"><i class="ph ph-rocket-launch"></i> Quickstart <span class="ess-sec">Guide</span></a>
-        <a class="ess-link" href="/guide/routing/"><i class="ph ph-signpost"></i> Routing <span class="ess-sec">Guide</span></a>
-        <a class="ess-link" href="/guide/binding/"><i class="ph ph-brackets-curly"></i> Binding <span class="ess-sec">Guide</span></a>
+        <a class="ess-link" href="/guide/quickstart/"><i aria-hidden="true" class="ph ph-rocket-launch"></i> Quickstart <span class="ess-sec">Guide</span></a>
+        <a class="ess-link" href="/guide/routing/"><i aria-hidden="true" class="ph ph-signpost"></i> Routing <span class="ess-sec">Guide</span></a>
+        <a class="ess-link" href="/guide/binding/"><i aria-hidden="true" class="ph ph-brackets-curly"></i> Binding <span class="ess-sec">Guide</span></a>
       </div>
       <div class="ess-group">
         <div class="ess-label">Popular</div>
-        <a class="ess-link" href="/middleware/jwt/"><i class="ph ph-lock-key"></i> JWT <span class="ess-sec">Middleware</span></a>
-        <a class="ess-link" href="/middleware/cors/"><i class="ph ph-globe"></i> CORS <span class="ess-sec">Middleware</span></a>
-        <a class="ess-link" href="/cookbook/hello-world/"><i class="ph ph-cube"></i> Hello World <span class="ess-sec">Cookbook</span></a>
+        <a class="ess-link" href="/middleware/jwt/"><i aria-hidden="true" class="ph ph-lock-key"></i> JWT <span class="ess-sec">Middleware</span></a>
+        <a class="ess-link" href="/middleware/cors/"><i aria-hidden="true" class="ph ph-globe"></i> CORS <span class="ess-sec">Middleware</span></a>
+        <a class="ess-link" href="/cookbook/hello-world/"><i aria-hidden="true" class="ph ph-cube"></i> Hello World <span class="ess-sec">Cookbook</span></a>
       </div>
       <div class="ess-foot">
         <span><kbd>↵</kbd>open</span><span><kbd>↑</kbd><kbd>↓</kbd>navigate</span><span><kbd>esc</kbd>close</span>
@@ -39,5 +39,14 @@ import Default from '@astrojs/starlight/components/Search.astro';
   if (!inject()) {
     const obs = new MutationObserver(() => { if (inject()) obs.disconnect(); });
     obs.observe(document.body, { childList: true, subtree: true });
+    // Bound the observer: if Pagefind never mounts (disabled in dev, or the
+    // Starlight markup changed on upgrade), stop watching so it can't run for
+    // the page's lifetime. Losing the launchpad is harmless; search still works.
+    setTimeout(() => {
+      obs.disconnect();
+      if (import.meta.env.DEV && !document.querySelector('.echo-search-empty')) {
+        console.warn('[search] empty-state panel not injected — .pagefind-ui selectors may have changed');
+      }
+    }, 10000);
   }
 </script>

site/src/data/github.ts

@@ -15,7 +15,7 @@ async function fetchStars(): Promise<number> {
     const token = process.env.GITHUB_TOKEN;
     if (token) headers.Authorization = `Bearer ${token}`;
 
-    const res = await fetch(`https://api.github.com/repos/${REPO}`, { headers });
+    const res = await fetch(`https://api.github.com/repos/${REPO}`, { headers, signal: AbortSignal.timeout(5000) });
     if (!res.ok) throw new Error(`GitHub API responded ${res.status}`);
     const data = await res.json();
     return typeof data.stargazers_count === 'number' ? data.stargazers_count : FALLBACK_STARS;
@@ -36,10 +36,18 @@ const FALLBACK_VERSION = 'v5';
 // (avoids GitHub "latest release" occasionally pointing at a v4 patch).
 async function fetchLatestVersion(): Promise<string> {
   try {
-    const res = await fetch('https://proxy.golang.org/github.com/labstack/echo/v5/@latest');
+    const res = await fetch('https://proxy.golang.org/github.com/labstack/echo/v5/@latest', {
+      signal: AbortSignal.timeout(5000),
+    });
     if (!res.ok) throw new Error(`Go proxy responded ${res.status}`);
     const data = await res.json();
-    return typeof data.Version === 'string' ? data.Version : FALLBACK_VERSION;
+    const v = typeof data.Version === 'string' ? data.Version.trim() : '';
+    // Require a real "vX..." tag — an empty/garbage value would silently render a blank badge.
+    if (!/^v\d/.test(v)) {
+      console.warn(`[github] unexpected version ${JSON.stringify(data.Version)}; using fallback ${FALLBACK_VERSION}`);
+      return FALLBACK_VERSION;
+    }
+    return v;
   } catch (e) {
     console.warn(`[github] version fetch failed; using fallback ${FALLBACK_VERSION}:`, e);
     return FALLBACK_VERSION;