diff --git a/cmd/mavweb/ecosystem.go b/cmd/mavweb/ecosystem.go
index 77a329c..1bb1439 100644
--- a/cmd/mavweb/ecosystem.go
+++ b/cmd/mavweb/ecosystem.go
@@ -117,8 +117,5 @@ func handleEcosystem(w http.ResponseWriter, r *http.Request, urls ecoURLs, core
 		d.Calls.Rows = rows
 	}
 
-	w.Header().Set("Content-Type", "text/html; charset=utf-8")
-	if err := ecosystemTmpl.Execute(w, d); err != nil {
-		log.Printf("ecosystem render: %v", err)
-	}
+	renderPage(w, ecosystemTmpl, d)
 }
diff --git a/cmd/mavweb/models.go b/cmd/mavweb/models.go
index ded6af1..2b38bcd 100644
--- a/cmd/mavweb/models.go
+++ b/cmd/mavweb/models.go
@@ -2,8 +2,8 @@ package main
 
 import (
 	"context"
+	_ "embed"
 	"errors"
-	"html/template"
 	"log"
 	"net/http"
 	"strconv"
@@ -31,43 +31,10 @@ type modelController interface {
 	SwapModel(ctx context.Context, req ipc.SwapModelReq) (ipc.SwapModelResp, error)
 }
 
-var modelsTmpl = template.Must(template.New("models").Funcs(shellFuncs()).Parse(shellHTML + modelsHTML))
+//go:embed models.html
+var modelsHTML string
 
-const modelsHTML = `{{template "shellTop" "models"}}
-<h1>Resident model</h1>
-<p class=hint>swapping requires step-up — <a href=/auth/passkey>assert a passkey</a> first. The old model is unloaded before the new one is loaded (one model fits the iGPU at a time), so turns during the load are refused and fall back to the classifier.</p>
-<p class=hint>a swap is not remembered. Nothing writes it down, so the next restart of the daemon — including the one <code>mavupdate</code> does — comes back on <code>phraser.model_path</code> from the config. Make it stick by editing that.</p>
-{{if .Msg}}<div class="msg msg-ok">{{.Msg}}</div>{{end}}
-{{if .Err}}<div class="msg msg-err">{{.Err}}</div>{{end}}
-{{if .Off}}
-<section class=card>
-<h2 class=card-title>swap not configured</h2>
-<p class=hint>this core has no <code>phraser.swap_models</code> allowlist, so there is nothing to swap to. Add the gguf paths you allow to <code>deploy/mavend.json</code> and restart once.</p>
-</section>
-{{else}}
-<section class=card>
-<h2 class=card-title>loaded now</h2>
-<div class=scroll><table>
-<tr><th>model</th><td><code>{{.Status.Model}}</code></td></tr>
-<tr><th>file</th><td><code>{{.Status.ModelPath}}</code></td></tr>
-<tr><th>server</th><td><code>{{.Status.BaseURL}}</code></td></tr>
-<tr><th>n_ctx</th><td>{{.Status.NCtx}}</td></tr>
-<tr><th>n_gpu_layers</th><td>{{.Status.NGpuLayers}}</td></tr>
-</table></div>
-<p class=hint>the model name is what llama-server reports for itself, not what the config says it should be.</p>
-</section>
-<section class=card>
-<h2 class=card-title>allowed models <span class=badge>{{len .Status.Swappable}}</span></h2>
-{{if .Status.Swappable}}<div class=scroll><table><tr><th>file</th><th></th></tr>
-{{range .Status.Swappable}}<tr><td><code>{{.}}</code></td>
-<td><form method=post action=/models class=inline-form>
-<input type=hidden name=model_path value="{{.}}">
-<button class=btn>load this one</button></form></td></tr>{{end}}
-</table></div>
-{{else}}<div class=empty><div>no models allowlisted</div></div>{{end}}
-</section>
-{{end}}
-{{template "shellBottom"}}`
+var modelsTmpl = parsePage("models", modelsHTML, nil)
 
 type modelsPage struct {
 	Msg    string
@@ -154,8 +121,5 @@ func handleModels(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, swap
 		}
 	}
 	page.Status = st
-	w.Header().Set("Content-Type", "text/html; charset=utf-8")
-	if err := modelsTmpl.Execute(w, page); err != nil {
-		log.Printf("models render: %v", err)
-	}
+	renderPage(w, modelsTmpl, page)
 }
diff --git a/cmd/mavweb/models.html b/cmd/mavweb/models.html
new file mode 100644
index 0000000..0990b54
--- /dev/null
+++ b/cmd/mavweb/models.html
@@ -0,0 +1,35 @@
+{{template "shellTop" "models"}}
+<h1>Resident model</h1>
+<p class=hint>swapping requires step-up — <a href=/auth/passkey>assert a passkey</a> first. The old model is unloaded before the new one is loaded (one model fits the iGPU at a time), so turns during the load are refused and fall back to the classifier.</p>
+<p class=hint>a swap is not remembered. Nothing writes it down, so the next restart of the daemon — including the one <code>mavupdate</code> does — comes back on <code>phraser.model_path</code> from the config. Make it stick by editing that.</p>
+{{if .Msg}}<div class="msg msg-ok">{{.Msg}}</div>{{end}}
+{{if .Err}}<div class="msg msg-err">{{.Err}}</div>{{end}}
+{{if .Off}}
+<section class=card>
+<h2 class=card-title>swap not configured</h2>
+<p class=hint>this core has no <code>phraser.swap_models</code> allowlist, so there is nothing to swap to. Add the gguf paths you allow to <code>deploy/mavend.json</code> and restart once.</p>
+</section>
+{{else}}
+<section class=card>
+<h2 class=card-title>loaded now</h2>
+<div class=scroll><table>
+<tr><th>model</th><td><code>{{.Status.Model}}</code></td></tr>
+<tr><th>file</th><td><code>{{.Status.ModelPath}}</code></td></tr>
+<tr><th>server</th><td><code>{{.Status.BaseURL}}</code></td></tr>
+<tr><th>n_ctx</th><td>{{.Status.NCtx}}</td></tr>
+<tr><th>n_gpu_layers</th><td>{{.Status.NGpuLayers}}</td></tr>
+</table></div>
+<p class=hint>the model name is what llama-server reports for itself, not what the config says it should be.</p>
+</section>
+<section class=card>
+<h2 class=card-title>allowed models <span class=badge>{{len .Status.Swappable}}</span></h2>
+{{if .Status.Swappable}}<div class=scroll><table><tr><th>file</th><th></th></tr>
+{{range .Status.Swappable}}<tr><td><code>{{.}}</code></td>
+<td><form method=post action=/models class=inline-form>
+<input type=hidden name=model_path value="{{.}}">
+<button class=btn>load this one</button></form></td></tr>{{end}}
+</table></div>
+{{else}}<div class=empty><div>no models allowlisted</div></div>{{end}}
+</section>
+{{end}}
+{{template "shellBottom"}}
diff --git a/cmd/mavweb/passkey.html b/cmd/mavweb/passkey.html
new file mode 100644
index 0000000..6ea67e0
--- /dev/null
+++ b/cmd/mavweb/passkey.html
@@ -0,0 +1,58 @@
+{{template "shellTop" "passkey"}}
+<h1>Passkey</h1>
+<p class=hint>Enroll a passkey once, then assert it to unlock destructive actions (tool enable) for a few minutes.</p>
+<div class=flex gap-2>
+<button class=btn onclick=enroll()>enroll passkey</button>
+<button class=btn onclick=assert()>assert (step-up)</button>
+<button class=btn onclick=rewrapKey()>rewrite cold-start key</button>
+<a href=/tools><button class=btn-primary>→ tools</button></a>
+</div>
+<p class=hint>Rewriting the cold-start key points it at the passkey you assert next. Every other enrolled passkey stops being able to unlock a cold-booted daemon.</p>
+<div id=msg></div>
+{{template "shellBottom"}}
+<script>
+const b64u=b=>btoa(String.fromCharCode(...new Uint8Array(b))).replace(/\+/g,'-').replace(/\//g,'_').replace(/=+$/,'');
+const ub64=s=>{s=s.replace(/-/g,'+').replace(/_/g,'/');const b=atob(s),a=new Uint8Array(b.length);for(let i=0;i<b.length;i++)a[i]=b.charCodeAt(i);return a;};
+const say=(t,ok)=>{const m=document.getElementById('msg');m.textContent=t;m.className=ok?'msg msg-ok':'msg msg-err';};
+async function enroll(){try{
+ const {challenge,options}=await (await fetch('/auth/webauthn/register/begin')).json();
+ options.challenge=ub64(options.challenge);
+ options.user.id=ub64(options.user.id);
+ const c=await navigator.credentials.create({publicKey:options});
+ const r=await fetch('/auth/webauthn/register/finish',{method:'POST',headers:{'content-type':'application/json'},
+  body:JSON.stringify({challenge,credential:{id:c.id,type:c.type,response:{
+   clientDataJSON:b64u(c.response.clientDataJSON),attestationObject:b64u(c.response.attestationObject)}}})});
+ if(!r.ok){say('enroll failed: '+await r.text(),false);return;}
+ // The wrapped key can only be written from an assertion: PRF results are
+ // not produced at create() time on most authenticators. Enrolment reports
+ // whether PRF is available at all so he is not told cold-start works when
+ // it cannot.
+ const ext=c.getClientExtensionResults?c.getClientExtensionResults():{};
+ const prfOK=!!(ext.prf&&ext.prf.enabled);
+ say(prfOK?'enrolled ✓ — now assert once to write the cold-start key':
+  'enrolled ✓ — but this authenticator has no PRF: cold-start unlock unavailable',true);
+}catch(e){say('enroll error: '+e,false);}}
+async function assert(explicit){try{
+ const {challenge,options}=await (await fetch('/auth/webauthn/assert/begin')).json();
+ options.challenge=ub64(options.challenge);
+ const c=await navigator.credentials.get({publicKey:options});
+ // The PRF result is the cold-start secret. It never touches localStorage
+ // and is posted once, over the same request as the assertion.
+ const ext=c.getClientExtensionResults?c.getClientExtensionResults():{};
+ const prf=ext.prf&&ext.prf.results&&ext.prf.results.first?b64u(ext.prf.results.first):'';
+ const r=await fetch('/auth/webauthn/assert/finish',{method:'POST',headers:{'content-type':'application/json'},
+  body:JSON.stringify({challenge,prf,explicit:!!explicit,credential:{id:c.id,type:c.type,response:{
+   clientDataJSON:b64u(c.response.clientDataJSON),authenticatorData:b64u(c.response.authenticatorData),
+   signature:b64u(c.response.signature)}}})});
+ if(!r.ok){say('assert failed: '+await r.text(),false);return;}
+ if(!prf){say('stepped up ✓ — no PRF from this authenticator, so cold-start unlock stayed unavailable',true);return;}
+ say(explicit?'stepped up ✓ — cold-start key now points at this passkey':
+  'stepped up ✓ — enable tools now',true);
+}catch(e){say('assert error: '+e,false);}}
+// Rewriting the wrapped key is a separate gesture, never a side effect of a
+// step-up. Only this button sets explicit, and only explicit lets the daemon
+// replace a blob that already exists.
+async function rewrapKey(){
+ if(!confirm('Rewrite the cold-start key under the passkey you are about to assert? Every other enrolled passkey stops being able to unlock a cold-booted daemon.'))return;
+ await assert(true);}
+</script>
diff --git a/cmd/mavweb/webauthn.go b/cmd/mavweb/webauthn.go
index 3312c7f..f1ef4a7 100644
--- a/cmd/mavweb/webauthn.go
+++ b/cmd/mavweb/webauthn.go
@@ -2,6 +2,7 @@ package main
 
 import (
 	"context"
+	_ "embed"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -76,72 +77,17 @@ func newPasskeyHandle(cfg webauthn.Config, core ipc.CoreAPI, storePath string, s
 // on: assert here (bumps the daemon session to L3 for the assertion TTL), then
 // enable a tool on /tools within that window.
 func (h *PasskeyHandle) Page(w http.ResponseWriter, r *http.Request) {
-	w.Header().Set("Content-Type", "text/html; charset=utf-8")
-	passkeyTmpl.Execute(w, nil)
+	renderPage(w, passkeyTmpl, nil)
 }
 
-var passkeyTmpl = parsePage("passkey", passkeyPageHTML, nil)
+// passkeyPageHTML — the enrolment page's own markup, wrapped by passkeyTmpl
+// with shellTop/shellBottom. It was a Go string constant, which is the one
+// place page markup still lived in Go.
+//
+//go:embed passkey.html
+var passkeyPageHTML string
 
-// passkeyPageHTML — rendered via passkeyTmpl, which wraps it with
-// shellTop/shellBottom.
-const passkeyPageHTML = `{{template "shellTop" "passkey"}}
-<h1>Passkey</h1>
-<p class=hint>Enroll a passkey once, then assert it to unlock destructive actions (tool enable) for a few minutes.</p>
-<div class=flex gap-2>
-<button class=btn onclick=enroll()>enroll passkey</button>
-<button class=btn onclick=assert()>assert (step-up)</button>
-<button class=btn onclick=rewrapKey()>rewrite cold-start key</button>
-<a href=/tools><button class=btn-primary>→ tools</button></a>
-</div>
-<p class=hint>Rewriting the cold-start key points it at the passkey you assert next. Every other enrolled passkey stops being able to unlock a cold-booted daemon.</p>
-<div id=msg></div>
-{{template "shellBottom"}}
-<script>
-const b64u=b=>btoa(String.fromCharCode(...new Uint8Array(b))).replace(/\+/g,'-').replace(/\//g,'_').replace(/=+$/,'');
-const ub64=s=>{s=s.replace(/-/g,'+').replace(/_/g,'/');const b=atob(s),a=new Uint8Array(b.length);for(let i=0;i<b.length;i++)a[i]=b.charCodeAt(i);return a;};
-const say=(t,ok)=>{const m=document.getElementById('msg');m.textContent=t;m.className=ok?'msg msg-ok':'msg msg-err';};
-async function enroll(){try{
- const {challenge,options}=await (await fetch('/auth/webauthn/register/begin')).json();
- options.challenge=ub64(options.challenge);
- options.user.id=ub64(options.user.id);
- const c=await navigator.credentials.create({publicKey:options});
- const r=await fetch('/auth/webauthn/register/finish',{method:'POST',headers:{'content-type':'application/json'},
-  body:JSON.stringify({challenge,credential:{id:c.id,type:c.type,response:{
-   clientDataJSON:b64u(c.response.clientDataJSON),attestationObject:b64u(c.response.attestationObject)}}})});
- if(!r.ok){say('enroll failed: '+await r.text(),false);return;}
- // The wrapped key can only be written from an assertion: PRF results are
- // not produced at create() time on most authenticators. Enrolment reports
- // whether PRF is available at all so he is not told cold-start works when
- // it cannot.
- const ext=c.getClientExtensionResults?c.getClientExtensionResults():{};
- const prfOK=!!(ext.prf&&ext.prf.enabled);
- say(prfOK?'enrolled ✓ — now assert once to write the cold-start key':
-  'enrolled ✓ — but this authenticator has no PRF: cold-start unlock unavailable',true);
-}catch(e){say('enroll error: '+e,false);}}
-async function assert(explicit){try{
- const {challenge,options}=await (await fetch('/auth/webauthn/assert/begin')).json();
- options.challenge=ub64(options.challenge);
- const c=await navigator.credentials.get({publicKey:options});
- // The PRF result is the cold-start secret. It never touches localStorage
- // and is posted once, over the same request as the assertion.
- const ext=c.getClientExtensionResults?c.getClientExtensionResults():{};
- const prf=ext.prf&&ext.prf.results&&ext.prf.results.first?b64u(ext.prf.results.first):'';
- const r=await fetch('/auth/webauthn/assert/finish',{method:'POST',headers:{'content-type':'application/json'},
-  body:JSON.stringify({challenge,prf,explicit:!!explicit,credential:{id:c.id,type:c.type,response:{
-   clientDataJSON:b64u(c.response.clientDataJSON),authenticatorData:b64u(c.response.authenticatorData),
-   signature:b64u(c.response.signature)}}})});
- if(!r.ok){say('assert failed: '+await r.text(),false);return;}
- if(!prf){say('stepped up ✓ — no PRF from this authenticator, so cold-start unlock stayed unavailable',true);return;}
- say(explicit?'stepped up ✓ — cold-start key now points at this passkey':
-  'stepped up ✓ — enable tools now',true);
-}catch(e){say('assert error: '+e,false);}}
-// Rewriting the wrapped key is a separate gesture, never a side effect of a
-// step-up. Only this button sets explicit, and only explicit lets the daemon
-// replace a blob that already exists.
-async function rewrapKey(){
- if(!confirm('Rewrite the cold-start key under the passkey you are about to assert? Every other enrolled passkey stops being able to unlock a cold-booted daemon.'))return;
- await assert(true);}
-</script>`
+var passkeyTmpl = parsePage("passkey", passkeyPageHTML, nil)
 
 func (h *PasskeyHandle) RegisterBegin(w http.ResponseWriter, r *http.Request) {
 	opts, challenge, err := h.rp.CreationOptions([]byte("maven-user"), "maven user")