---
id: ac166f8e-1ace-4c92-adc3-573aae822ae2
title: raw policy differs between serve and _headers
state: closed
labels:
- ui
assignees: []
milestone: null
created: 2026-10-27T17:24:52.552802224Z
updated: 2026-10-27T17:45:41.808140838Z
---
## What

`serve` and Pages disagree on `/raw/*` text files:

- `serve`: text extensions → `text/plain; charset=utf-8`, `inline`
- `_headers` (`src/build.rs:1097`): every `/raw/*` gets `Content-Disposition: attachment`, so text downloads

## Impact

Same URL behaves differently across deployment shapes (the core single-shape goal). Not a security hole, but review/clone/download UX differs and the docs are ambiguous.

## Fix

Pick one policy. Recommended: **attachment for all raw files** on both (safer, simpler), or encode the exact text-vs-active policy in `_headers` per extension. Update the deploy wiki and tests so both paths agree.