diff --git a/patches/README.md b/patches/README.md
index 31393e06c9fb911f20d303b3c4a128e79aecb5cd..752e30ff29e4df957b03b6b8123863fdfcd46c82 100644
--- a/patches/README.md
+++ b/patches/README.md
@@ -35,6 +35,62 @@ ```
 
 If `git apply --check` fails after a `sourcehut-refresh`, upstream has changed that file — re-derive the patch against the new context and update the copy in `~/data/home/phoebe-lab/srht/patches/` first, then re-import here.
 
+### `core-nav-groups.patch`
+
+**Repo:** `core.sr.ht`  ·  **Files:** `srht/app/nav.py` (new), `srht/app/flask.py`, `srht/templates/nav.html`, `scss/nav.scss`, `scss/dark.scss`
+
+**Problem.** The service switcher — the strip of service names between the brand and the login box — is a flat row listing every `*.sr.ht` section in the config. That works at eight services and stops working at fourteen: on a laptop the tail slides under the login box, and every service the instance gains makes it worse. Two further defects underneath the overflow:
+
+- **The two halves disagree about order.** The strip is rendered twice: here in Jinja, and in Go by `sr-ht-ecore/chrome` for the instance's own services. Python sorts *stably* and gives every non-canonical service the same key, so they come out in config-file order; Go's ini parser is a `map[string]Section` and has thrown that order away before it sees the file, so it falls back to the alphabet. On the running config `go` is second in one half and seventh in the other.
+- **Nothing in the row says what anything is.** After the four canonical names it is just an alphabet, so a reader cannot tell that `cov` and `bench` are what came out of a build while `go` is a module proxy.
+
+**Fix.** The row becomes a pinned subset plus a grouped remainder behind a `+N` counter, with both the subset and the grouping declared in `config.ini` rather than in code:
+
+```ini
+[sr.ht]
+nav-groups=code work ci output account
+nav-pinned=git builds artifacts
+
+[bench.sr.ht]
+nav-group=output
+```
+
+The taxonomy lives in the config *because* there are two renderers — a copy of it in each would drift exactly the way the navbars themselves did before `sr-ht-ecore` existed. Members sort alphabetically inside a group in both halves, and that is what closes the ordering divergence: the alphabet is the one order neither parser can take away.
+
+Three properties worth knowing before touching it:
+
+- **An unedited config renders correctly.** With no `nav-groups` and no `nav-pinned` the panel is one unnamed alphabetical list and the row holds only the current service — no key is required, nothing 500s, and nothing is hidden that was not reachable before. This is also the precondition for the patch ever being acceptable upstream.
+- **No JavaScript.** The panel is `<details>`/`<summary>`; this repo builds no bundles and the Go half has to print the same markup, so anything else would have to be written twice in two languages and would be the first thing to diverge.
+- **`api.sr.ht` is excluded** alongside `paste` and `pages`. The federated GraphQL gateway serves no pages of its own; it is listed *before* the instance deploys one, because a section appearing in the config is all it takes for a service to enter the switcher.
+
+The logic lives in a new module, `srht/app/nav.py`, rather than in more lines of `flask.py`. That keeps the patch's contact with upstream down to three small hunks — an import, one list entry, three context keys — and it gives the Go half a single function to be compared against.
+
+**Status.** Written 2026-08-23 against `docs/SPEC.nav.md` in `sr-ht-ecore` (stages 0–1); **not applied anywhere yet.** The Go half is already released in `sr-ht-ecore/chrome`; this patch is the statement of the Python half, and how it reaches production is still an open decision — see below.
+
+**How it would reach production, and why that is not settled.** The spec's chapter 7 says to add the patch to `source=` in `sr.ht-apkbuilds/sr.ht/core.sr.ht/APKBUILD`. That is wrong for this instance, and the reason is worth writing down because it applies to every future core.sr.ht patch:
+
+- `~/data/home/sourcehut/sr.ht-apkbuilds` is a read-only clone of **upstream's** repo (its only remote is `git.sr.ht/~sircmpwn/sr.ht-apkbuilds`), and its `core.sr.ht` APKBUILD still pins `0.83.0` while the instance runs **0.84.5**. Nothing here builds core.sr.ht from it.
+- The apk comes from `~bigbes/srht-upstream`, a channel that **mirrors upstream's prebuilt packages** (`mirror.sr.ht` → `apk-mirror` → Garage → the channel). No local build step exists to hook a patch into.
+- The mechanism actually in use for core.sr.ht is `phoebe-lab/srht/scripts/patch-*.py` — idempotent scripts that rewrite the *installed* files in `Dockerfile.base`. `nav.html` is already patched twice that way, by `patch-nav-brand.py` and `patch-nav-register.py`, and neither touches the `<ul class="navbar-nav">` this patch rewrites.
+
+The Python and template hunks therefore want to become a `patch-nav-groups.py` beside those two. The `scss` hunks are the harder half and have no answer yet:
+
+- The **Python services'** CSS is compiled at *their own* apk build (`SASSC_INCLUDE=-I$(ASSETS)/scss/` in each service's Makefile) and arrives prebuilt inside upstream's package. Editing core.sr.ht's scss cannot reach it; only patching the built CSS in the image, or serving an extra stylesheet, can.
+- The **Go services'** CSS is compiled in each service's own CI, which clones core.sr.ht at `CORE_VER` and runs `make css`. There the scss hunks do apply — by `git apply`ing this patch after the clone, exactly as `Dockerfile.pages` and `Dockerfile.builds-worker` already do for `core-go-checksum.patch`. That is ten `.build.yml` files.
+
+Until that is decided the panel works everywhere and is styled nowhere: `<details>` opens without CSS, so the markup degrades to a nested list rather than to a broken navbar.
+
+**Verify it still applies cleanly:**
+
+```bash
+cd ~/data/home/sourcehut/core.sr.ht
+git apply --check ../patches/core-nav-groups.patch
+```
+
+Checked 2026-08-23 against `0.84.5` (what the instance runs), `0.83.8` (this clone) and `0.83.0`, with no offsets in any of them, and the patched `0.84.5` scss compiles under `sassc`. The hunks deliberately stay out of the regions that differ between those tags — the `_network_order` block and the `import_module` rework in `flask.py` — which is what makes one patch cover all three.
+
+**Verify the two halves still agree.** `core-nav-groups.fixture.ini` is one instance and `core-nav-groups.expected` is the switcher it must produce, as rendered from `diff.sr.ht`. No test can span both languages, so this pair is the shared answer key: check each side against the file rather than against the other side's screenshot. The Go half carries the same sections in `chrome/nav_groups_test.go`'s `navConf`, for the same reason.
+
 ### `builds-images-ubuntu-genimg.patch`
 
 **Repo:** `builds.sr.ht` &nbsp;·&nbsp; **File:** `images/ubuntu/genimg`
diff --git a/patches/core-nav-groups.expected b/patches/core-nav-groups.expected
new file mode 100644
index 0000000000000000000000000000000000000000..aeaf3b489dc5a622ab78f8c8154b266be1f5487e
--- /dev/null
+++ b/patches/core-nav-groups.expected
@@ -0,0 +1,44 @@
+# The switcher core-nav-groups.fixture.ini must produce, as rendered from
+# diff.sr.ht. Both halves of the instance are checked against this file.
+#
+# Read it as the sequence a reader sees, left to right and then top to bottom
+# once the panel is open. What has to match between the two renderings is this
+# list - not the markup around it, which differs in whitespace, in the brand
+# above and in the login box below, and always will.
+#
+# Produced and verified 2026-08-23 against sr-ht-ecore chrome (Go) and the
+# patched core.sr.ht (Jinja); the two agreed on all seventeen lines.
+
+row          git
+row          builds
+row          artifacts
+row-active   diff
+count        8
+group        code
+member       dolt
+member       spec
+group        work
+member       todo
+group        output
+member       bench
+member       cov
+member       go
+group        account
+member       meta
+member       tokens
+
+# Things this fixture pins that are easy to get wrong:
+#
+#   - artifacts stands third because nav-pinned says so, not because of any
+#     canonical or alphabetical order.
+#   - diff is fourth because it is the service rendering, and it is the only
+#     lit entry. Rendering from builds would produce a three-entry row instead,
+#     since builds is already pinned and must not be printed twice.
+#   - the ci group is absent: its only member is pinned, and a group nobody is
+#     left in prints nothing.
+#   - members are alphabetical inside each group. Not config order - the two
+#     config parsers disagree about whether that even survives parsing.
+#   - the count is 8, which is the number of "member" lines below it. A count
+#     that disagrees with its own panel is the one defect this design must not
+#     have.
+#   - api, hub, paste, pages and the origin-less ghost appear nowhere.
diff --git a/patches/core-nav-groups.fixture.ini b/patches/core-nav-groups.fixture.ini
new file mode 100644
index 0000000000000000000000000000000000000000..09cb400ec53a91267be83acc9d201eb6251bc661
--- /dev/null
+++ b/patches/core-nav-groups.fixture.ini
@@ -0,0 +1,89 @@
+; Fixture for core-nav-groups.patch: one instance, one expected switcher.
+;
+; The service switcher is rendered twice on this instance - by the patched
+; core.sr.ht for the Python services, and by sr-ht-ecore's chrome package for
+; the Go ones - and the two renderings have to agree entry for entry. There is
+; no test that can span both, so this file is the shared answer key: each side
+; is checked against it separately, and the file is the thing that makes those
+; two checks be about the same question.
+;
+; It is a fixture, not a deployment: the origins are examples, and the section
+; list is deliberately wider than the running instance so that every rule has a
+; case here. Keep it in step with chrome/nav_groups_test.go's navConf, which
+; carries the same sections for the same reason.
+
+[sr.ht]
+site-name=srht.example
+environment=production
+nav-groups=code work ci output account
+nav-pinned=git builds artifacts
+
+; Members, one per group.
+
+[git.sr.ht]
+origin=https://git.example
+nav-group=code
+
+[dolt.sr.ht]
+origin=https://dolt.example
+nav-group=code
+
+[spec.sr.ht]
+origin=https://spec.example
+nav-group=code
+
+[todo.sr.ht]
+origin=https://todo.example
+nav-group=work
+
+[diff.sr.ht]
+origin=https://diff.example
+nav-group=work
+
+[builds.sr.ht]
+origin=https://builds.example
+nav-group=ci
+
+[bench.sr.ht]
+origin=https://bench.example
+nav-group=output
+
+[cov.sr.ht]
+origin=https://cov.example
+nav-group=output
+
+[artifacts.sr.ht]
+origin=https://artifacts.example
+nav-group=output
+
+[go.sr.ht]
+origin=https://go.example
+nav-group=output
+
+[meta.sr.ht]
+origin=https://meta.example
+nav-group=account
+
+[tokens.sr.ht]
+origin=https://tokens.example
+nav-group=account
+
+; Not members, and each for a different reason: hub is the network's front page
+; and the brand already points at it, paste and pages have no top-level UI, api
+; is the GraphQL gateway and serves no pages at all. A section with no origin is
+; skipped too - it would otherwise be an entry with a dead link.
+
+[hub.sr.ht]
+origin=https://hub.example
+
+[paste.sr.ht]
+origin=https://paste.example
+
+[pages.sr.ht]
+origin=https://pages.example
+
+[api.sr.ht]
+origin=https://api.example
+nav-group=code
+
+[ghost.sr.ht]
diff --git a/patches/core-nav-groups.patch b/patches/core-nav-groups.patch
new file mode 100644
index 0000000000000000000000000000000000000000..f0c8f722e0584c40ac85a6e5270e8fde35d2a93e
--- /dev/null
+++ b/patches/core-nav-groups.patch
@@ -0,0 +1,382 @@
+--- a/srht/app/flask.py
++++ b/srht/app/flask.py
+@@ -6,6 +6,7 @@
+ from jinja2 import PackageLoader, ChoiceLoader
+ from srht.app import icon, datef, date_handler
+ from srht.app.csrf import issue_csrf_token, verify_request_csrf, csrf_bypass
++from srht.app.nav import switcher
+ from srht.app.pagination import pagination, coalesce_search_terms
+ from srht.assets import static_blueprint, static_resource
+ from srht.config import cfg, cfgi, cfgkeys, config
+@@ -34,6 +35,7 @@
+         if s.endswith(".sr.ht") and s not in [
+             "paste.sr.ht",
+             "pages.sr.ht",
++            "api.sr.ht",
+         ]
+ ]
+ 
+@@ -180,6 +182,9 @@
+                 'logout_url': self.logout_url,
+                 'environment': cfg("sr.ht", "environment", default="production"),
+                 'network': _network,
++                'nav_pinned': switcher(site).pinned,
++                'nav_hidden': switcher(site).hidden,
++                'nav_hidden_count': switcher(site).hidden_count,
+                 'static_resource': static_resource,
+                 'coalesce_search_terms': coalesce_search_terms,
+                 'to_rid': to_rid,
+--- a/srht/templates/nav.html
++++ b/srht/templates/nav.html
+@@ -14,21 +14,50 @@
+   </a>
+ </span>
+ {% endif %}
++{#
++  The switcher is the pinned services plus a counter holding the rest, both
++  decided by srht.app.nav from config.ini. It stopped being a flat row because
++  the row stopped fitting, and every service an installation gains made that
++  worse - the visible width is now a property of the config rather than of how
++  many services exist.
++
++  <details> and nothing else: this template has to work without JavaScript,
++  and the same strip is rendered by non-Python services on the same instance,
++  so anything not expressible in markup and CSS would have to be written twice
++  in two languages and would be the first thing to diverge. The class names are
++  load-bearing for the same reason - one stylesheet in this repo covers both
++  renderings.
++
++  The counter says how many rather than "more" or "all": a number is the one
++  label a reader can check against what opening the panel reveals, which is why
++  it is computed from that panel rather than counted here.
++#}
+ <ul class="navbar-nav">
+   {% if current_user %}
+-  {% for _site in network %}
+-
+-  {% if _site != "hub.sr.ht" %}
+-  <li class="nav-item {{'active' if _site == site else ''}}">
++  {% for item in nav_pinned %}
++  <li class="nav-item {{'active' if item.active else ''}}">
+     <a
+       class="nav-link"
+-      href="{{get_origin(_site, external=True)}}"
+-    >{{_site.split(".")[0]}}</a>
++      href="{{item.origin}}"
++    >{{item.name}}</a>
+   </li>
+-  {% endif %}
+-
+   {% endfor %}
++  {% if nav_hidden_count %}
++  <li class="nav-item nav-more">
++    <details>
++      <summary>+{{nav_hidden_count}}</summary>
++      <div class="nav-more-panel">
++        {% for group in nav_hidden %}
++        <div class="nav-more-group">
++          {% if group.name %}<div class="nav-more-title">{{group.name}}</div>{% endif %}
++          <ul>{% for item in group.items %}<li><a href="{{item.origin}}">{{item.name}}</a></li>{% endfor %}</ul>
++        </div>
++        {% endfor %}
++      </div>
++    </details>
++  </li>
+   {% endif %}
++  {% endif %}
+ </ul>
+ <div class="login">
+   {% if current_user %}
+--- a/scss/nav.scss
++++ b/scss/nav.scss
+@@ -22,6 +22,103 @@
+     text-decoration: underline;
+   }
+ 
++  // The overflow panel of the service switcher. It hangs off its own list
++  // item, so the navbar must not clip it: nothing here or above may introduce
++  // overflow: hidden, or the panel is cut off at the row it drops out of.
++  .nav-item.nav-more {
++    position: relative;
++
++    // The default disclosure triangle is dropped in favour of a caret drawn
++    // beside the count, so the summary reads as one label rather than as a
++    // widget with a number next to it. list-style covers Firefox, the
++    // ::-webkit-details-marker rule covers Safari.
++    summary {
++      list-style: none;
++      cursor: pointer;
++      padding: 0 0.5rem;
++      color: $navbar-light-color;
++      white-space: nowrap;
++
++      &::-webkit-details-marker {
++        display: none;
++      }
++
++      &::after {
++        content: " \25be";
++      }
++
++      &:hover {
++        color: $navbar-light-active-color;
++        text-decoration: underline;
++      }
++
++      // The summary is the only keyboard-reachable way into the panel, so its
++      // focus ring is not decoration.
++      &:focus,
++      &:focus-visible {
++        outline: 2px solid $link-color;
++        outline-offset: -2px;
++        color: $navbar-light-active-color;
++      }
++    }
++
++    details[open] > summary::after {
++      content: " \25b4";
++    }
++
++    .nav-more-panel {
++      position: absolute;
++      z-index: 1030; // above page content, level with Bootstrap's fixed navbar
++      right: 0;
++      min-width: 12rem;
++      padding: 0.5rem 0;
++      background: $gray-100;
++      border: 1px solid $gray-300;
++
++      // Two columns' worth of groups sit side by side on a wide viewport and
++      // stack on a narrow one, so the panel grows sideways rather than into a
++      // list long enough to need scrolling.
++      display: flex;
++      flex-wrap: wrap;
++      align-items: flex-start;
++    }
++
++    .nav-more-group {
++      padding: 0 1rem;
++      min-width: 8rem;
++
++      ul {
++        list-style: none;
++        margin: 0;
++        padding: 0;
++      }
++
++      a {
++        display: block;
++        padding: 0.1rem 0;
++        white-space: nowrap;
++      }
++    }
++
++    .nav-more-title {
++      color: $gray-600;
++      font-size: 0.85rem;
++      text-transform: uppercase;
++      padding-bottom: 0.1rem;
++    }
++
++    // On a phone the row already wraps rather than pushing the page sideways;
++    // the panel follows it and spans the width instead of hanging off an edge
++    // that may be off-screen.
++    @include media-breakpoint-down(xs) {
++      position: static;
++
++      .nav-more-panel {
++        width: 100%;
++      }
++    }
++  }
++
+   .navbar-text {
+     color: $black;
+ 
+--- a/scss/dark.scss
++++ b/scss/dark.scss
+@@ -177,6 +177,34 @@
+     .active .nav-link {
+       color: $white;
+     }
++
++    // The service switcher's overflow panel. Same two roles the rest of the
++    // dark theme uses for a raised surface and its edge, so the panel sits on
++    // the navbar the way .event sits on the page.
++    .nav-item.nav-more {
++      summary {
++        color: lighten($gray-600, 5);
++
++        &:hover,
++        &:focus,
++        &:focus-visible {
++          color: $white;
++        }
++      }
++
++      .nav-more-panel {
++        background: $darker;
++        border-color: $border;
++      }
++
++      .nav-more-title {
++        color: $muted-dark;
++      }
++
++      a {
++        color: $link-dark;
++      }
++    }
+   }
+ }
+ 
+--- /dev/null
++++ b/srht/app/nav.py
+@@ -0,0 +1,147 @@
++"""The service switcher: which services stay visible in the navbar, and how the
++rest are grouped behind the counter.
++
++The strip between the brand and the login box is the instance's only catalogue,
++and on an installation with more than a handful of services it stopped fitting
++the row. It is now a pinned subset plus a grouped remainder, with both the
++subset and the grouping declared in config.ini rather than in code:
++
++    [sr.ht]
++    nav-groups=code work ci output account
++    nav-pinned=git builds artifacts
++
++    [bench.sr.ht]
++    origin=https://bench.example
++    nav-group=output
++
++An installation that sets none of these keys keeps the switcher it had, moved
++behind the counter: every service falls into one unnamed group, which prints as
++a plain alphabetical list with no headings. That is deliberate — it is what
++makes this safe to run against a config nobody has edited yet.
++
++This module exists as a module, rather than as more lines in flask.py, because
++the same three keys are read by the instance's non-Python services and the two
++implementations have to keep agreeing. A self-contained function is the part
++that can be compared against its counterpart, and the part a rebase onto a new
++upstream does not have to be re-threaded through.
++
++One rule is worth stating on its own: members sort alphabetically inside a
++group, in every implementation. Not by config order — a config parser is free
++to throw the file's order away (Python's keeps it, Go's ini does not), so any
++ordering derived from it makes two renderers of the same instance disagree
++about the same config. The alphabet is the order both can reach unaided.
++"""
++from collections import namedtuple
++from functools import lru_cache
++
++from srht.config import cfg, config, get_origin
++
++# Sections that are never entries in the switcher. paste and pages have no
++# top-level UI worth linking; hub is not a sibling service but the network's
++# front page, and the brand already points at it; api is the federated GraphQL
++# gateway and serves no pages at all.
++_excluded = [
++    "paste.sr.ht",
++    "pages.sr.ht",
++    "hub.sr.ht",
++    "api.sr.ht",
++]
++
++NavItem = namedtuple("NavItem", ["name", "origin", "active", "group"])
++
++# NavGroup.name is "" for the tail group, the one collecting members whose
++# nav-group is missing or names a group the instance never declared. It is
++# empty rather than spelled "other" so that an installation which declared no
++# groups at all renders one plain list: every member lands in the tail, and a
++# tail with a name would print a heading over the whole panel.
++NavGroup = namedtuple("NavGroup", ["name", "items"])
++
++Switcher = namedtuple("Switcher", ["pinned", "hidden", "hidden_count"])
++
++
++def _participants(site):
++    """Every entry of the switcher, unordered: a section named "<name>.sr.ht"
++    that is not excluded and resolves to an origin.
++
++    A section without an origin is skipped rather than listed with a dead link,
++    which is the one place this differs from the flat `network` list flask.py
++    still exposes for the brand.
++    """
++    items = []
++    for section in config:
++        if not section.endswith(".sr.ht") or section in _excluded:
++            continue
++        origin = get_origin(section, external=True, default=None)
++        if not origin:
++            continue
++        items.append(NavItem(
++            name=section[:-len(".sr.ht")],
++            origin=origin,
++            active=section == site,
++            group=cfg(section, "nav-group", default=None) or "",
++        ))
++    return items
++
++
++def _group(items, order):
++    """Bucket items by their declared group, in the declared order, tail last.
++
++    A group named in nav-groups that nobody joined prints nothing, so an
++    installation may declare a taxonomy ahead of the services that will fill
++    it. A member naming a group that was never declared goes to the tail rather
++    than inventing a heading out of the misspelling.
++    """
++    buckets = {}
++    for item in items:
++        name = item.group if item.group in order else ""
++        buckets.setdefault(name, []).append(item)
++
++    groups = []
++    for name in order:
++        if buckets.get(name):
++            groups.append(NavGroup(name, sorted(buckets[name], key=lambda i: i.name)))
++    if buckets.get(""):
++        groups.append(NavGroup("", sorted(buckets[""], key=lambda i: i.name)))
++    return groups
++
++
++@lru_cache(maxsize=None)
++def switcher(site):
++    """The switcher as one page renders it: the row, the panel, and the count.
++
++    The row is nav-pinned in the order it was written, plus the current service
++    when it is not already there — a pinned name that answers to no service is
++    dropped without a word, because the cost of a typo in a hand-edited config
++    key must be one missing shortcut rather than an empty navbar. An empty or
++    absent nav-pinned is a working configuration too: the row then carries only
++    the current service.
++
++    The count is computed here, from the panel that was just built, and nothing
++    else may compute it. A "+5" over a panel of six is worse than no counter at
++    all, since the number is the only part of the strip a reader can check.
++
++    Cached on the site because the answer is a function of the config and of
++    which service is rendering — never of the request or the viewer. That is
++    also what makes the instance-wide rule checkable: every service shows the
++    same services, and only the highlight moves.
++    """
++    order = cfg("sr.ht", "nav-groups", default="").split()
++    pinned_names = cfg("sr.ht", "nav-pinned", default="").split()
++
++    items = _participants(site)
++    by_name = {item.name: item for item in items}
++
++    pinned, shown = [], set()
++    for name in pinned_names:
++        item = by_name.get(name)
++        if item is None or name in shown:
++            continue
++        shown.add(name)
++        pinned.append(item)
++    for item in items:
++        if item.active and item.name not in shown:
++            shown.add(item.name)
++            pinned.append(item)
++
++    hidden = _group([i for i in items if i.name not in shown], order)
++    return Switcher(pinned, hidden, sum(len(g.items) for g in hidden))