Previously the docs only required builds.sr.ht/JOBS:RW, but the log endpoints under /query/log/<id>[/<task>]/log require builds.sr.ht/LOGS:RO. A token with the documented scope would submit jobs and poll status correctly, then 403 on every log fetch. The provider's streamStep suppressed all non-404 errors at debug level and emitted empty steps, so operators following the docs got green builds whose logs were silently blank. Update the docs to require both scopes and explain why. Add an ErrUnauthorized sentinel to the sourcehut client and wrap 401/403 responses from GetTaskLog with it. In the provider, probe the master log up front in Logs() so a systemic auth failure surfaces as a Logs() error (5xx via the HTTP layer) rather than as an empty stream. As defense in depth, streamStep now aborts the stream and logs at error level on ErrUnauthorized instead of swallowing it.