If you have an error for a field that's not present in the HTML source, htmlfill.render() inserts the corresponding error message at the beginning of the output, which often means in front of the '<html>' tag, which produces invalid HTML.
This happens, for example, if your FormEncode schema doesn't declare your submit button as a Bool() field, and you use the standard Pylons validate() decorator.
I suggest that the fallback location for unused errors should not be the beginning of the document, instead it should be just in front (or just after, depending on prefix_errors) of the <form> tag. I also suggest interpreting <form:error name="*"> as the location for all unused errors.
Confirmed