web: draw the whole web tier from sr-ht-ecore The chrome moved last time; this moves the four packages around it. pages discovers the page templates and carries the shared error body, so the hand-maintained page list, the render helper and error.html go; assets finds the hashed stylesheet and serves the static tree, so the local regexp, the href glob and handleStatic go; middleware brings the private-cache policy and a panic guard that aborts a connection rather than appending an error page to a truncated one; and ecoretest replaces the hand-built config and the TestMain that minted its own keys. The one that matters is csrf. The guard was a predicate three handlers remembered to call, which made unprotected the default for any form added later. It is now csrf.Require on the router, so it covers the routes that are not written yet, it runs before routing — an unrouted POST is refused rather than 404'd — and the refusal is the shared sentence. Host comparison becomes case-insensitive, which is strictly more permissive and only for an operator typo in the config. threads.html becomes _threads.html, the partial spelling pages.Load discovers, and the review page takes container-fluid: two prose columns do not fit the centred container, which is what cover and dolt already concluded for their wide views. What stays here: the sentinel-to-status mapping in fail, and a renderError that wraps ecore's error body in this service's view struct.
feat(web): proposal review page — prose diff + approve/reject (Phase 4) The browser review plane at /~owner/space/p/<id>, the stable URL every write already returns. The owner opens the link an agent handed them, reads a prose diff of each changed document, and approves (merges now) or rejects. - web/diff.go: the prose-diff HTML renderer, consuming prosediff's block model (the package renders text only; HTML is the web layer's job). It implements the Phase 0 verdict's hard requirement — inline word diffs above 0.75 block similarity, a two-column old/new view below it, because 13% of real edits shred and are unreadable inline. All document content is HTML-escaped; only the diff structure is markup. - service/review.go: ProposalDiff reads each changed document's base and proposed content for the page to diff (branch tip resolved to a sha, the legitimate pinned-rev read, not the ReadDocumentAtRef bypass), and MergeHuman fixes the approval kind so a browser approve is always human. - web/proposal.go: the GET page and the approve/reject POSTs. Only the owner may act (an agent is authenticated but has no more approval authority than anyone); a cross-site guard on Origin/Referer is the CSRF defense a form post needs when the session cookie is meta's. Post- redirect-get back to the page. Stale/already-merged approve → 409. - web.Reader gains the proposal reads and the two actions; the diff-view styles go in scss/main.scss (inline marks, two-column, code line diffs). Inbox and the policy-merged digest are the remaining Phase 4 surfaces.