feat(web): line-numbered unified prose diff replaces the block cards (spec-by6.3.5) The block-card renderer was reviewed against a live proposal and rejected: "ADDED PARAGRAPH" outweighed the content on every row, every block carried identical chrome, and on a new file the whole page is one change, so the cards added noise and no signal. Two columns of digits say the same thing and then get out of the way, which is what a gutter is for. Selection is by line, anchoring is by block. Lines are what the cursor lands on; block hashes are what survive a reflow. The web layer maps a selected line range onto its enclosing prosediff block and stores the existing core.CommentAnchor unchanged — service/, db/ and core/ do not move and the POST wire format is untouched. The composer states which block it will anchor to before anything is typed, so the indirection is visible rather than magic. A line number is never guessed. A modified prose block goes through prosediff.WordsByLine, whose ok=false contract is honoured with a paired old/new region stating a line RANGE; a block rewritten past the similarity threshold takes that path too. An equal block that was rewrapped states an old number only for the lines the old revision really holds — equal line counts were the first rule and were not proof, which a property test over 2800 generated document/edit pairs found within seventeen cases. The markup is a table because prose wraps and a number has to stay on the first visual line of the line it names. One rail ground behind both number tracks with a single hairline against the content; the change tint starts at the sign column so the gutter never reads as part of the change; heading rows pin themselves as the section readout, replacing the per-hunk breadcrumb that only restated a heading three rows above. Folding and commenting both work with JavaScript off — the fold is a checkbox, and every block keeps a visible composer. With the script in, that per-block composer is hidden and reached by selecting lines instead, because sixteen identical "comment on this block" rows are the chrome this port removes. A composer holding typed text is never hidden by anything. Two pre-existing prosediff faults are fixed here because line numbers are what made them visible: a thematic break reported line 1 for every rule in the document, and a document whose entire content is "---" panicked in splitFrontmatter.
feat(web): commentable prose diff with honest anchor state (spec-by6.3.3) Reverses the diff view's founding rule. renderDocDiff skipped ChangeEqual outright — "the review shows only what changed" — but any block of a proposed document must be commentable, so unchanged blocks now render as collapsed, dimmed context. Changed blocks keep their border, tint and full body, so the page still reads as a diff at a glance rather than as a document dump. A context block carrying a comment renders open. ChangeMoveIn now shows its text too, since a comment control on invisible text is a control on nothing; ChangeMoveOut stays a bare marker and is deliberately not commentable, because the same paragraph is anchorable at its move-in position and two anchors for one paragraph is the bug that avoids. Every rendered block carries id="b-<16 hex>", hashed from the whole anchor tuple. Not the page ordinal: an ordinal renumbers on any insertion above it, so a saved link would silently scroll to a neighbouring paragraph, whereas including the block hash makes a stale link resolve to nothing instead. Threads are placed by anchor and by nothing else. Anything no rendered block claims — an outdated anchor, an old-side anchor whose block the diff no longer draws, a document the proposal no longer changes — is collected into a page-level "comments that lost their anchor" area. Never dropped, never moved onto a neighbour: a comment reads as authoritative about the block it sits beside, so attaching it to the wrong one is worse than admitting it lost its place. An edited anchor is drawn on its block and badged. The comment form's anchor is built at submit time from the branch as it now reads, through service.AnchorOf — hand-rolling the ordinal conversion here would put the browser's comments on different blocks than the MCP tool's, which is the one way two surfaces of one conversation disagree without either looking broken. The form's block hash guards it: a block that moved while the page sat open is a 409, not a comment attached to whatever took its place. That hash is required rather than checked-when-present. Skipping the guard for a form that omits it would let a later template refactor drop the hidden field and disable the staleness check silently, with every test still green. Authority is surfaced, not re-implemented: compose and resolve are the owner's because service says so and ErrForbidden becomes a 403. spec-by6.3.3
feat(web): proposal review page — prose diff + approve/reject (Phase 4) The browser review plane at /~owner/space/p/<id>, the stable URL every write already returns. The owner opens the link an agent handed them, reads a prose diff of each changed document, and approves (merges now) or rejects. - web/diff.go: the prose-diff HTML renderer, consuming prosediff's block model (the package renders text only; HTML is the web layer's job). It implements the Phase 0 verdict's hard requirement — inline word diffs above 0.75 block similarity, a two-column old/new view below it, because 13% of real edits shred and are unreadable inline. All document content is HTML-escaped; only the diff structure is markup. - service/review.go: ProposalDiff reads each changed document's base and proposed content for the page to diff (branch tip resolved to a sha, the legitimate pinned-rev read, not the ReadDocumentAtRef bypass), and MergeHuman fixes the approval kind so a browser approve is always human. - web/proposal.go: the GET page and the approve/reject POSTs. Only the owner may act (an agent is authenticated but has no more approval authority than anyone); a cross-site guard on Origin/Referer is the CSRF defense a form post needs when the session cookie is meta's. Post- redirect-get back to the page. Stale/already-merged approve → 409. - web.Reader gains the proposal reads and the two actions; the diff-view styles go in scss/main.scss (inline marks, two-column, code line diffs). Inbox and the policy-merged digest are the remaining Phase 4 surfaces.
feat: web — the Phase 2 read plane UI and its SCSS entry SourceHut chrome (nav service-switcher, login block, environment banner, error page, embedded hashed static assets) ported from compare.sr.ht, plus the read-plane pages: landing, space document tree, rendered document with frontmatter/backlinks, and search. The URL grammar is the design's pinned one: a document's address carries no extension, ".md" is raw source, ".json" is metadata plus body, and ?rev= pins any of the three to an immutable revision. Links rendered inside a pinned page keep the pin, so following one does not silently land on the approved head. One human and no visibility levels, so the read ACL is one line: the owner and its agents read, everyone else is redirected to meta's login (a browser) or refused with 401 (a client asking for .md/.json).