From a077609796939541559c1300494387b405274d39 Mon Sep 17 00:00:00 2001
From: Ben Firestone <ben.firestone@krypticlabs.com>
Date: Sat, 28 Mar 2026 11:45:45 -0700
Subject: [PATCH 01/20] chore: adding eval workspace to gitignore

---
 .gitignore | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.gitignore b/.gitignore
index eaf97cf..5d6ac44 100644
--- a/.gitignore
+++ b/.gitignore
@@ -29,5 +29,8 @@ coverage.html
 # Worktrees
 .worktrees/
 
+# eval workspaces
+plan-*
+
 # Config (contains user-specific settings)
 # Note: ~/.arc/cli-config.json is user config

From cfcbce91e2bc1fc61384fd39986d5341f5a611a0 Mon Sep 17 00:00:00 2001
From: Ben Firestone <ben.firestone@krypticlabs.com>
Date: Wed, 29 Apr 2026 13:43:45 -0700
Subject: [PATCH 02/20] feat(paste): add foundation types, storage, and crypto
 helpers

Establishes the shared contracts for the shared-review epic: Go types
(PasteShare, PasteEvent, DTOs), Storage interface with sentinel errors,
SQLite implementation with embed-based migrations, AES-256-GCM crypto
helpers, and TypeScript mirrors with Vitest unit tests.
---
 internal/paste/crypto.go                      |  60 +++++++++
 internal/paste/crypto_test.go                 |  42 ++++++
 internal/paste/sqlite/migrations.go           |  54 ++++++++
 internal/paste/sqlite/migrations/001_init.sql |  20 +++
 internal/paste/sqlite/store.go                | 111 ++++++++++++++++
 internal/paste/sqlite/store_test.go           | 122 ++++++++++++++++++
 internal/paste/storage.go                     |  19 +++
 internal/paste/types.go                       |  46 +++++++
 internal/paste/types_test.go                  |  32 +++++
 web/bun.lock                                  |  49 +++++++
 web/package.json                              |   5 +-
 web/src/lib/paste/crypto.test.ts              |  42 ++++++
 web/src/lib/paste/crypto.ts                   |  49 +++++++
 web/src/lib/paste/types.ts                    |  85 ++++++++++++
 web/vitest.config.ts                          |   7 +
 15 files changed, 741 insertions(+), 2 deletions(-)
 create mode 100644 internal/paste/crypto.go
 create mode 100644 internal/paste/crypto_test.go
 create mode 100644 internal/paste/sqlite/migrations.go
 create mode 100644 internal/paste/sqlite/migrations/001_init.sql
 create mode 100644 internal/paste/sqlite/store.go
 create mode 100644 internal/paste/sqlite/store_test.go
 create mode 100644 internal/paste/storage.go
 create mode 100644 internal/paste/types.go
 create mode 100644 internal/paste/types_test.go
 create mode 100644 web/src/lib/paste/crypto.test.ts
 create mode 100644 web/src/lib/paste/crypto.ts
 create mode 100644 web/src/lib/paste/types.ts
 create mode 100644 web/vitest.config.ts

diff --git a/internal/paste/crypto.go b/internal/paste/crypto.go
new file mode 100644
index 0000000..d91e812
--- /dev/null
+++ b/internal/paste/crypto.go
@@ -0,0 +1,60 @@
+package paste
+
+import (
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/rand"
+	"encoding/json"
+	"errors"
+)
+
+const KeySize = 32
+
+func GenerateKey() ([]byte, error) {
+	key := make([]byte, KeySize)
+	_, err := rand.Read(key)
+	return key, err
+}
+
+func EncryptJSON(v any, key []byte) (ciphertext, iv []byte, err error) {
+	if len(key) != KeySize {
+		return nil, nil, errors.New("paste: key must be 32 bytes")
+	}
+	plain, err := json.Marshal(v)
+	if err != nil {
+		return nil, nil, err
+	}
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		return nil, nil, err
+	}
+	gcm, err := cipher.NewGCM(block)
+	if err != nil {
+		return nil, nil, err
+	}
+	iv = make([]byte, gcm.NonceSize())
+	if _, err := rand.Read(iv); err != nil {
+		return nil, nil, err
+	}
+	ciphertext = gcm.Seal(nil, iv, plain, nil)
+	return ciphertext, iv, nil
+}
+
+func DecryptJSON(ciphertext, iv, key []byte, v any) error {
+	if len(key) != KeySize {
+		return errors.New("paste: key must be 32 bytes")
+	}
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		return err
+	}
+	gcm, err := cipher.NewGCM(block)
+	if err != nil {
+		return err
+	}
+	plain, err := gcm.Open(nil, iv, ciphertext, nil)
+	if err != nil {
+		return err
+	}
+	return json.Unmarshal(plain, v)
+}
diff --git a/internal/paste/crypto_test.go b/internal/paste/crypto_test.go
new file mode 100644
index 0000000..fa1bb1f
--- /dev/null
+++ b/internal/paste/crypto_test.go
@@ -0,0 +1,42 @@
+package paste
+
+import (
+	"bytes"
+	"testing"
+)
+
+func TestEncryptDecryptRoundtrip(t *testing.T) {
+	key, err := GenerateKey()
+	if err != nil {
+		t.Fatal(err)
+	}
+	in := map[string]any{"hello": "world", "n": float64(42)}
+	ct, iv, err := EncryptJSON(in, key)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var out map[string]any
+	if err := DecryptJSON(ct, iv, key, &out); err != nil {
+		t.Fatalf("DecryptJSON: %v", err)
+	}
+	if out["hello"] != "world" {
+		t.Errorf("roundtrip mismatch: %+v", out)
+	}
+}
+
+func TestDecryptWithWrongKeyFails(t *testing.T) {
+	k1, _ := GenerateKey()
+	k2, _ := GenerateKey()
+	ct, iv, _ := EncryptJSON("secret", k1)
+	var out string
+	if err := DecryptJSON(ct, iv, k2, &out); err == nil {
+		t.Error("expected decrypt to fail with wrong key")
+	}
+}
+
+func TestKeySizeValidation(t *testing.T) {
+	short := bytes.Repeat([]byte{1}, 16)
+	if _, _, err := EncryptJSON("x", short); err == nil {
+		t.Error("expected error for short key")
+	}
+}
diff --git a/internal/paste/sqlite/migrations.go b/internal/paste/sqlite/migrations.go
new file mode 100644
index 0000000..2c8c486
--- /dev/null
+++ b/internal/paste/sqlite/migrations.go
@@ -0,0 +1,54 @@
+package sqlite
+
+import (
+	"context"
+	"database/sql"
+	"embed"
+	"fmt"
+	"io/fs"
+	"sort"
+	"strings"
+)
+
+//go:embed migrations/*.sql
+var migrationsFS embed.FS
+
+func Apply(ctx context.Context, db *sql.DB) error {
+	if _, err := db.ExecContext(ctx, `CREATE TABLE IF NOT EXISTS paste_migrations (
+        name TEXT PRIMARY KEY, applied_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP)`); err != nil {
+		return fmt.Errorf("create paste_migrations: %w", err)
+	}
+	entries, err := fs.ReadDir(migrationsFS, "migrations")
+	if err != nil {
+		return err
+	}
+	names := make([]string, 0, len(entries))
+	for _, e := range entries {
+		if !strings.HasSuffix(e.Name(), ".sql") {
+			continue
+		}
+		names = append(names, e.Name())
+	}
+	sort.Strings(names)
+	for _, name := range names {
+		var existing string
+		err := db.QueryRowContext(ctx, `SELECT name FROM paste_migrations WHERE name = ?`, name).Scan(&existing)
+		if err == nil {
+			continue
+		}
+		if err != sql.ErrNoRows {
+			return err
+		}
+		body, err := migrationsFS.ReadFile("migrations/" + name)
+		if err != nil {
+			return err
+		}
+		if _, err := db.ExecContext(ctx, string(body)); err != nil {
+			return fmt.Errorf("apply %s: %w", name, err)
+		}
+		if _, err := db.ExecContext(ctx, `INSERT INTO paste_migrations(name) VALUES (?)`, name); err != nil {
+			return err
+		}
+	}
+	return nil
+}
diff --git a/internal/paste/sqlite/migrations/001_init.sql b/internal/paste/sqlite/migrations/001_init.sql
new file mode 100644
index 0000000..9c476bb
--- /dev/null
+++ b/internal/paste/sqlite/migrations/001_init.sql
@@ -0,0 +1,20 @@
+CREATE TABLE paste_shares (
+    id           TEXT PRIMARY KEY,
+    edit_token   TEXT NOT NULL,
+    plan_blob    BLOB NOT NULL,
+    plan_iv      BLOB NOT NULL,
+    schema_ver   INTEGER NOT NULL DEFAULT 1,
+    created_at   TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    updated_at   TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    expires_at   TIMESTAMP
+);
+
+CREATE TABLE paste_events (
+    id           TEXT PRIMARY KEY,
+    share_id     TEXT NOT NULL REFERENCES paste_shares(id) ON DELETE CASCADE,
+    blob         BLOB NOT NULL,
+    iv           BLOB NOT NULL,
+    created_at   TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+
+CREATE INDEX idx_paste_events_share ON paste_events(share_id, created_at);
diff --git a/internal/paste/sqlite/store.go b/internal/paste/sqlite/store.go
new file mode 100644
index 0000000..208860b
--- /dev/null
+++ b/internal/paste/sqlite/store.go
@@ -0,0 +1,111 @@
+package sqlite
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"time"
+
+	"github.com/sentiolabs/arc/internal/paste"
+)
+
+type Store struct {
+	db *sql.DB
+}
+
+func New(db *sql.DB) *Store { return &Store{db: db} }
+
+func (s *Store) CreateShare(ctx context.Context, share paste.PasteShare, editToken string) error {
+	_, err := s.db.ExecContext(ctx,
+		`INSERT INTO paste_shares (id, edit_token, plan_blob, plan_iv, schema_ver, created_at, updated_at, expires_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
+		share.ID, editToken, share.PlanBlob, share.PlanIV, share.SchemaVer,
+		share.CreatedAt, share.UpdatedAt, share.ExpiresAt,
+	)
+	return err
+}
+
+func (s *Store) GetShare(ctx context.Context, id string) (*paste.PasteShare, error) {
+	var sh paste.PasteShare
+	var expires sql.NullTime
+	err := s.db.QueryRowContext(ctx,
+		`SELECT id, plan_blob, plan_iv, schema_ver, created_at, updated_at, expires_at
+         FROM paste_shares WHERE id = ?`, id).
+		Scan(&sh.ID, &sh.PlanBlob, &sh.PlanIV, &sh.SchemaVer, &sh.CreatedAt, &sh.UpdatedAt, &expires)
+	if errors.Is(err, sql.ErrNoRows) {
+		return nil, paste.ErrShareNotFound
+	}
+	if err != nil {
+		return nil, err
+	}
+	if expires.Valid {
+		t := expires.Time
+		sh.ExpiresAt = &t
+	}
+	return &sh, nil
+}
+
+func (s *Store) UpdateSharePlan(ctx context.Context, id string, planBlob, iv []byte, editToken string) error {
+	ok, err := s.VerifyEditToken(ctx, id, editToken)
+	if err != nil {
+		return err
+	}
+	if !ok {
+		return paste.ErrInvalidEditToken
+	}
+	_, err = s.db.ExecContext(ctx,
+		`UPDATE paste_shares SET plan_blob = ?, plan_iv = ?, updated_at = ? WHERE id = ?`,
+		planBlob, iv, time.Now(), id)
+	return err
+}
+
+func (s *Store) DeleteShare(ctx context.Context, id, editToken string) error {
+	ok, err := s.VerifyEditToken(ctx, id, editToken)
+	if err != nil {
+		return err
+	}
+	if !ok {
+		return paste.ErrInvalidEditToken
+	}
+	_, err = s.db.ExecContext(ctx, `DELETE FROM paste_shares WHERE id = ?`, id)
+	return err
+}
+
+func (s *Store) AppendEvent(ctx context.Context, e paste.PasteEvent) error {
+	_, err := s.db.ExecContext(ctx,
+		`INSERT INTO paste_events (id, share_id, blob, iv, created_at) VALUES (?, ?, ?, ?, ?)`,
+		e.ID, e.ShareID, e.Blob, e.IV, e.CreatedAt)
+	return err
+}
+
+func (s *Store) ListEvents(ctx context.Context, shareID string) ([]paste.PasteEvent, error) {
+	rows, err := s.db.QueryContext(ctx,
+		`SELECT id, share_id, blob, iv, created_at FROM paste_events
+         WHERE share_id = ? ORDER BY created_at ASC, id ASC`, shareID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var out []paste.PasteEvent
+	for rows.Next() {
+		var e paste.PasteEvent
+		if err := rows.Scan(&e.ID, &e.ShareID, &e.Blob, &e.IV, &e.CreatedAt); err != nil {
+			return nil, err
+		}
+		out = append(out, e)
+	}
+	return out, rows.Err()
+}
+
+func (s *Store) VerifyEditToken(ctx context.Context, id, token string) (bool, error) {
+	var stored string
+	err := s.db.QueryRowContext(ctx,
+		`SELECT edit_token FROM paste_shares WHERE id = ?`, id).Scan(&stored)
+	if errors.Is(err, sql.ErrNoRows) {
+		return false, paste.ErrShareNotFound
+	}
+	if err != nil {
+		return false, err
+	}
+	return stored == token, nil
+}
diff --git a/internal/paste/sqlite/store_test.go b/internal/paste/sqlite/store_test.go
new file mode 100644
index 0000000..f7feecd
--- /dev/null
+++ b/internal/paste/sqlite/store_test.go
@@ -0,0 +1,122 @@
+package sqlite_test
+
+import (
+	"context"
+	"database/sql"
+	"testing"
+	"time"
+
+	_ "modernc.org/sqlite"
+
+	"github.com/sentiolabs/arc/internal/paste"
+	"github.com/sentiolabs/arc/internal/paste/sqlite"
+)
+
+var _ paste.Storage = (*sqlite.Store)(nil)
+
+func newTestStore(t *testing.T) *sqlite.Store {
+	t.Helper()
+	db, err := sql.Open("sqlite", ":memory:")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := sqlite.Apply(context.Background(), db); err != nil {
+		t.Fatal(err)
+	}
+	return sqlite.New(db)
+}
+
+func TestCreateAndGetShare(t *testing.T) {
+	s := newTestStore(t)
+	now := time.Now().UTC().Truncate(time.Second)
+	share := paste.PasteShare{
+		ID:        "abc12345",
+		PlanBlob:  []byte{1, 2, 3},
+		PlanIV:    []byte{4, 5, 6},
+		SchemaVer: 1,
+		CreatedAt: now,
+		UpdatedAt: now,
+	}
+	if err := s.CreateShare(context.Background(), share, "tok"); err != nil {
+		t.Fatalf("CreateShare: %v", err)
+	}
+	got, err := s.GetShare(context.Background(), "abc12345")
+	if err != nil {
+		t.Fatalf("GetShare: %v", err)
+	}
+	if got.ID != share.ID || string(got.PlanBlob) != string(share.PlanBlob) {
+		t.Errorf("got %+v, want %+v", got, share)
+	}
+}
+
+func TestVerifyEditToken(t *testing.T) {
+	s := newTestStore(t)
+	now := time.Now().UTC()
+	_ = s.CreateShare(context.Background(), paste.PasteShare{
+		ID:        "x",
+		PlanBlob:  []byte{0},
+		PlanIV:    []byte{0},
+		SchemaVer: 1,
+		CreatedAt: now,
+		UpdatedAt: now,
+	}, "good")
+	ok, err := s.VerifyEditToken(context.Background(), "x", "good")
+	if err != nil || !ok {
+		t.Errorf("expected good token to verify, got ok=%v err=%v", ok, err)
+	}
+	ok, _ = s.VerifyEditToken(context.Background(), "x", "bad")
+	if ok {
+		t.Error("expected bad token to fail verify")
+	}
+}
+
+func TestUpdateSharePlanRequiresToken(t *testing.T) {
+	s := newTestStore(t)
+	now := time.Now().UTC()
+	_ = s.CreateShare(context.Background(), paste.PasteShare{
+		ID:        "x",
+		PlanBlob:  []byte{0},
+		PlanIV:    []byte{0},
+		SchemaVer: 1,
+		CreatedAt: now,
+		UpdatedAt: now,
+	}, "good")
+	err := s.UpdateSharePlan(context.Background(), "x", []byte{9}, []byte{8}, "bad")
+	if err != paste.ErrInvalidEditToken {
+		t.Errorf("expected ErrInvalidEditToken, got %v", err)
+	}
+}
+
+func TestAppendAndListEvents(t *testing.T) {
+	s := newTestStore(t)
+	now := time.Now().UTC()
+	_ = s.CreateShare(context.Background(), paste.PasteShare{
+		ID:        "x",
+		PlanBlob:  []byte{0},
+		PlanIV:    []byte{0},
+		SchemaVer: 1,
+		CreatedAt: now,
+		UpdatedAt: now,
+	}, "tok")
+	_ = s.AppendEvent(context.Background(), paste.PasteEvent{
+		ID:        "e1",
+		ShareID:   "x",
+		Blob:      []byte{1},
+		IV:        []byte{1},
+		CreatedAt: now,
+	})
+	_ = s.AppendEvent(context.Background(), paste.PasteEvent{
+		ID:        "e2",
+		ShareID:   "x",
+		Blob:      []byte{2},
+		IV:        []byte{2},
+		CreatedAt: now.Add(time.Second),
+	})
+	events, err := s.ListEvents(context.Background(), "x")
+	if err != nil || len(events) != 2 {
+		t.Fatalf("expected 2 events, got %d (err=%v)", len(events), err)
+	}
+	if events[0].ID != "e1" {
+		t.Errorf("expected ordering by created_at; first event was %s", events[0].ID)
+	}
+}
diff --git a/internal/paste/storage.go b/internal/paste/storage.go
new file mode 100644
index 0000000..608ef13
--- /dev/null
+++ b/internal/paste/storage.go
@@ -0,0 +1,19 @@
+package paste
+
+import (
+	"context"
+	"errors"
+)
+
+var ErrShareNotFound = errors.New("paste share not found")
+var ErrInvalidEditToken = errors.New("invalid edit token")
+
+type Storage interface {
+	CreateShare(ctx context.Context, s PasteShare, editToken string) error
+	GetShare(ctx context.Context, id string) (*PasteShare, error)
+	UpdateSharePlan(ctx context.Context, id string, planBlob, iv []byte, editToken string) error
+	DeleteShare(ctx context.Context, id string, editToken string) error
+	AppendEvent(ctx context.Context, e PasteEvent) error
+	ListEvents(ctx context.Context, shareID string) ([]PasteEvent, error)
+	VerifyEditToken(ctx context.Context, id, token string) (bool, error)
+}
diff --git a/internal/paste/types.go b/internal/paste/types.go
new file mode 100644
index 0000000..76c7b0c
--- /dev/null
+++ b/internal/paste/types.go
@@ -0,0 +1,46 @@
+// Package paste provides zero-knowledge encrypted paste storage for arc plans
+// and review comments. The server stores opaque ciphertext blobs; encryption
+// and decryption happen exclusively on clients.
+package paste
+
+import "time"
+
+type PasteShare struct {
+	ID        string     `json:"id"`
+	PlanBlob  []byte     `json:"plan_blob"`
+	PlanIV    []byte     `json:"plan_iv"`
+	SchemaVer int        `json:"schema_ver"`
+	CreatedAt time.Time  `json:"created_at"`
+	UpdatedAt time.Time  `json:"updated_at"`
+	ExpiresAt *time.Time `json:"expires_at,omitempty"`
+}
+
+type PasteEvent struct {
+	ID        string    `json:"id"`
+	ShareID   string    `json:"share_id"`
+	Blob      []byte    `json:"blob"`
+	IV        []byte    `json:"iv"`
+	CreatedAt time.Time `json:"created_at"`
+}
+
+type CreatePasteRequest struct {
+	PlanBlob  []byte     `json:"plan_blob"`
+	PlanIV    []byte     `json:"plan_iv"`
+	SchemaVer int        `json:"schema_ver"`
+	ExpiresAt *time.Time `json:"expires_at,omitempty"`
+}
+
+type CreatePasteResponse struct {
+	ID        string `json:"id"`
+	EditToken string `json:"edit_token"`
+}
+
+type AppendEventRequest struct {
+	Blob []byte `json:"blob"`
+	IV   []byte `json:"iv"`
+}
+
+type GetPasteResponse struct {
+	PasteShare
+	Events []PasteEvent `json:"events"`
+}
diff --git a/internal/paste/types_test.go b/internal/paste/types_test.go
new file mode 100644
index 0000000..5d26c09
--- /dev/null
+++ b/internal/paste/types_test.go
@@ -0,0 +1,32 @@
+package paste
+
+import (
+	"testing"
+	"time"
+)
+
+func TestPasteShareContract(t *testing.T) {
+	var s PasteShare
+	var _ string = s.ID
+	var _ []byte = s.PlanBlob
+	var _ []byte = s.PlanIV
+	var _ int = s.SchemaVer
+	var _ time.Time = s.CreatedAt
+	var _ time.Time = s.UpdatedAt
+	var _ *time.Time = s.ExpiresAt
+}
+
+func TestPasteEventContract(t *testing.T) {
+	var e PasteEvent
+	var _ string = e.ID
+	var _ string = e.ShareID
+	var _ []byte = e.Blob
+	var _ []byte = e.IV
+	var _ time.Time = e.CreatedAt
+}
+
+func TestCreatePasteResponseContract(t *testing.T) {
+	var r CreatePasteResponse
+	var _ string = r.ID
+	var _ string = r.EditToken
+}
diff --git a/web/bun.lock b/web/bun.lock
index da2c14b..6f52750 100644
--- a/web/bun.lock
+++ b/web/bun.lock
@@ -35,6 +35,7 @@
         "tailwindcss": "^4.0.0",
         "typescript": "^5.9.3",
         "vite": "^7.2.6",
+        "vitest": "^4.1.5",
       },
     },
   },
@@ -295,8 +296,12 @@
 
     "@types/bun": ["@types/bun@1.3.10", "", { "dependencies": { "bun-types": "1.3.10" } }, "sha512-0+rlrUrOrTSskibryHbvQkDOWRJwJZqZlxrUs1u4oOoTln8+WIXBPmAuCF35SWB2z4Zl3E84Nl/D0P7803nigQ=="],
 
+    "@types/chai": ["@types/chai@5.2.3", "", { "dependencies": { "@types/deep-eql": "*", "assertion-error": "^2.0.1" } }, "sha512-Mw558oeA9fFbv65/y4mHtXDs9bPnFMZAL/jxdPFUpOHHIXX91mcgEHbS5Lahr+pwZFR8A7GQleRWeI6cGFC2UA=="],
+
     "@types/cookie": ["@types/cookie@0.6.0", "", {}, "sha512-4Kh9a6B2bQciAhf7FSuMRRkUWecJgJu9nPnx3yzpsfXX/c50REIqpHY4C82bXP90qrLtXtkDxTZosYO3UpOwlA=="],
 
+    "@types/deep-eql": ["@types/deep-eql@4.0.2", "", {}, "sha512-c9h9dVVMigMPc4bwTvC5dxqtqJZwQPePsWjPlpSOnojbor6pGqdk541lfA7AqFQr5pB1BRdq0juY9db81BwyFw=="],
+
     "@types/dompurify": ["@types/dompurify@3.2.0", "", { "dependencies": { "dompurify": "*" } }, "sha512-Fgg31wv9QbLDA0SpTOXO3MaxySc4DKGLi8sna4/Utjo4r3ZRPdCt4UQee8BWr+Q5z21yifghREPJGYaEOEIACg=="],
 
     "@types/estree": ["@types/estree@1.0.8", "", {}, "sha512-dWHzHa2WqEXI/O1E9OjrocMTKJl2mSrEolh1Iomrv6U+JuNwaHXsXx9bLu5gG7BUWFIN0skIQJQ/L1rIex4X6w=="],
@@ -335,6 +340,20 @@
 
     "@ungap/structured-clone": ["@ungap/structured-clone@1.3.0", "", {}, "sha512-WmoN8qaIAo7WTYWbAZuG8PYEhn5fkz7dZrqTBZ7dtt//lL2Gwms1IcnQ5yHqjDfX8Ft5j4YzDM23f87zBfDe9g=="],
 
+    "@vitest/expect": ["@vitest/expect@4.1.5", "", { "dependencies": { "@standard-schema/spec": "^1.1.0", "@types/chai": "^5.2.2", "@vitest/spy": "4.1.5", "@vitest/utils": "4.1.5", "chai": "^6.2.2", "tinyrainbow": "^3.1.0" } }, "sha512-PWBaRY5JoKuRnHlUHfpV/KohFylaDZTupcXN1H9vYryNLOnitSw60Mw9IAE2r67NbwwzBw/Cc/8q9BK3kIX8Kw=="],
+
+    "@vitest/mocker": ["@vitest/mocker@4.1.5", "", { "dependencies": { "@vitest/spy": "4.1.5", "estree-walker": "^3.0.3", "magic-string": "^0.30.21" }, "peerDependencies": { "msw": "^2.4.9", "vite": "^6.0.0 || ^7.0.0 || ^8.0.0" }, "optionalPeers": ["msw", "vite"] }, "sha512-/x2EmFC4mT4NNzqvC3fmesuV97w5FC903KPmey4gsnJiMQ3Be1IlDKVaDaG8iqaLFHqJ2FVEkxZk5VmeLjIItw=="],
+
+    "@vitest/pretty-format": ["@vitest/pretty-format@4.1.5", "", { "dependencies": { "tinyrainbow": "^3.1.0" } }, "sha512-7I3q6l5qr03dVfMX2wCo9FxwSJbPdwKjy2uu/YPpU3wfHvIL4QHwVRp57OfGrDFeUJ8/8QdfBKIV12FTtLn00g=="],
+
+    "@vitest/runner": ["@vitest/runner@4.1.5", "", { "dependencies": { "@vitest/utils": "4.1.5", "pathe": "^2.0.3" } }, "sha512-2D+o7Pr82IEO46YPpoA/YU0neeyr6FTerQb5Ro7BUnBuv6NQtT/kmVnczngiMEBhzgqz2UZYl5gArejsyERDSQ=="],
+
+    "@vitest/snapshot": ["@vitest/snapshot@4.1.5", "", { "dependencies": { "@vitest/pretty-format": "4.1.5", "@vitest/utils": "4.1.5", "magic-string": "^0.30.21", "pathe": "^2.0.3" } }, "sha512-zypXEt4KH/XgKGPUz4eC2AvErYx0My5hfL8oDb1HzGFpEk1P62bxSohdyOmvz+d9UJwanI68MKwr2EquOaOgMQ=="],
+
+    "@vitest/spy": ["@vitest/spy@4.1.5", "", {}, "sha512-2lNOsh6+R2Idnf1TCZqSwYlKN2E/iDlD8sgU59kYVl+OMDmvldO1VDk39smRfpUNwYpNRVn3w4YfuC7KfbBnkQ=="],
+
+    "@vitest/utils": ["@vitest/utils@4.1.5", "", { "dependencies": { "@vitest/pretty-format": "4.1.5", "convert-source-map": "^2.0.0", "tinyrainbow": "^3.1.0" } }, "sha512-76wdkrmfXfqGjueGgnb45ITPyUi1ycZ4IHgC2bhPDUfWHklY/q3MdLOAB+TF1e6xfl8NxNY0ZYaPCFNWSsw3Ug=="],
+
     "acorn": ["acorn@8.15.0", "", { "bin": { "acorn": "bin/acorn" } }, "sha512-NZyJarBfL7nWwIq+FDL6Zp/yHEhePMNnnJ0y3qfieCrmNvYct8uvtiV41UvlSe6apAfk0fY1FbWx+NwfmpvtTg=="],
 
     "acorn-jsx": ["acorn-jsx@5.3.2", "", { "peerDependencies": { "acorn": "^6.0.0 || ^7.0.0 || ^8.0.0" } }, "sha512-rq9s+JNhf0IChjtDXxllJ7g41oZk5SlXtp0LHwyA5cejwn7vKmKp4pPri6YEePv2PU65sAsegbXtIinmDFDXgQ=="],
@@ -351,6 +370,8 @@
 
     "aria-query": ["aria-query@5.3.2", "", {}, "sha512-COROpnaoap1E2F000S62r6A60uHZnmlvomhfyT2DlTcrY1OrBKn2UhH7qn5wTC9zMvD0AY7csdPSNwKP+7WiQw=="],
 
+    "assertion-error": ["assertion-error@2.0.1", "", {}, "sha512-Izi8RQcffqCeNVgFigKli1ssklIbpHnCYc6AknXGYoB6grJqyeby7jv12JUQgmTAnIDnbck1uxksT4dzN3PWBA=="],
+
     "axobject-query": ["axobject-query@4.1.0", "", {}, "sha512-qIj0G9wZbMGNLjLmg1PT6v2mE9AH2zlnADJD/2tC6E00hgmhUOfEB6greHPAfLRSufHqROIUTkw6E+M3lH0PTQ=="],
 
     "balanced-match": ["balanced-match@1.0.2", "", {}, "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw=="],
@@ -365,6 +386,8 @@
 
     "ccount": ["ccount@2.0.1", "", {}, "sha512-eyrF0jiFpY+3drT6383f1qhkbGsLSifNAjA61IUjZjmLCWjItY6LB9ft9YhoDgwfmclB2zhu51Lc7+95b8NRAg=="],
 
+    "chai": ["chai@6.2.2", "", {}, "sha512-NUPRluOfOiTKBKvWPtSD4PhFvWCqOi0BGStNWs57X9js7XGTprSmFoz5F0tWhR4WPjNeR9jXqdC7/UpSJTnlRg=="],
+
     "chalk": ["chalk@4.1.2", "", { "dependencies": { "ansi-styles": "^4.1.0", "supports-color": "^7.1.0" } }, "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA=="],
 
     "change-case": ["change-case@5.4.4", "", {}, "sha512-HRQyTk2/YPEkt9TnUPbOpr64Uw3KOicFWPVBb+xiHvd6eBx/qPr9xqfBFDT8P2vWsvvz4jbEkfDe71W3VyNu2w=="],
@@ -387,6 +410,8 @@
 
     "concat-map": ["concat-map@0.0.1", "", {}, "sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg=="],
 
+    "convert-source-map": ["convert-source-map@2.0.0", "", {}, "sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg=="],
+
     "cookie": ["cookie@0.6.0", "", {}, "sha512-U71cyTamuh1CRNCfpGY6to28lxvNwPG4Guz/EVjgf3Jmzv0vlDp1atT9eS5dDjMYHucpHbWns6Lwf3BKz6svdw=="],
 
     "cross-spawn": ["cross-spawn@7.0.6", "", { "dependencies": { "path-key": "^3.1.0", "shebang-command": "^2.0.0", "which": "^2.0.1" } }, "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA=="],
@@ -421,6 +446,8 @@
 
     "entities": ["entities@6.0.1", "", {}, "sha512-aN97NXWF6AWBTahfVOIrB/NShkzi5H7F9r1s9mD3cDj4Ko5f2qhhVoYMibXF7GlLveb/D2ioWay8lxI97Ven3g=="],
 
+    "es-module-lexer": ["es-module-lexer@2.1.0", "", {}, "sha512-n27zTYMjYu1aj4MjCWzSP7G9r75utsaoc8m61weK+W8JMBGGQybd43GstCXZ3WNmSFtGT9wi59qQTW6mhTR5LQ=="],
+
     "esbuild": ["esbuild@0.27.2", "", { "optionalDependencies": { "@esbuild/aix-ppc64": "0.27.2", "@esbuild/android-arm": "0.27.2", "@esbuild/android-arm64": "0.27.2", "@esbuild/android-x64": "0.27.2", "@esbuild/darwin-arm64": "0.27.2", "@esbuild/darwin-x64": "0.27.2", "@esbuild/freebsd-arm64": "0.27.2", "@esbuild/freebsd-x64": "0.27.2", "@esbuild/linux-arm": "0.27.2", "@esbuild/linux-arm64": "0.27.2", "@esbuild/linux-ia32": "0.27.2", "@esbuild/linux-loong64": "0.27.2", "@esbuild/linux-mips64el": "0.27.2", "@esbuild/linux-ppc64": "0.27.2", "@esbuild/linux-riscv64": "0.27.2", "@esbuild/linux-s390x": "0.27.2", "@esbuild/linux-x64": "0.27.2", "@esbuild/netbsd-arm64": "0.27.2", "@esbuild/netbsd-x64": "0.27.2", "@esbuild/openbsd-arm64": "0.27.2", "@esbuild/openbsd-x64": "0.27.2", "@esbuild/openharmony-arm64": "0.27.2", "@esbuild/sunos-x64": "0.27.2", "@esbuild/win32-arm64": "0.27.2", "@esbuild/win32-ia32": "0.27.2", "@esbuild/win32-x64": "0.27.2" }, "bin": { "esbuild": "bin/esbuild" } }, "sha512-HyNQImnsOC7X9PMNaCIeAm4ISCQXs5a5YasTXVliKv4uuBo1dKrG0A+uQS8M5eXjVMnLg3WgXaKvprHlFJQffw=="],
 
     "escape-string-regexp": ["escape-string-regexp@4.0.0", "", {}, "sha512-TtpcNJ3XAzx3Gq8sWRzJaVajRs0uVxA2YAkdb1jm2YkPz4G6egUFAyA3n5vtEIZefPk5Wa4UXbKuS5fKkJWdgA=="],
@@ -447,8 +474,12 @@
 
     "estraverse": ["estraverse@5.3.0", "", {}, "sha512-MMdARuVEQziNTeJD8DgMqmhwR11BRQ/cBP+pLtYdSTnf3MIO8fFeiINEbX36ZdNlfU/7A9f3gUw49B3oQsvwBA=="],
 
+    "estree-walker": ["estree-walker@3.0.3", "", { "dependencies": { "@types/estree": "^1.0.0" } }, "sha512-7RUKfXgSMMkzt6ZuXmqapOurLGPPfgj6l9uRZ7lRGolvk0y2yocc35LdcxKC5PQZdn2DMqioAQ2NoWcrTKmm6g=="],
+
     "esutils": ["esutils@2.0.3", "", {}, "sha512-kVscqXk4OCp68SZ0dkgEKVi6/8ij300KBWTJq32P/dYeWTSwK41WyTxalN1eRmA5Z9UU/LX9D7FWSmV9SAYx6g=="],
 
+    "expect-type": ["expect-type@1.3.0", "", {}, "sha512-knvyeauYhqjOYvQ66MznSMs83wmHrCycNEN6Ao+2AeYEfxUIkuiVxdEa1qlGEPK+We3n0THiDciYSsCcgW/DoA=="],
+
     "fast-deep-equal": ["fast-deep-equal@3.1.3", "", {}, "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q=="],
 
     "fast-json-stable-stringify": ["fast-json-stable-stringify@2.1.0", "", {}, "sha512-lhd/wF+Lk98HZoTCtlVraHtfh5XYijIjalXck7saUtuanSDyLMxnHhSXEDJqHxD7msR8D0uCmqlkwjCV8xvwHw=="],
@@ -627,6 +658,8 @@
 
     "path-key": ["path-key@3.1.1", "", {}, "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q=="],
 
+    "pathe": ["pathe@2.0.3", "", {}, "sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w=="],
+
     "picocolors": ["picocolors@1.1.1", "", {}, "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA=="],
 
     "picomatch": ["picomatch@4.0.3", "", {}, "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q=="],
@@ -685,12 +718,18 @@
 
     "shiki": ["shiki@4.0.0", "", { "dependencies": { "@shikijs/core": "4.0.0", "@shikijs/engine-javascript": "4.0.0", "@shikijs/engine-oniguruma": "4.0.0", "@shikijs/langs": "4.0.0", "@shikijs/themes": "4.0.0", "@shikijs/types": "4.0.0", "@shikijs/vscode-textmate": "^10.0.2", "@types/hast": "^3.0.4" } }, "sha512-rjKoiw30ZaFsM0xnPPwxco/Jftz/XXqZkcQZBTX4LGheDw8gCDEH87jdgaKDEG3FZO2bFOK27+sR/sDHhbBXfg=="],
 
+    "siginfo": ["siginfo@2.0.0", "", {}, "sha512-ybx0WO1/8bSBLEWXZvEd7gMW3Sn3JFlW3TvX1nREbDLRNQNaeNN8WK0meBwPdAaOI7TtRRRJn/Es1zhrrCHu7g=="],
+
     "sirv": ["sirv@3.0.2", "", { "dependencies": { "@polka/url": "^1.0.0-next.24", "mrmime": "^2.0.0", "totalist": "^3.0.0" } }, "sha512-2wcC/oGxHis/BoHkkPwldgiPSYcpZK3JU28WoMVv55yHJgcZ8rlXvuG9iZggz+sU1d4bRgIGASwyWqjxu3FM0g=="],
 
     "source-map-js": ["source-map-js@1.2.1", "", {}, "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA=="],
 
     "space-separated-tokens": ["space-separated-tokens@2.0.2", "", {}, "sha512-PEGlAwrG8yXGXRjW32fGbg66JAlOAwbObuqVoJpv/mRgoWDQfgH1wDPvtzWyUSNAXBGSk8h755YDbbcEy3SH2Q=="],
 
+    "stackback": ["stackback@0.0.2", "", {}, "sha512-1XMJE5fQo1jGH6Y/7ebnwPOBEkIEnT4QF32d5R1+VXdXveM0IBMJt8zfaxX1P3QhVwrYe+576+jkANtSS2mBbw=="],
+
+    "std-env": ["std-env@4.1.0", "", {}, "sha512-Rq7ybcX2RuC55r9oaPVEW7/xu3tj8u4GeBYHBWCychFtzMIr86A7e3PPEBPT37sHStKX3+TiX/Fr/ACmJLVlLQ=="],
+
     "stringify-entities": ["stringify-entities@4.0.4", "", { "dependencies": { "character-entities-html4": "^2.0.0", "character-entities-legacy": "^3.0.0" } }, "sha512-IwfBptatlO+QCJUo19AqvrPNqlVMpW9YEL2LIVY+Rpv2qsjCGxaDLNRgeGsQWJhfItebuJhsGSLjaBbNSQ+ieg=="],
 
     "strip-json-comments": ["strip-json-comments@3.1.1", "", {}, "sha512-6fPc+R4ihwqP6N/aIv2f1gMH8lOVtWQHoqC4yK6oSDVVocumAsfCqjkXnqiYMhmMwS/mEHLp7Vehlt3ql6lEig=="],
@@ -709,8 +748,14 @@
 
     "tapable": ["tapable@2.3.0", "", {}, "sha512-g9ljZiwki/LfxmQADO3dEY1CbpmXT5Hm2fJ+QaGKwSXUylMybePR7/67YW7jOrrvjEgL1Fmz5kzyAjWVWLlucg=="],
 
+    "tinybench": ["tinybench@2.9.0", "", {}, "sha512-0+DUvqWMValLmha6lr4kD8iAMK1HzV0/aKnCtWb9v9641TnP/MFb7Pc2bxoxQjTXAErryXVgUOfv2YqNllqGeg=="],
+
+    "tinyexec": ["tinyexec@1.1.2", "", {}, "sha512-dAqSqE/RabpBKI8+h26GfLq6Vb3JVXs30XYQjdMjaj/c2tS8IYYMbIzP599KtRj7c57/wYApb3QjgRgXmrCukA=="],
+
     "tinyglobby": ["tinyglobby@0.2.15", "", { "dependencies": { "fdir": "^6.5.0", "picomatch": "^4.0.3" } }, "sha512-j2Zq4NyQYG5XMST4cbs02Ak8iJUdxRM0XI5QyxXuZOzKOINmWurp3smXu3y5wDcJrptwpSjgXHzIQxR0omXljQ=="],
 
+    "tinyrainbow": ["tinyrainbow@3.1.0", "", {}, "sha512-Bf+ILmBgretUrdJxzXM0SgXLZ3XfiaUuOj/IKQHuTXip+05Xn+uyEYdVg0kYDipTBcLrCVyUzAPz7QmArb0mmw=="],
+
     "tldts": ["tldts@7.0.23", "", { "dependencies": { "tldts-core": "^7.0.23" }, "bin": { "tldts": "bin/cli.js" } }, "sha512-ASdhgQIBSay0R/eXggAkQ53G4nTJqTXqC2kbaBbdDwM7SkjyZyO0OaaN1/FH7U/yCeqOHDwFO5j8+Os/IS1dXw=="],
 
     "tldts-core": ["tldts-core@7.0.23", "", {}, "sha512-0g9vrtDQLrNIiCj22HSe9d4mLVG3g5ph5DZ8zCKBr4OtrspmNB6ss7hVyzArAeE88ceZocIEGkyW1Ime7fxPtQ=="],
@@ -757,6 +802,8 @@
 
     "vitefu": ["vitefu@1.1.1", "", { "peerDependencies": { "vite": "^3.0.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0-beta.0" }, "optionalPeers": ["vite"] }, "sha512-B/Fegf3i8zh0yFbpzZ21amWzHmuNlLlmJT6n7bu5e+pCHUKQIfXSYokrqOBGEMMe9UG2sostKQF9mml/vYaWJQ=="],
 
+    "vitest": ["vitest@4.1.5", "", { "dependencies": { "@vitest/expect": "4.1.5", "@vitest/mocker": "4.1.5", "@vitest/pretty-format": "4.1.5", "@vitest/runner": "4.1.5", "@vitest/snapshot": "4.1.5", "@vitest/spy": "4.1.5", "@vitest/utils": "4.1.5", "es-module-lexer": "^2.0.0", "expect-type": "^1.3.0", "magic-string": "^0.30.21", "obug": "^2.1.1", "pathe": "^2.0.3", "picomatch": "^4.0.3", "std-env": "^4.0.0-rc.1", "tinybench": "^2.9.0", "tinyexec": "^1.0.2", "tinyglobby": "^0.2.15", "tinyrainbow": "^3.1.0", "vite": "^6.0.0 || ^7.0.0 || ^8.0.0", "why-is-node-running": "^2.3.0" }, "peerDependencies": { "@edge-runtime/vm": "*", "@opentelemetry/api": "^1.9.0", "@types/node": "^20.0.0 || ^22.0.0 || >=24.0.0", "@vitest/browser-playwright": "4.1.5", "@vitest/browser-preview": "4.1.5", "@vitest/browser-webdriverio": "4.1.5", "@vitest/coverage-istanbul": "4.1.5", "@vitest/coverage-v8": "4.1.5", "@vitest/ui": "4.1.5", "happy-dom": "*", "jsdom": "*" }, "optionalPeers": ["@edge-runtime/vm", "@opentelemetry/api", "@types/node", "@vitest/browser-playwright", "@vitest/browser-preview", "@vitest/browser-webdriverio", "@vitest/coverage-istanbul", "@vitest/coverage-v8", "@vitest/ui", "happy-dom", "jsdom"], "bin": { "vitest": "vitest.mjs" } }, "sha512-9Xx1v3/ih3m9hN+SbfkUyy0JAs72ap3r7joc87XL6jwF0jGg6mFBvQ1SrwaX+h8BlkX6Hz9shdd1uo6AF+ZGpg=="],
+
     "w3c-xmlserializer": ["w3c-xmlserializer@5.0.0", "", { "dependencies": { "xml-name-validator": "^5.0.0" } }, "sha512-o8qghlI8NZHU1lLPrpi2+Uq7abh4GGPpYANlalzWxyWteJOCsr/P+oPBA49TOLu5FTZO4d3F9MnWJfiMo4BkmA=="],
 
     "webidl-conversions": ["webidl-conversions@8.0.1", "", {}, "sha512-BMhLD/Sw+GbJC21C/UgyaZX41nPt8bUTg+jWyDeg7e7YN4xOM05YPSIXceACnXVtqyEw/LMClUQMtMZ+PGGpqQ=="],
@@ -767,6 +814,8 @@
 
     "which": ["which@2.0.2", "", { "dependencies": { "isexe": "^2.0.0" }, "bin": { "node-which": "./bin/node-which" } }, "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA=="],
 
+    "why-is-node-running": ["why-is-node-running@2.3.0", "", { "dependencies": { "siginfo": "^2.0.0", "stackback": "0.0.2" }, "bin": { "why-is-node-running": "cli.js" } }, "sha512-hUrmaWBdVDcxvYqnyh09zunKzROWjbZTiNy8dBEjkS7ehEDQibXJ7XvlmtbwuTclUiIyN+CyXQD4Vmko8fNm8w=="],
+
     "word-wrap": ["word-wrap@1.2.5", "", {}, "sha512-BN22B5eaMMI9UMtjrGd5g5eCYPpCPDUy0FJXbYsaT5zYxjFOckS53SQDE3pWkVoWpHXVb3BrYcEN4Twa55B5cA=="],
 
     "xml-name-validator": ["xml-name-validator@5.0.0", "", {}, "sha512-EvGK8EJ3DhaHfbRlETOWAS5pO9MZITeauHKJyb8wyajUfQUenkIg2MvLDTZ4T/TgIcm3HU0TFBgWWboAZ30UHg=="],
diff --git a/web/package.json b/web/package.json
index 86924a4..5fc9659 100644
--- a/web/package.json
+++ b/web/package.json
@@ -14,7 +14,7 @@
 		"lint:fix": "biome lint --write . && eslint . --fix",
 		"format": "biome format --write . && prettier --write '**/*.svelte'",
 		"format:check": "biome format . && prettier --check '**/*.svelte'",
-		"test": "playwright test",
+		"test": "vitest run",
 		"test:e2e": "playwright test --config playwright.e2e.config.ts",
 		"test:ui": "playwright test --ui",
 		"generate": "openapi-typescript ../api/openapi.yaml -o src/lib/api/types.ts"
@@ -43,7 +43,8 @@
 		"svelte-check": "^4.3.4",
 		"tailwindcss": "^4.0.0",
 		"typescript": "^5.9.3",
-		"vite": "^7.2.6"
+		"vite": "^7.2.6",
+		"vitest": "^4.1.5"
 	},
 	"dependencies": {
 		"isomorphic-dompurify": "^3.0.0",
diff --git a/web/src/lib/paste/crypto.test.ts b/web/src/lib/paste/crypto.test.ts
new file mode 100644
index 0000000..5326ba9
--- /dev/null
+++ b/web/src/lib/paste/crypto.test.ts
@@ -0,0 +1,42 @@
+import { describe, it, expect } from 'vitest';
+import {
+	generateKey,
+	encryptJSON,
+	decryptJSON,
+	exportKey,
+	importKey,
+	base64UrlEncode,
+	base64UrlDecode,
+} from './crypto';
+
+describe('paste crypto', () => {
+	it('round-trips JSON', async () => {
+		const key = await generateKey();
+		const value = { hello: 'world', n: 42 };
+		const { blob, iv } = await encryptJSON(value, key);
+		const decoded = await decryptJSON<typeof value>(blob, iv, key);
+		expect(decoded).toEqual(value);
+	});
+
+	it('fails to decrypt with wrong key', async () => {
+		const k1 = await generateKey();
+		const k2 = await generateKey();
+		const { blob, iv } = await encryptJSON('secret', k1);
+		await expect(decryptJSON(blob, iv, k2)).rejects.toBeDefined();
+	});
+
+	it('exports and re-imports key losslessly', async () => {
+		const k = await generateKey();
+		const exported = await exportKey(k);
+		const imported = await importKey(exported);
+		const { blob, iv } = await encryptJSON('hi', k);
+		const out = await decryptJSON<string>(blob, iv, imported);
+		expect(out).toBe('hi');
+	});
+
+	it('base64url round-trips arbitrary bytes', () => {
+		const bytes = new Uint8Array([0, 255, 1, 254, 100]);
+		const decoded = base64UrlDecode(base64UrlEncode(bytes));
+		expect([...decoded]).toEqual([...bytes]);
+	});
+});
diff --git a/web/src/lib/paste/crypto.ts b/web/src/lib/paste/crypto.ts
new file mode 100644
index 0000000..6135e45
--- /dev/null
+++ b/web/src/lib/paste/crypto.ts
@@ -0,0 +1,49 @@
+const ALGO = 'AES-GCM';
+const KEY_LEN_BITS = 256;
+const IV_LEN_BYTES = 12;
+
+export async function generateKey(): Promise<CryptoKey> {
+	return crypto.subtle.generateKey({ name: ALGO, length: KEY_LEN_BITS }, true, [
+		'encrypt',
+		'decrypt',
+	]);
+}
+
+export async function exportKey(key: CryptoKey): Promise<string> {
+	const raw = await crypto.subtle.exportKey('raw', key);
+	return base64UrlEncode(new Uint8Array(raw));
+}
+
+export async function importKey(b64url: string): Promise<CryptoKey> {
+	const raw = base64UrlDecode(b64url);
+	return crypto.subtle.importKey('raw', raw, { name: ALGO }, true, ['encrypt', 'decrypt']);
+}
+
+export async function encryptJSON<T>(
+	value: T,
+	key: CryptoKey,
+): Promise<{ blob: Uint8Array; iv: Uint8Array }> {
+	const iv = crypto.getRandomValues(new Uint8Array(IV_LEN_BYTES));
+	const plaintext = new TextEncoder().encode(JSON.stringify(value));
+	const ct = await crypto.subtle.encrypt({ name: ALGO, iv }, key, plaintext);
+	return { blob: new Uint8Array(ct), iv };
+}
+
+export async function decryptJSON<T>(blob: Uint8Array, iv: Uint8Array, key: CryptoKey): Promise<T> {
+	const plain = await crypto.subtle.decrypt({ name: ALGO, iv }, key, blob);
+	return JSON.parse(new TextDecoder().decode(plain)) as T;
+}
+
+export function base64UrlEncode(bytes: Uint8Array): string {
+	let s = btoa(String.fromCharCode(...bytes));
+	return s.replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+
+export function base64UrlDecode(s: string): Uint8Array {
+	const pad = s.length % 4 === 0 ? '' : '='.repeat(4 - (s.length % 4));
+	const b64 = s.replace(/-/g, '+').replace(/_/g, '/') + pad;
+	const bin = atob(b64);
+	const out = new Uint8Array(bin.length);
+	for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
+	return out;
+}
diff --git a/web/src/lib/paste/types.ts b/web/src/lib/paste/types.ts
new file mode 100644
index 0000000..55ca90c
--- /dev/null
+++ b/web/src/lib/paste/types.ts
@@ -0,0 +1,85 @@
+export type PasteShareResponse = {
+	id: string;
+	plan_blob: string;
+	plan_iv: string;
+	schema_ver: number;
+	created_at: string;
+	updated_at: string;
+	expires_at?: string;
+};
+
+export type PasteEventResponse = {
+	id: string;
+	share_id: string;
+	blob: string;
+	iv: string;
+	created_at: string;
+};
+
+export type GetPasteResponse = PasteShareResponse & { events: PasteEventResponse[] };
+
+export type CreatePasteRequest = {
+	plan_blob: string;
+	plan_iv: string;
+	schema_ver: number;
+	expires_at?: string;
+};
+
+export type CreatePasteResponse = { id: string; edit_token: string };
+
+export type AppendEventRequest = { blob: string; iv: string };
+
+export type PlanPlaintext = {
+	version: 1;
+	markdown: string;
+	title?: string;
+	author_name?: string;
+	created_at: string;
+};
+
+export type CommentType = 'comment' | 'praise' | 'issue' | 'suggestion' | 'question' | 'nit';
+export type Severity = 'important' | 'nit';
+export type ResolutionStatus = 'accepted' | 'rejected' | 'resolved' | 'reopened';
+
+export type Anchor = {
+	line_start: number;
+	line_end: number;
+	char_start?: number;
+	char_end?: number;
+	quoted_text: string;
+	context_before?: string;
+	context_after?: string;
+	heading_slug?: string;
+};
+
+export type CommentEvent = {
+	kind: 'comment';
+	id: string;
+	author_name: string;
+	comment_type: CommentType;
+	severity?: Severity;
+	body: string;
+	suggested_text?: string;
+	parent_id?: string;
+	anchor: Anchor;
+	created_at: string;
+};
+
+export type ResolutionEvent = {
+	kind: 'resolution';
+	id: string;
+	comment_id: string;
+	status: ResolutionStatus;
+	reply?: string;
+	author_name: string;
+	created_at: string;
+};
+
+export type PlanEditEvent = {
+	kind: 'plan_edit';
+	id: string;
+	edit_summary?: string;
+	created_at: string;
+};
+
+export type EventPlaintext = CommentEvent | ResolutionEvent | PlanEditEvent;
diff --git a/web/vitest.config.ts b/web/vitest.config.ts
new file mode 100644
index 0000000..f5a2891
--- /dev/null
+++ b/web/vitest.config.ts
@@ -0,0 +1,7 @@
+import { defineConfig } from 'vitest/config';
+
+export default defineConfig({
+	test: {
+		environment: 'node',
+	},
+});

From 4d537276735ff109c9fdd98dec77b60b78ac6295 Mon Sep 17 00:00:00 2001
From: Ben Firestone <ben.firestone@krypticlabs.com>
Date: Wed, 29 Apr 2026 13:47:29 -0700
Subject: [PATCH 03/20] fix(paste): coerce Uint8Array to BufferSource for Web
 Crypto API

---
 web/src/lib/paste/crypto.ts | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/web/src/lib/paste/crypto.ts b/web/src/lib/paste/crypto.ts
index 6135e45..8b23e65 100644
--- a/web/src/lib/paste/crypto.ts
+++ b/web/src/lib/paste/crypto.ts
@@ -15,7 +15,9 @@ export async function exportKey(key: CryptoKey): Promise<string> {
 }
 
 export async function importKey(b64url: string): Promise<CryptoKey> {
-	const raw = base64UrlDecode(b64url);
+	const decoded = base64UrlDecode(b64url);
+	// Copy to ensure backing buffer is ArrayBuffer, not SharedArrayBuffer
+	const raw = new Uint8Array(decoded.buffer.slice(decoded.byteOffset, decoded.byteOffset + decoded.byteLength)) as Uint8Array<ArrayBuffer>;
 	return crypto.subtle.importKey('raw', raw, { name: ALGO }, true, ['encrypt', 'decrypt']);
 }
 
@@ -25,12 +27,22 @@ export async function encryptJSON<T>(
 ): Promise<{ blob: Uint8Array; iv: Uint8Array }> {
 	const iv = crypto.getRandomValues(new Uint8Array(IV_LEN_BYTES));
 	const plaintext = new TextEncoder().encode(JSON.stringify(value));
-	const ct = await crypto.subtle.encrypt({ name: ALGO, iv }, key, plaintext);
+	// Copy to ensure backing buffer is ArrayBuffer, not SharedArrayBuffer
+	const plaintextAsArrayBuffer = plaintext as unknown as Uint8Array<ArrayBuffer>;
+	const plaintextCopy = new Uint8Array(plaintextAsArrayBuffer.buffer.slice(plaintextAsArrayBuffer.byteOffset, plaintextAsArrayBuffer.byteOffset + plaintextAsArrayBuffer.byteLength)) as Uint8Array<ArrayBuffer>;
+	const ct = await crypto.subtle.encrypt({ name: ALGO, iv }, key, plaintextCopy);
 	return { blob: new Uint8Array(ct), iv };
 }
 
 export async function decryptJSON<T>(blob: Uint8Array, iv: Uint8Array, key: CryptoKey): Promise<T> {
-	const plain = await crypto.subtle.decrypt({ name: ALGO, iv }, key, blob);
+	// Copy to ensure backing buffer is ArrayBuffer, not SharedArrayBuffer
+	const blobAsArrayBuffer = blob as unknown as Uint8Array<ArrayBuffer>;
+	const ivAsArrayBuffer = iv as unknown as Uint8Array<ArrayBuffer>;
+	const plain = await crypto.subtle.decrypt(
+		{ name: ALGO, iv: ivAsArrayBuffer },
+		key,
+		new Uint8Array((blobAsArrayBuffer as Uint8Array<ArrayBuffer>).buffer.slice((blobAsArrayBuffer as Uint8Array<ArrayBuffer>).byteOffset, (blobAsArrayBuffer as Uint8Array<ArrayBuffer>).byteOffset + (blobAsArrayBuffer as Uint8Array<ArrayBuffer>).byteLength)) as any,
+	);
 	return JSON.parse(new TextDecoder().decode(plain)) as T;
 }
 

From 1dabc299ecbe3c3e128c4819206b1eb5e95ba7f4 Mon Sep 17 00:00:00 2001
From: Ben Firestone <ben.firestone@krypticlabs.com>
Date: Wed, 29 Apr 2026 13:50:33 -0700
Subject: [PATCH 04/20] feat(paste): add HTTP handlers for /api/paste/*

Implements five endpoints (POST, GET, PUT, DELETE, POST blobs) with
Bearer token auth, proper HTTP status codes, and 10 test cases covering
happy paths, auth errors, and missing resource cases.
---
 internal/paste/handlers.go      | 203 ++++++++++++++++++++++++++
 internal/paste/handlers_test.go | 249 ++++++++++++++++++++++++++++++++
 2 files changed, 452 insertions(+)
 create mode 100644 internal/paste/handlers.go
 create mode 100644 internal/paste/handlers_test.go

diff --git a/internal/paste/handlers.go b/internal/paste/handlers.go
new file mode 100644
index 0000000..4d335cb
--- /dev/null
+++ b/internal/paste/handlers.go
@@ -0,0 +1,203 @@
+package paste
+
+import (
+	"crypto/rand"
+	"encoding/hex"
+	"errors"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/labstack/echo/v4"
+)
+
+// Handlers holds the paste HTTP handler dependencies.
+type Handlers struct {
+	store Storage
+}
+
+// NewHandlers creates a new Handlers with the given storage backend.
+func NewHandlers(s Storage) *Handlers {
+	return &Handlers{store: s}
+}
+
+// Register mounts the paste endpoints on the provided echo.Group.
+func (h *Handlers) Register(g *echo.Group) {
+	g.POST("", h.createPaste)
+	g.GET("/:id", h.getPaste)
+	g.PUT("/:id", h.updatePaste)
+	g.DELETE("/:id", h.deletePaste)
+	g.POST("/:id/blobs", h.appendEvent)
+}
+
+func (h *Handlers) createPaste(c echo.Context) error {
+	var req CreatePasteRequest
+	if err := c.Bind(&req); err != nil {
+		return echo.NewHTTPError(http.StatusBadRequest, err.Error())
+	}
+	if len(req.PlanBlob) == 0 || len(req.PlanIV) == 0 {
+		return echo.NewHTTPError(http.StatusBadRequest, "plan_blob and plan_iv required")
+	}
+	id, err := newShareID()
+	if err != nil {
+		return err
+	}
+	token, err := newEditToken()
+	if err != nil {
+		return err
+	}
+	now := time.Now().UTC()
+	sh := PasteShare{
+		ID:        id,
+		PlanBlob:  req.PlanBlob,
+		PlanIV:    req.PlanIV,
+		SchemaVer: req.SchemaVer,
+		CreatedAt: now,
+		UpdatedAt: now,
+		ExpiresAt: req.ExpiresAt,
+	}
+	if err := h.store.CreateShare(c.Request().Context(), sh, token); err != nil {
+		return err
+	}
+	return c.JSON(http.StatusCreated, CreatePasteResponse{ID: id, EditToken: token})
+}
+
+func (h *Handlers) getPaste(c echo.Context) error {
+	id := c.Param("id")
+	sh, err := h.store.GetShare(c.Request().Context(), id)
+	if err != nil {
+		if errors.Is(err, ErrShareNotFound) {
+			return echo.NewHTTPError(http.StatusNotFound, "not found")
+		}
+		return err
+	}
+	events, err := h.store.ListEvents(c.Request().Context(), id)
+	if err != nil {
+		return err
+	}
+	if events == nil {
+		events = []PasteEvent{}
+	}
+	return c.JSON(http.StatusOK, GetPasteResponse{PasteShare: *sh, Events: events})
+}
+
+func (h *Handlers) updatePaste(c echo.Context) error {
+	id := c.Param("id")
+	token, err := bearerToken(c)
+	if err != nil {
+		return err
+	}
+	var req struct {
+		PlanBlob []byte `json:"plan_blob"`
+		PlanIV   []byte `json:"plan_iv"`
+	}
+	if err := c.Bind(&req); err != nil {
+		return echo.NewHTTPError(http.StatusBadRequest, err.Error())
+	}
+	if err := h.store.UpdateSharePlan(c.Request().Context(), id, req.PlanBlob, req.PlanIV, token); err != nil {
+		if errors.Is(err, ErrInvalidEditToken) {
+			return echo.NewHTTPError(http.StatusForbidden, "invalid edit token")
+		}
+		if errors.Is(err, ErrShareNotFound) {
+			return echo.NewHTTPError(http.StatusNotFound, "not found")
+		}
+		return err
+	}
+	return c.NoContent(http.StatusNoContent)
+}
+
+func (h *Handlers) deletePaste(c echo.Context) error {
+	id := c.Param("id")
+	token, err := bearerToken(c)
+	if err != nil {
+		return err
+	}
+	if err := h.store.DeleteShare(c.Request().Context(), id, token); err != nil {
+		if errors.Is(err, ErrInvalidEditToken) {
+			return echo.NewHTTPError(http.StatusForbidden, "invalid edit token")
+		}
+		if errors.Is(err, ErrShareNotFound) {
+			return echo.NewHTTPError(http.StatusNotFound, "not found")
+		}
+		return err
+	}
+	return c.NoContent(http.StatusNoContent)
+}
+
+func (h *Handlers) appendEvent(c echo.Context) error {
+	id := c.Param("id")
+	if _, err := h.store.GetShare(c.Request().Context(), id); err != nil {
+		if errors.Is(err, ErrShareNotFound) {
+			return echo.NewHTTPError(http.StatusNotFound, "not found")
+		}
+		return err
+	}
+	var req AppendEventRequest
+	if err := c.Bind(&req); err != nil {
+		return echo.NewHTTPError(http.StatusBadRequest, err.Error())
+	}
+	if len(req.Blob) == 0 || len(req.IV) == 0 {
+		return echo.NewHTTPError(http.StatusBadRequest, "blob and iv required")
+	}
+	eventID, err := newEventID()
+	if err != nil {
+		return err
+	}
+	e := PasteEvent{
+		ID:        eventID,
+		ShareID:   id,
+		Blob:      req.Blob,
+		IV:        req.IV,
+		CreatedAt: time.Now().UTC(),
+	}
+	if err := h.store.AppendEvent(c.Request().Context(), e); err != nil {
+		return err
+	}
+	return c.JSON(http.StatusCreated, map[string]string{"id": eventID})
+}
+
+// bearerToken extracts the Bearer token from the Authorization header.
+func bearerToken(c echo.Context) (string, error) {
+	auth := c.Request().Header.Get("Authorization")
+	const prefix = "Bearer "
+	if !strings.HasPrefix(auth, prefix) {
+		return "", echo.NewHTTPError(http.StatusUnauthorized, "missing bearer token")
+	}
+	return strings.TrimPrefix(auth, prefix), nil
+}
+
+// newShareID returns an 8-character Crockford base32 (lowercase, without i/l/o/u) ID.
+func newShareID() (string, error) {
+	const alphabet = "0123456789abcdefghjkmnpqrstvwxyz"
+	buf := make([]byte, 8)
+	if _, err := rand.Read(buf); err != nil {
+		return "", err
+	}
+	out := make([]byte, 8)
+	for i := range out {
+		out[i] = alphabet[int(buf[i])%len(alphabet)]
+	}
+	return string(out), nil
+}
+
+// newEditToken returns a 64-character hex-encoded random token (32 random bytes).
+func newEditToken() (string, error) {
+	buf := make([]byte, 32)
+	if _, err := rand.Read(buf); err != nil {
+		return "", err
+	}
+	return hex.EncodeToString(buf), nil
+}
+
+// newEventID returns a time-prefixed random hex event ID.
+func newEventID() (string, error) {
+	buf := make([]byte, 12)
+	if _, err := rand.Read(buf); err != nil {
+		return "", err
+	}
+	ts := time.Now().UTC().UnixNano()
+	return hex.EncodeToString([]byte{
+		byte(ts >> 56), byte(ts >> 48), byte(ts >> 40), byte(ts >> 32),
+		byte(ts >> 24), byte(ts >> 16), byte(ts >> 8), byte(ts),
+	}) + hex.EncodeToString(buf), nil
+}
diff --git a/internal/paste/handlers_test.go b/internal/paste/handlers_test.go
new file mode 100644
index 0000000..1afc8a4
--- /dev/null
+++ b/internal/paste/handlers_test.go
@@ -0,0 +1,249 @@
+package paste_test
+
+import (
+	"bytes"
+	"context"
+	"database/sql"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/labstack/echo/v4"
+	_ "modernc.org/sqlite"
+
+	"github.com/sentiolabs/arc/internal/paste"
+	"github.com/sentiolabs/arc/internal/paste/sqlite"
+)
+
+func newTestServer(t *testing.T) *echo.Echo {
+	t.Helper()
+	db, err := sql.Open("sqlite", ":memory:")
+	if err != nil {
+		t.Fatalf("open sqlite: %v", err)
+	}
+	if err := sqlite.Apply(context.Background(), db); err != nil {
+		t.Fatalf("apply migrations: %v", err)
+	}
+	e := echo.New()
+	paste.NewHandlers(sqlite.New(db)).Register(e.Group("/api/paste"))
+	return e
+}
+
+func TestCreatePaste(t *testing.T) {
+	e := newTestServer(t)
+	body, _ := json.Marshal(paste.CreatePasteRequest{PlanBlob: []byte{1, 2}, PlanIV: []byte{3, 4}, SchemaVer: 1})
+	req := httptest.NewRequest(http.MethodPost, "/api/paste", bytes.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+	rec := httptest.NewRecorder()
+	e.ServeHTTP(rec, req)
+	if rec.Code != http.StatusCreated {
+		t.Fatalf("expected 201, got %d: %s", rec.Code, rec.Body.String())
+	}
+	var resp paste.CreatePasteResponse
+	if err := json.Unmarshal(rec.Body.Bytes(), &resp); err != nil {
+		t.Fatalf("unmarshal response: %v", err)
+	}
+	if resp.ID == "" || resp.EditToken == "" {
+		t.Errorf("missing id or edit_token in response: %+v", resp)
+	}
+}
+
+func TestCreatePasteEmptyBody(t *testing.T) {
+	e := newTestServer(t)
+	body, _ := json.Marshal(paste.CreatePasteRequest{SchemaVer: 1}) // no PlanBlob or PlanIV
+	req := httptest.NewRequest(http.MethodPost, "/api/paste", bytes.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+	rec := httptest.NewRecorder()
+	e.ServeHTTP(rec, req)
+	if rec.Code != http.StatusBadRequest {
+		t.Errorf("expected 400, got %d: %s", rec.Code, rec.Body.String())
+	}
+}
+
+func TestGetPaste(t *testing.T) {
+	e := newTestServer(t)
+
+	// Create a share first
+	body, _ := json.Marshal(paste.CreatePasteRequest{PlanBlob: []byte{1, 2}, PlanIV: []byte{3, 4}, SchemaVer: 1})
+	req := httptest.NewRequest(http.MethodPost, "/api/paste", bytes.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+	rec := httptest.NewRecorder()
+	e.ServeHTTP(rec, req)
+	if rec.Code != http.StatusCreated {
+		t.Fatalf("create failed with %d: %s", rec.Code, rec.Body.String())
+	}
+	var created paste.CreatePasteResponse
+	_ = json.Unmarshal(rec.Body.Bytes(), &created)
+
+	// GET the share
+	req2 := httptest.NewRequest(http.MethodGet, "/api/paste/"+created.ID, nil)
+	rec2 := httptest.NewRecorder()
+	e.ServeHTTP(rec2, req2)
+	if rec2.Code != http.StatusOK {
+		t.Fatalf("expected 200, got %d: %s", rec2.Code, rec2.Body.String())
+	}
+	var got paste.GetPasteResponse
+	if err := json.Unmarshal(rec2.Body.Bytes(), &got); err != nil {
+		t.Fatalf("unmarshal get response: %v", err)
+	}
+	if got.ID != created.ID {
+		t.Errorf("expected id %q, got %q", created.ID, got.ID)
+	}
+	if got.Events == nil {
+		// Events may be nil when empty slice; just ensure no panic
+	}
+}
+
+func TestGetPasteNotFound(t *testing.T) {
+	e := newTestServer(t)
+	req := httptest.NewRequest(http.MethodGet, "/api/paste/doesnotexist", nil)
+	rec := httptest.NewRecorder()
+	e.ServeHTTP(rec, req)
+	if rec.Code != http.StatusNotFound {
+		t.Errorf("expected 404, got %d: %s", rec.Code, rec.Body.String())
+	}
+}
+
+func TestUpdatePasteWithToken(t *testing.T) {
+	e := newTestServer(t)
+
+	// Create
+	body, _ := json.Marshal(paste.CreatePasteRequest{PlanBlob: []byte{1}, PlanIV: []byte{2}, SchemaVer: 1})
+	req := httptest.NewRequest(http.MethodPost, "/api/paste", bytes.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+	rec := httptest.NewRecorder()
+	e.ServeHTTP(rec, req)
+	var created paste.CreatePasteResponse
+	_ = json.Unmarshal(rec.Body.Bytes(), &created)
+
+	// Update with correct token
+	upd, _ := json.Marshal(map[string]interface{}{"plan_blob": []byte{9}, "plan_iv": []byte{8}})
+	req2 := httptest.NewRequest(http.MethodPut, "/api/paste/"+created.ID, bytes.NewReader(upd))
+	req2.Header.Set("Content-Type", "application/json")
+	req2.Header.Set("Authorization", "Bearer "+created.EditToken)
+	rec2 := httptest.NewRecorder()
+	e.ServeHTTP(rec2, req2)
+	if rec2.Code != http.StatusNoContent {
+		t.Errorf("expected 204, got %d: %s", rec2.Code, rec2.Body.String())
+	}
+}
+
+func TestUpdatePasteWrongToken(t *testing.T) {
+	e := newTestServer(t)
+
+	// Create
+	body, _ := json.Marshal(paste.CreatePasteRequest{PlanBlob: []byte{1}, PlanIV: []byte{2}, SchemaVer: 1})
+	req := httptest.NewRequest(http.MethodPost, "/api/paste", bytes.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+	rec := httptest.NewRecorder()
+	e.ServeHTTP(rec, req)
+	var created paste.CreatePasteResponse
+	_ = json.Unmarshal(rec.Body.Bytes(), &created)
+
+	// Update with wrong token
+	upd, _ := json.Marshal(map[string]interface{}{"plan_blob": []byte{9}, "plan_iv": []byte{8}})
+	req2 := httptest.NewRequest(http.MethodPut, "/api/paste/"+created.ID, bytes.NewReader(upd))
+	req2.Header.Set("Content-Type", "application/json")
+	req2.Header.Set("Authorization", "Bearer wrongtoken")
+	rec2 := httptest.NewRecorder()
+	e.ServeHTTP(rec2, req2)
+	if rec2.Code != http.StatusForbidden {
+		t.Errorf("expected 403, got %d: %s", rec2.Code, rec2.Body.String())
+	}
+}
+
+func TestUpdatePasteMissingAuth(t *testing.T) {
+	e := newTestServer(t)
+
+	// Create
+	body, _ := json.Marshal(paste.CreatePasteRequest{PlanBlob: []byte{1}, PlanIV: []byte{2}, SchemaVer: 1})
+	req := httptest.NewRequest(http.MethodPost, "/api/paste", bytes.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+	rec := httptest.NewRecorder()
+	e.ServeHTTP(rec, req)
+	var created paste.CreatePasteResponse
+	_ = json.Unmarshal(rec.Body.Bytes(), &created)
+
+	// Update with no Authorization header
+	upd, _ := json.Marshal(map[string]interface{}{"plan_blob": []byte{9}, "plan_iv": []byte{8}})
+	req2 := httptest.NewRequest(http.MethodPut, "/api/paste/"+created.ID, bytes.NewReader(upd))
+	req2.Header.Set("Content-Type", "application/json")
+	rec2 := httptest.NewRecorder()
+	e.ServeHTTP(rec2, req2)
+	if rec2.Code != http.StatusUnauthorized {
+		t.Errorf("expected 401, got %d: %s", rec2.Code, rec2.Body.String())
+	}
+}
+
+func TestDeletePasteWithToken(t *testing.T) {
+	e := newTestServer(t)
+
+	// Create
+	body, _ := json.Marshal(paste.CreatePasteRequest{PlanBlob: []byte{1}, PlanIV: []byte{2}, SchemaVer: 1})
+	req := httptest.NewRequest(http.MethodPost, "/api/paste", bytes.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+	rec := httptest.NewRecorder()
+	e.ServeHTTP(rec, req)
+	var created paste.CreatePasteResponse
+	_ = json.Unmarshal(rec.Body.Bytes(), &created)
+
+	// Delete with correct token
+	req2 := httptest.NewRequest(http.MethodDelete, "/api/paste/"+created.ID, nil)
+	req2.Header.Set("Authorization", "Bearer "+created.EditToken)
+	rec2 := httptest.NewRecorder()
+	e.ServeHTTP(rec2, req2)
+	if rec2.Code != http.StatusNoContent {
+		t.Errorf("expected 204, got %d: %s", rec2.Code, rec2.Body.String())
+	}
+}
+
+func TestAppendEvent(t *testing.T) {
+	e := newTestServer(t)
+
+	// Create share
+	body, _ := json.Marshal(paste.CreatePasteRequest{PlanBlob: []byte{1, 2}, PlanIV: []byte{3, 4}, SchemaVer: 1})
+	req := httptest.NewRequest(http.MethodPost, "/api/paste", bytes.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+	rec := httptest.NewRecorder()
+	e.ServeHTTP(rec, req)
+	var created paste.CreatePasteResponse
+	_ = json.Unmarshal(rec.Body.Bytes(), &created)
+
+	// Append event
+	evBody, _ := json.Marshal(paste.AppendEventRequest{Blob: []byte{5, 6}, IV: []byte{7, 8}})
+	req2 := httptest.NewRequest(http.MethodPost, "/api/paste/"+created.ID+"/blobs", bytes.NewReader(evBody))
+	req2.Header.Set("Content-Type", "application/json")
+	rec2 := httptest.NewRecorder()
+	e.ServeHTTP(rec2, req2)
+	if rec2.Code != http.StatusCreated {
+		t.Fatalf("expected 201, got %d: %s", rec2.Code, rec2.Body.String())
+	}
+	var evResp map[string]string
+	_ = json.Unmarshal(rec2.Body.Bytes(), &evResp)
+	if evResp["id"] == "" {
+		t.Errorf("expected event id in response: %+v", evResp)
+	}
+
+	// GET shows the event
+	req3 := httptest.NewRequest(http.MethodGet, "/api/paste/"+created.ID, nil)
+	rec3 := httptest.NewRecorder()
+	e.ServeHTTP(rec3, req3)
+	var got paste.GetPasteResponse
+	_ = json.Unmarshal(rec3.Body.Bytes(), &got)
+	if len(got.Events) != 1 {
+		t.Errorf("expected 1 event, got %d", len(got.Events))
+	}
+}
+
+func TestAppendEventToMissingShare(t *testing.T) {
+	e := newTestServer(t)
+	evBody, _ := json.Marshal(paste.AppendEventRequest{Blob: []byte{5, 6}, IV: []byte{7, 8}})
+	req := httptest.NewRequest(http.MethodPost, "/api/paste/doesnotexist/blobs", bytes.NewReader(evBody))
+	req.Header.Set("Content-Type", "application/json")
+	rec := httptest.NewRecorder()
+	e.ServeHTTP(rec, req)
+	if rec.Code != http.StatusNotFound {
+		t.Errorf("expected 404, got %d: %s", rec.Code, rec.Body.String())
+	}
+}

From 28b75e50ff13a1b2e9b0793a3d6ed7386a7a480c Mon Sep 17 00:00:00 2001
From: Ben Firestone <ben.firestone@krypticlabs.com>
Date: Wed, 29 Apr 2026 13:51:10 -0700
Subject: [PATCH 05/20] feat(web): add paste client, anchor, events, identity
 utilities

Implement four utility modules for the paste/shared-review feature:
client.ts (fetch wrappers), anchor.ts (4-step resilience resolution),
events.ts (CRDT-lite replay), and identity.ts (localStorage name capture).
All modules are fully tested with 16 passing Vitest unit tests.
---
 web/src/lib/paste/anchor.test.ts   | 33 +++++++++++++
 web/src/lib/paste/anchor.ts        | 79 ++++++++++++++++++++++++++++++
 web/src/lib/paste/client.test.ts   | 32 ++++++++++++
 web/src/lib/paste/client.ts        | 63 ++++++++++++++++++++++++
 web/src/lib/paste/events.test.ts   | 49 ++++++++++++++++++
 web/src/lib/paste/events.ts        | 36 ++++++++++++++
 web/src/lib/paste/identity.test.ts | 23 +++++++++
 web/src/lib/paste/identity.ts      | 16 ++++++
 8 files changed, 331 insertions(+)
 create mode 100644 web/src/lib/paste/anchor.test.ts
 create mode 100644 web/src/lib/paste/anchor.ts
 create mode 100644 web/src/lib/paste/client.test.ts
 create mode 100644 web/src/lib/paste/client.ts
 create mode 100644 web/src/lib/paste/events.test.ts
 create mode 100644 web/src/lib/paste/events.ts
 create mode 100644 web/src/lib/paste/identity.test.ts
 create mode 100644 web/src/lib/paste/identity.ts

diff --git a/web/src/lib/paste/anchor.test.ts b/web/src/lib/paste/anchor.test.ts
new file mode 100644
index 0000000..f7b5a41
--- /dev/null
+++ b/web/src/lib/paste/anchor.test.ts
@@ -0,0 +1,33 @@
+import { describe, it, expect } from 'vitest';
+import { resolveAnchor } from './anchor';
+
+describe('resolveAnchor', () => {
+	const plan = '# Title\n\nFirst paragraph.\nSecond paragraph.\n## Sub\nThird.\n';
+
+	it('returns ok when quoted_text still at original lines', () => {
+		const r = resolveAnchor(plan, { line_start: 3, line_end: 3, quoted_text: 'First paragraph.' });
+		expect(r.status).toBe('ok');
+	});
+
+	it('returns drifted when found via heading slug', () => {
+		const edited = 'PRELUDE\n# Title\n\nMore content.\nFirst paragraph.\n## Sub\nThird.\n';
+		const r = resolveAnchor(edited, {
+			line_start: 3,
+			line_end: 3,
+			quoted_text: 'First paragraph.',
+			heading_slug: 'title',
+		});
+		expect(r.status).toBe('drifted');
+	});
+
+	it('returns orphaned when text is gone', () => {
+		const edited = '# Title\n\nDifferent stuff.\n';
+		const r = resolveAnchor(edited, {
+			line_start: 3,
+			line_end: 3,
+			quoted_text: 'First paragraph.',
+			heading_slug: 'title',
+		});
+		expect(r.status).toBe('orphaned');
+	});
+});
diff --git a/web/src/lib/paste/anchor.ts b/web/src/lib/paste/anchor.ts
new file mode 100644
index 0000000..a0ba6ac
--- /dev/null
+++ b/web/src/lib/paste/anchor.ts
@@ -0,0 +1,79 @@
+import type { Anchor } from './types';
+
+export type AnchorResolution = {
+	line_start: number;
+	line_end: number;
+	char_start?: number;
+	char_end?: number;
+	status: 'ok' | 'drifted' | 'orphaned';
+};
+
+export function resolveAnchor(plan: string, anchor: Anchor): AnchorResolution {
+	const lines = plan.split('\n');
+
+	if (anchor.line_start <= lines.length && anchor.line_end <= lines.length) {
+		const slice = lines.slice(anchor.line_start - 1, anchor.line_end).join('\n');
+		if (slice.includes(anchor.quoted_text)) {
+			return {
+				line_start: anchor.line_start,
+				line_end: anchor.line_end,
+				char_start: anchor.char_start,
+				char_end: anchor.char_end,
+				status: 'ok',
+			};
+		}
+	}
+
+	if (anchor.heading_slug) {
+		const headingIdx = findHeadingIndex(lines, anchor.heading_slug);
+		if (headingIdx >= 0) {
+			const window = lines.slice(headingIdx, Math.min(headingIdx + 50, lines.length)).join('\n');
+			const offset = window.indexOf(anchor.quoted_text);
+			if (offset >= 0) {
+				const lineNum = headingIdx + 1 + countNewlinesBefore(window, offset);
+				return {
+					line_start: lineNum,
+					line_end: lineNum + countNewlinesBefore(anchor.quoted_text, anchor.quoted_text.length),
+					status: 'drifted',
+				};
+			}
+		}
+	}
+
+	if (anchor.context_before && anchor.context_after) {
+		const needle = anchor.context_before + anchor.quoted_text + anchor.context_after;
+		const idx = plan.indexOf(needle);
+		if (idx >= 0) {
+			const lineNum = countNewlinesBefore(plan, idx + (anchor.context_before?.length ?? 0)) + 1;
+			return {
+				line_start: lineNum,
+				line_end: lineNum + countNewlinesBefore(anchor.quoted_text, anchor.quoted_text.length),
+				status: 'drifted',
+			};
+		}
+	}
+
+	return { line_start: anchor.line_start, line_end: anchor.line_end, status: 'orphaned' };
+}
+
+function findHeadingIndex(lines: string[], slug: string): number {
+	for (let i = 0; i < lines.length; i++) {
+		const m = lines[i].match(/^#+\s+(.*)$/);
+		if (m && slugify(m[1]) === slug) return i;
+	}
+	return -1;
+}
+
+export function slugify(text: string): string {
+	return text
+		.toLowerCase()
+		.replace(/[^a-z0-9\s-]/g, '')
+		.trim()
+		.replace(/\s+/g, '-');
+}
+
+function countNewlinesBefore(s: string, idx: number): number {
+	let n = 0;
+	for (let i = 0; i < idx && i < s.length; i++) if (s[i] === '\n') n++;
+	return n;
+}
diff --git a/web/src/lib/paste/client.test.ts b/web/src/lib/paste/client.test.ts
new file mode 100644
index 0000000..7cf9d4b
--- /dev/null
+++ b/web/src/lib/paste/client.test.ts
@@ -0,0 +1,32 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { PasteClient } from './client';
+
+describe('PasteClient', () => {
+	beforeEach(() => vi.restoreAllMocks());
+
+	it('POSTs base64-encoded blob+iv on create', async () => {
+		const fetchMock = vi.spyOn(globalThis, 'fetch').mockResolvedValue(
+			new Response(JSON.stringify({ id: 'abc', edit_token: 'tok' }), { status: 201 }),
+		);
+		const c = new PasteClient('http://x');
+		const res = await c.create(new Uint8Array([1, 2]), new Uint8Array([3, 4]));
+		expect(res.id).toBe('abc');
+		expect(fetchMock).toHaveBeenCalledWith(
+			'http://x/api/paste',
+			expect.objectContaining({ method: 'POST' }),
+		);
+		const body = JSON.parse((fetchMock.mock.calls[0][1] as RequestInit).body as string);
+		expect(body.schema_ver).toBe(1);
+		expect(body.plan_blob).toMatch(/^[A-Za-z0-9+/=]+$/);
+	});
+
+	it('sends Bearer token on update', async () => {
+		const fetchMock = vi.spyOn(globalThis, 'fetch').mockResolvedValue(
+			new Response(null, { status: 204 }),
+		);
+		const c = new PasteClient('http://x');
+		await c.updatePlan('abc', 'mytoken', new Uint8Array([1]), new Uint8Array([2]));
+		const opts = fetchMock.mock.calls[0][1] as RequestInit;
+		expect((opts.headers as Record<string, string>).Authorization).toBe('Bearer mytoken');
+	});
+});
diff --git a/web/src/lib/paste/client.ts b/web/src/lib/paste/client.ts
new file mode 100644
index 0000000..82cf47c
--- /dev/null
+++ b/web/src/lib/paste/client.ts
@@ -0,0 +1,63 @@
+import type {
+	CreatePasteResponse,
+	GetPasteResponse,
+	PasteEventResponse,
+} from './types';
+
+export class PasteClient {
+	constructor(private baseUrl: string) {}
+
+	async create(planBlob: Uint8Array, planIv: Uint8Array, schemaVer = 1): Promise<CreatePasteResponse> {
+		const res = await fetch(`${this.baseUrl}/api/paste`, {
+			method: 'POST',
+			headers: { 'Content-Type': 'application/json' },
+			body: JSON.stringify({
+				plan_blob: bytesToB64(planBlob),
+				plan_iv: bytesToB64(planIv),
+				schema_ver: schemaVer,
+			}),
+		});
+		if (!res.ok) throw new Error(`create paste failed: ${res.status}`);
+		return await res.json();
+	}
+
+	async get(id: string): Promise<GetPasteResponse> {
+		const res = await fetch(`${this.baseUrl}/api/paste/${id}`);
+		if (!res.ok) throw new Error(`get paste failed: ${res.status}`);
+		return await res.json();
+	}
+
+	async appendEvent(id: string, blob: Uint8Array, iv: Uint8Array): Promise<{ id: string }> {
+		const res = await fetch(`${this.baseUrl}/api/paste/${id}/blobs`, {
+			method: 'POST',
+			headers: { 'Content-Type': 'application/json' },
+			body: JSON.stringify({ blob: bytesToB64(blob), iv: bytesToB64(iv) }),
+		});
+		if (!res.ok) throw new Error(`append event failed: ${res.status}`);
+		return await res.json();
+	}
+
+	async updatePlan(id: string, editToken: string, planBlob: Uint8Array, planIv: Uint8Array): Promise<void> {
+		const res = await fetch(`${this.baseUrl}/api/paste/${id}`, {
+			method: 'PUT',
+			headers: { 'Content-Type': 'application/json', 'Authorization': `Bearer ${editToken}` },
+			body: JSON.stringify({ plan_blob: bytesToB64(planBlob), plan_iv: bytesToB64(planIv) }),
+		});
+		if (!res.ok) throw new Error(`update plan failed: ${res.status}`);
+	}
+}
+
+function bytesToB64(b: Uint8Array): string {
+	return btoa(String.fromCharCode(...b));
+}
+
+export function b64ToBytes(s: string): Uint8Array {
+	const bin = atob(s);
+	const out = new Uint8Array(bin.length);
+	for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
+	return out;
+}
+
+export function eventBytes(e: PasteEventResponse): { blob: Uint8Array; iv: Uint8Array } {
+	return { blob: b64ToBytes(e.blob), iv: b64ToBytes(e.iv) };
+}
diff --git a/web/src/lib/paste/events.test.ts b/web/src/lib/paste/events.test.ts
new file mode 100644
index 0000000..7600d5c
--- /dev/null
+++ b/web/src/lib/paste/events.test.ts
@@ -0,0 +1,49 @@
+import { describe, it, expect } from 'vitest';
+import { replayEvents, acceptedOnly } from './events';
+import type { CommentEvent, ResolutionEvent } from './types';
+
+const c: CommentEvent = {
+	kind: 'comment',
+	id: 'c1',
+	author_name: 'Alice',
+	comment_type: 'comment',
+	body: 'looks good',
+	anchor: { line_start: 1, line_end: 1, quoted_text: 'x' },
+	created_at: '2026-04-29T00:00:00Z',
+};
+const accept: ResolutionEvent = {
+	kind: 'resolution',
+	id: 'r1',
+	comment_id: 'c1',
+	status: 'accepted',
+	author_name: 'Ben',
+	created_at: '2026-04-29T00:01:00Z',
+};
+
+describe('replayEvents', () => {
+	it('marks comment accepted when resolver is plan author', () => {
+		const states = replayEvents('Ben', [c, accept]);
+		expect(states.get('c1')?.status).toBe('accepted');
+	});
+
+	it('ignores resolution from non-author', () => {
+		const states = replayEvents('Ben', [c, { ...accept, author_name: 'Mallory' }]);
+		expect(states.get('c1')?.status).toBe('open');
+	});
+
+	it('acceptedOnly filters non-accepted', () => {
+		const states = replayEvents('Ben', [c, accept]);
+		expect(acceptedOnly(states).length).toBe(1);
+	});
+
+	it('replays in created_at order', () => {
+		const reject: ResolutionEvent = {
+			...accept,
+			id: 'r2',
+			status: 'rejected',
+			created_at: '2026-04-29T00:02:00Z',
+		};
+		const states = replayEvents('Ben', [c, accept, reject]);
+		expect(states.get('c1')?.status).toBe('rejected');
+	});
+});
diff --git a/web/src/lib/paste/events.ts b/web/src/lib/paste/events.ts
new file mode 100644
index 0000000..7b0db48
--- /dev/null
+++ b/web/src/lib/paste/events.ts
@@ -0,0 +1,36 @@
+import type { CommentEvent, EventPlaintext, ResolutionStatus } from './types';
+
+export type CommentState = {
+	event: CommentEvent;
+	status: 'open' | ResolutionStatus;
+	reply?: string;
+	replyAt?: string;
+};
+
+export function replayEvents(
+	planAuthor: string | undefined,
+	events: EventPlaintext[],
+): Map<string, CommentState> {
+	const sorted = [...events].sort((a, b) => {
+		const c = a.created_at.localeCompare(b.created_at);
+		return c !== 0 ? c : a.id.localeCompare(b.id);
+	});
+	const states = new Map<string, CommentState>();
+	for (const e of sorted) {
+		if (e.kind === 'comment') {
+			states.set(e.id, { event: e, status: 'open' });
+		} else if (e.kind === 'resolution') {
+			const target = states.get(e.comment_id);
+			if (!target) continue;
+			if (planAuthor && e.author_name !== planAuthor) continue;
+			target.status = e.status;
+			target.reply = e.reply;
+			target.replyAt = e.created_at;
+		}
+	}
+	return states;
+}
+
+export function acceptedOnly(states: Map<string, CommentState>): CommentState[] {
+	return [...states.values()].filter((s) => s.status === 'accepted');
+}
diff --git a/web/src/lib/paste/identity.test.ts b/web/src/lib/paste/identity.test.ts
new file mode 100644
index 0000000..7e5f83b
--- /dev/null
+++ b/web/src/lib/paste/identity.test.ts
@@ -0,0 +1,23 @@
+// @vitest-environment jsdom
+import { describe, it, expect, beforeEach } from 'vitest';
+import { getReviewerName, setReviewerName, clearReviewerName } from './identity';
+
+describe('identity', () => {
+	beforeEach(() => localStorage.clear());
+
+	it('round-trips a name', () => {
+		setReviewerName('Alice');
+		expect(getReviewerName()).toBe('Alice');
+	});
+
+	it('clear removes the name', () => {
+		setReviewerName('Bob');
+		clearReviewerName();
+		expect(getReviewerName()).toBeNull();
+	});
+
+	it('trims whitespace on set', () => {
+		setReviewerName('  Carol  ');
+		expect(getReviewerName()).toBe('Carol');
+	});
+});
diff --git a/web/src/lib/paste/identity.ts b/web/src/lib/paste/identity.ts
new file mode 100644
index 0000000..420b672
--- /dev/null
+++ b/web/src/lib/paste/identity.ts
@@ -0,0 +1,16 @@
+const KEY = 'arc.reviewer.name';
+
+export function getReviewerName(): string | null {
+	if (typeof localStorage === 'undefined') return null;
+	return localStorage.getItem(KEY);
+}
+
+export function setReviewerName(name: string): void {
+	if (typeof localStorage === 'undefined') return;
+	localStorage.setItem(KEY, name.trim());
+}
+
+export function clearReviewerName(): void {
+	if (typeof localStorage === 'undefined') return;
+	localStorage.removeItem(KEY);
+}

From cc4923a3becf13e9c4f0381c5f8ef7f5ca048fdb Mon Sep 17 00:00:00 2001
From: Ben Firestone <ben.firestone@krypticlabs.com>
Date: Wed, 29 Apr 2026 13:51:38 -0700
Subject: [PATCH 06/20] test(paste): add cross-language crypto roundtrip
 fixtures

---
 internal/paste/cmd/genxlang/main.go         | 50 +++++++++++++
 internal/paste/crypto_xlang_test.go         | 83 +++++++++++++++++++++
 internal/paste/testdata/README.md           | 15 ++++
 internal/paste/testdata/xlang_fixtures.json | 32 ++++++++
 web/src/lib/paste/crypto.xlang.test.ts      | 32 ++++++++
 5 files changed, 212 insertions(+)
 create mode 100644 internal/paste/cmd/genxlang/main.go
 create mode 100644 internal/paste/crypto_xlang_test.go
 create mode 100644 internal/paste/testdata/README.md
 create mode 100644 internal/paste/testdata/xlang_fixtures.json
 create mode 100644 web/src/lib/paste/crypto.xlang.test.ts

diff --git a/internal/paste/cmd/genxlang/main.go b/internal/paste/cmd/genxlang/main.go
new file mode 100644
index 0000000..d6f014d
--- /dev/null
+++ b/internal/paste/cmd/genxlang/main.go
@@ -0,0 +1,50 @@
+// genxlang generates testdata/xlang_fixtures.json with Go-encrypted blobs.
+// Run once to populate; the fixtures are checked into the repo and used
+// by both Go and TS tests to verify cross-language compatibility.
+package main
+
+import (
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"os"
+
+	"github.com/sentiolabs/arc/internal/paste"
+)
+
+type fixture struct {
+	Name          string `json:"name"`
+	KeyB64Url     string `json:"key_b64url"`
+	Plaintext     any    `json:"plaintext"`
+	CiphertextB64 string `json:"ciphertext_b64"`
+	IvB64         string `json:"iv_b64"`
+}
+
+func main() {
+	cases := []struct{ name string; v any }{
+		{"simple-string", "hello world"},
+		{"empty-object", map[string]any{}},
+		{"nested-object", map[string]any{
+			"kind": "comment", "id": "c1", "author_name": "Alice",
+			"anchor": map[string]any{"line_start": 1, "line_end": 1, "quoted_text": "x"},
+		}},
+	}
+	var out []fixture
+	for _, c := range cases {
+		key, _ := paste.GenerateKey()
+		ct, iv, err := paste.EncryptJSON(c.v, key)
+		if err != nil {
+			panic(err)
+		}
+		out = append(out, fixture{
+			Name:          c.name,
+			KeyB64Url:     base64.RawURLEncoding.EncodeToString(key),
+			Plaintext:     c.v,
+			CiphertextB64: base64.StdEncoding.EncodeToString(ct),
+			IvB64:         base64.StdEncoding.EncodeToString(iv),
+		})
+	}
+	data, _ := json.MarshalIndent(out, "", "  ")
+	fmt.Println(string(data))
+	_ = os.WriteFile("internal/paste/testdata/xlang_fixtures.json", data, 0o644)
+}
diff --git a/internal/paste/crypto_xlang_test.go b/internal/paste/crypto_xlang_test.go
new file mode 100644
index 0000000..ebf85f1
--- /dev/null
+++ b/internal/paste/crypto_xlang_test.go
@@ -0,0 +1,83 @@
+package paste
+
+import (
+	"encoding/base64"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"reflect"
+	"testing"
+)
+
+type xlangFixture struct {
+	Name          string          `json:"name"`
+	KeyB64Url     string          `json:"key_b64url"`
+	Plaintext     json.RawMessage `json:"plaintext"`
+	CiphertextB64 string          `json:"ciphertext_b64"`
+	IvB64         string          `json:"iv_b64"`
+}
+
+func TestCryptoXLangFixtures(t *testing.T) {
+	data, err := os.ReadFile(filepath.Join("testdata", "xlang_fixtures.json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	var fixtures []xlangFixture
+	if err := json.Unmarshal(data, &fixtures); err != nil {
+		t.Fatal(err)
+	}
+	if len(fixtures) == 0 {
+		t.Fatal("no fixtures loaded")
+	}
+	for _, f := range fixtures {
+		t.Run(f.Name, func(t *testing.T) {
+			key, err := base64UrlDecode(f.KeyB64Url)
+			if err != nil {
+				t.Fatal(err)
+			}
+			ct, _ := base64.StdEncoding.DecodeString(f.CiphertextB64)
+			iv, _ := base64.StdEncoding.DecodeString(f.IvB64)
+			var got json.RawMessage
+			if err := DecryptJSON(ct, iv, key, &got); err != nil {
+				t.Fatalf("decrypt: %v", err)
+			}
+			var a, b any
+			_ = json.Unmarshal(f.Plaintext, &a)
+			_ = json.Unmarshal(got, &b)
+			if !reflect.DeepEqual(a, b) {
+				t.Errorf("plaintext mismatch:\nwant %s\ngot  %s", f.Plaintext, got)
+			}
+		})
+	}
+}
+
+func TestCryptoXLangRoundtrip(t *testing.T) {
+	// For each fixture, also verify that re-encrypting and re-decrypting in Go
+	// produces the same plaintext (catches Go-internal regressions).
+	data, _ := os.ReadFile(filepath.Join("testdata", "xlang_fixtures.json"))
+	var fixtures []xlangFixture
+	_ = json.Unmarshal(data, &fixtures)
+	for _, f := range fixtures {
+		t.Run(f.Name+"-roundtrip", func(t *testing.T) {
+			key, _ := base64UrlDecode(f.KeyB64Url)
+			ct, iv, err := EncryptJSON(json.RawMessage(f.Plaintext), key)
+			if err != nil {
+				t.Fatal(err)
+			}
+			var out json.RawMessage
+			if err := DecryptJSON(ct, iv, key, &out); err != nil {
+				t.Fatal(err)
+			}
+		})
+	}
+}
+
+func base64UrlDecode(s string) ([]byte, error) {
+	switch len(s) % 4 {
+	case 2:
+		s += "=="
+	case 3:
+		s += "="
+	}
+	return base64.URLEncoding.DecodeString(s)
+}
diff --git a/internal/paste/testdata/README.md b/internal/paste/testdata/README.md
new file mode 100644
index 0000000..913aefb
--- /dev/null
+++ b/internal/paste/testdata/README.md
@@ -0,0 +1,15 @@
+# Crypto cross-language fixtures
+
+`xlang_fixtures.json` contains AES-256-GCM ciphertexts produced by the Go
+implementation in `internal/paste/crypto.go`. The TypeScript test
+`web/src/lib/paste/crypto.xlang.test.ts` reads these fixtures and verifies
+that the JS Web Crypto API decrypts them to the original plaintext.
+
+## Regenerate
+
+    go run ./internal/paste/cmd/genxlang/
+
+This overwrites the JSON file with fresh ciphertexts (random keys + IVs each
+run). Don't regenerate casually — the goal is for both Go and TS tests to
+pass against the same checked-in fixtures, so a regen invalidates the
+TS-side check until you also re-run it.
diff --git a/internal/paste/testdata/xlang_fixtures.json b/internal/paste/testdata/xlang_fixtures.json
new file mode 100644
index 0000000..7565d6f
--- /dev/null
+++ b/internal/paste/testdata/xlang_fixtures.json
@@ -0,0 +1,32 @@
+[
+  {
+    "name": "simple-string",
+    "key_b64url": "0sPOEgk6sXnLa8gG-Us0rGbFVzXtZLdDz05i_Ht7Y8s",
+    "plaintext": "hello world",
+    "ciphertext_b64": "xEZxsBqDhxxzVrszzoJf8JCO+VK/vo5sDrIK3sY=",
+    "iv_b64": "59bzfpIIYaB2YpOG"
+  },
+  {
+    "name": "empty-object",
+    "key_b64url": "XcTZkGxWCrrxaY_h3NiCj6lpYuNXKUeW6biLnisFsUw",
+    "plaintext": {},
+    "ciphertext_b64": "MGA2OLHstGPKAq880FJ7v1Dr",
+    "iv_b64": "aQBdDtz/ZeNHGA0i"
+  },
+  {
+    "name": "nested-object",
+    "key_b64url": "iyo2Rc7qGRKTKZz895k2d3Yp8zxa6J6pYWlO1_Nty4Q",
+    "plaintext": {
+      "anchor": {
+        "line_end": 1,
+        "line_start": 1,
+        "quoted_text": "x"
+      },
+      "author_name": "Alice",
+      "id": "c1",
+      "kind": "comment"
+    },
+    "ciphertext_b64": "Zron1CbqnlsZaSJWZezFn7TD7rUwWoMNT/MuzCjm31hjmbBoZ1OQB/6InUuL02KFcbvTtgrmH18ryHXluI3xmyfV65NuaGN6dIm+y7LZP1bykPm7QH7qBAxc7XekG+Zj4fcGHbPh8RA0IbTJ/PhEFhvj4Hqr/hbOZ+go",
+    "iv_b64": "2gljqJMdKMtG2S28"
+  }
+]
\ No newline at end of file
diff --git a/web/src/lib/paste/crypto.xlang.test.ts b/web/src/lib/paste/crypto.xlang.test.ts
new file mode 100644
index 0000000..fae9c7c
--- /dev/null
+++ b/web/src/lib/paste/crypto.xlang.test.ts
@@ -0,0 +1,32 @@
+import { describe, it, expect } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { importKey, decryptJSON } from './crypto';
+
+const FIXTURES_PATH = join(__dirname, '../../../../internal/paste/testdata/xlang_fixtures.json');
+const fixtures: Array<{
+	name: string;
+	key_b64url: string;
+	plaintext: unknown;
+	ciphertext_b64: string;
+	iv_b64: string;
+}> = JSON.parse(readFileSync(FIXTURES_PATH, 'utf8'));
+
+describe('crypto xlang', () => {
+	for (const f of fixtures) {
+		it(`decrypts Go-produced fixture: ${f.name}`, async () => {
+			const key = await importKey(f.key_b64url);
+			const blob = stdB64Decode(f.ciphertext_b64);
+			const iv = stdB64Decode(f.iv_b64);
+			const got = await decryptJSON(blob, iv, key);
+			expect(got).toEqual(f.plaintext);
+		});
+	}
+});
+
+function stdB64Decode(s: string): Uint8Array {
+	const bin = atob(s);
+	const out = new Uint8Array(bin.length);
+	for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
+	return out;
+}

From 9a936ac2a79b5384eed1b5f279c9b4b1601adf68 Mon Sep 17 00:00:00 2001
From: Ben Firestone <ben.firestone@krypticlabs.com>
Date: Wed, 29 Apr 2026 13:57:35 -0700
Subject: [PATCH 07/20] feat(web): add /share/[id] route with full annotation
 markup

Implements the SvelteKit route web/src/routes/share/[id]/ with all 11
components for the encrypted plan review UI: PlanRenderer (markdown with
source-line anchors), AnnotationToolbar, LabelPicker, CommentCard,
CommentThread, ResolveControls, SuggestionDiff, NamePromptModal, and
DriftBadge. The route decrypts pastes via window.location.hash key,
replays comment events, and gates submission on a reviewer name prompt.
---
 web/src/routes/share/[id]/+page.svelte        | 142 ++++++++++++++++++
 web/src/routes/share/[id]/+page.ts            |   7 +
 .../[id]/components/AnnotationToolbar.svelte  |  63 ++++++++
 .../share/[id]/components/CommentCard.svelte  |  34 +++++
 .../[id]/components/CommentThread.svelte      |  21 +++
 .../share/[id]/components/DriftBadge.svelte   |   9 ++
 .../share/[id]/components/LabelPicker.svelte  |  26 ++++
 .../[id]/components/NamePromptModal.svelte    |  28 ++++
 .../share/[id]/components/PlanRenderer.svelte |  75 +++++++++
 .../[id]/components/ResolveControls.svelte    |  42 ++++++
 .../[id]/components/SuggestionDiff.svelte     |  10 ++
 11 files changed, 457 insertions(+)
 create mode 100644 web/src/routes/share/[id]/+page.svelte
 create mode 100644 web/src/routes/share/[id]/+page.ts
 create mode 100644 web/src/routes/share/[id]/components/AnnotationToolbar.svelte
 create mode 100644 web/src/routes/share/[id]/components/CommentCard.svelte
 create mode 100644 web/src/routes/share/[id]/components/CommentThread.svelte
 create mode 100644 web/src/routes/share/[id]/components/DriftBadge.svelte
 create mode 100644 web/src/routes/share/[id]/components/LabelPicker.svelte
 create mode 100644 web/src/routes/share/[id]/components/NamePromptModal.svelte
 create mode 100644 web/src/routes/share/[id]/components/PlanRenderer.svelte
 create mode 100644 web/src/routes/share/[id]/components/ResolveControls.svelte
 create mode 100644 web/src/routes/share/[id]/components/SuggestionDiff.svelte

diff --git a/web/src/routes/share/[id]/+page.svelte b/web/src/routes/share/[id]/+page.svelte
new file mode 100644
index 0000000..e452848
--- /dev/null
+++ b/web/src/routes/share/[id]/+page.svelte
@@ -0,0 +1,142 @@
+<script lang="ts">
+	import { onMount } from 'svelte';
+	import { PasteClient, b64ToBytes, eventBytes } from '$lib/paste/client';
+	import { importKey, encryptJSON, decryptJSON } from '$lib/paste/crypto';
+	import { replayEvents, type CommentState } from '$lib/paste/events';
+	import { getReviewerName } from '$lib/paste/identity';
+	import type {
+		PlanPlaintext,
+		EventPlaintext,
+		CommentEvent,
+		CommentType,
+		Severity,
+		Anchor
+	} from '$lib/paste/types';
+	import PlanRenderer from './components/PlanRenderer.svelte';
+	import AnnotationToolbar from './components/AnnotationToolbar.svelte';
+	import CommentCard from './components/CommentCard.svelte';
+	import NamePromptModal from './components/NamePromptModal.svelte';
+
+	const { data } = $props<{ data: { id: string } }>();
+	let plan = $state<PlanPlaintext | null>(null);
+	let comments = $state(new Map<string, CommentState>());
+	let key = $state<CryptoKey | null>(null);
+	let reviewerName = $state(getReviewerName());
+	let showNamePrompt = $state(false);
+	let pendingComment = $state<{
+		body: string;
+		comment_type: CommentType;
+		severity?: Severity;
+		suggested_text?: string;
+		anchor: Anchor;
+	} | null>(null);
+	let selection = $state<{
+		lineStart: number;
+		lineEnd: number;
+		charStart?: number;
+		charEnd?: number;
+		quotedText: string;
+		headingSlug?: string;
+		contextBefore?: string;
+		contextAfter?: string;
+	} | undefined>(undefined);
+
+	const anchor = $derived(
+		selection
+			? ({
+					line_start: selection.lineStart,
+					line_end: selection.lineEnd,
+					char_start: selection.charStart,
+					char_end: selection.charEnd,
+					quoted_text: selection.quotedText,
+					heading_slug: selection.headingSlug,
+					context_before: selection.contextBefore,
+					context_after: selection.contextAfter
+				} satisfies Anchor)
+			: undefined
+	);
+
+	const client = new PasteClient(window.location.origin);
+
+	onMount(async () => {
+		const fragment = window.location.hash.replace(/^#/, '');
+		const params = new URLSearchParams(fragment);
+		const k = params.get('k');
+		if (!k) {
+			console.error('missing #k=<key> in URL');
+			return;
+		}
+		key = await importKey(k);
+
+		const resp = await client.get(data.id);
+		plan = await decryptJSON<PlanPlaintext>(b64ToBytes(resp.plan_blob), b64ToBytes(resp.plan_iv), key);
+
+		const events: EventPlaintext[] = [];
+		for (const ev of resp.events) {
+			const { blob, iv } = eventBytes(ev);
+			try {
+				events.push(await decryptJSON<EventPlaintext>(blob, iv, key));
+			} catch {
+				// skip undecryptable events (corrupt or tampered)
+			}
+		}
+		comments = replayEvents(plan?.author_name, events);
+	});
+
+	async function handleSubmitComment(payload: typeof pendingComment) {
+		if (!payload || !key || !plan) return;
+		if (!reviewerName) {
+			pendingComment = payload;
+			showNamePrompt = true;
+			return;
+		}
+		const event: CommentEvent = {
+			kind: 'comment',
+			id: `c-${crypto.randomUUID()}`,
+			author_name: reviewerName,
+			comment_type: payload.comment_type,
+			severity: payload.severity,
+			body: payload.body,
+			suggested_text: payload.suggested_text,
+			anchor: payload.anchor,
+			created_at: new Date().toISOString()
+		};
+		const { blob, iv } = await encryptJSON(event, key);
+		await client.appendEvent(data.id, blob, iv);
+		const next = new Map(comments);
+		next.set(event.id, { event, status: 'open' });
+		comments = next;
+		pendingComment = null;
+	}
+</script>
+
+{#if !plan}
+	<p class="p-4 text-gray-500">Loading…</p>
+{:else}
+	<div class="grid grid-cols-[1fr_320px] gap-4 p-4">
+		<PlanRenderer
+			markdown={plan.markdown}
+			onSelection={(a) => {
+				selection = a;
+			}}
+		/>
+		<aside>
+			<AnnotationToolbar onSubmit={handleSubmitComment} anchor={anchor} />
+			<ul class="space-y-2 mt-4">
+				{#each [...comments.values()] as state (state.event.id)}
+					<CommentCard {state} isAuthor={reviewerName === plan.author_name} />
+				{/each}
+			</ul>
+		</aside>
+	</div>
+{/if}
+
+{#if showNamePrompt}
+	<NamePromptModal
+		onSave={(name) => {
+			reviewerName = name;
+			showNamePrompt = false;
+			if (pendingComment) handleSubmitComment(pendingComment);
+		}}
+	/>
+{/if}
diff --git a/web/src/routes/share/[id]/+page.ts b/web/src/routes/share/[id]/+page.ts
new file mode 100644
index 0000000..60375fa
--- /dev/null
+++ b/web/src/routes/share/[id]/+page.ts
@@ -0,0 +1,7 @@
+import type { PageLoad } from './$types';
+
+export const ssr = false; // SPA-only; we need window.location.hash and crypto.subtle
+
+export const load: PageLoad = async ({ params }) => {
+	return { id: params.id };
+};
diff --git a/web/src/routes/share/[id]/components/AnnotationToolbar.svelte b/web/src/routes/share/[id]/components/AnnotationToolbar.svelte
new file mode 100644
index 0000000..dd593e7
--- /dev/null
+++ b/web/src/routes/share/[id]/components/AnnotationToolbar.svelte
@@ -0,0 +1,63 @@
+<script lang="ts">
+	import LabelPicker from './LabelPicker.svelte';
+	import type { CommentType, Severity, Anchor } from '$lib/paste/types';
+
+	const { onSubmit, anchor } = $props<{
+		onSubmit: (payload: {
+			body: string;
+			comment_type: CommentType;
+			severity?: Severity;
+			suggested_text?: string;
+			anchor: Anchor;
+		}) => Promise<void>;
+		anchor?: Anchor;
+	}>();
+
+	let body = $state('');
+	let commentType = $state<CommentType>('comment');
+	let severity = $state<Severity | undefined>(undefined);
+	let suggested = $state('');
+	let showSuggested = $state(false);
+
+	async function submit() {
+		if (!anchor || !body.trim()) return;
+		await onSubmit({
+			body: body.trim(),
+			comment_type: commentType,
+			severity: commentType === 'issue' ? severity : undefined,
+			suggested_text: showSuggested ? suggested : undefined,
+			anchor
+		});
+		body = '';
+		suggested = '';
+		showSuggested = false;
+	}
+</script>
+
+<div class="space-y-2 p-2 border rounded">
+	<textarea bind:value={body} placeholder="Comment…" class="w-full" rows="3"></textarea>
+	<LabelPicker bind:value={commentType} />
+	{#if commentType === 'issue'}
+		<label>
+			<input
+				type="checkbox"
+				checked={severity === 'important'}
+				onchange={(e) => (severity = e.currentTarget.checked ? 'important' : 'nit')}
+			/>
+			Important
+		</label>
+	{/if}
+	<label>
+		<input type="checkbox" bind:checked={showSuggested} />
+		Suggest replacement text
+	</label>
+	{#if showSuggested}
+		<textarea
+			bind:value={suggested}
+			placeholder="Proposed replacement…"
+			class="w-full"
+			rows="3"
+		></textarea>
+	{/if}
+	<button onclick={submit} disabled={!body.trim() || !anchor}>Post</button>
+</div>
diff --git a/web/src/routes/share/[id]/components/CommentCard.svelte b/web/src/routes/share/[id]/components/CommentCard.svelte
new file mode 100644
index 0000000..0c504a6
--- /dev/null
+++ b/web/src/routes/share/[id]/components/CommentCard.svelte
@@ -0,0 +1,34 @@
+<script lang="ts">
+	import type { CommentState } from '$lib/paste/events';
+	import ResolveControls from './ResolveControls.svelte';
+	import SuggestionDiff from './SuggestionDiff.svelte';
+
+	const { state, isAuthor } = $props<{ state: CommentState; isAuthor: boolean }>();
+	const e = $derived(state.event);
+</script>
+
+<li class="p-3 border rounded space-y-2">
+	<header class="flex items-center justify-between text-xs">
+		<span class="font-semibold">{e.author_name}</span>
+		<span class="px-2 py-0.5 rounded bg-gray-100"
+			>{e.comment_type}{e.severity ? ` · ${e.severity}` : ''}</span
+		>
+	</header>
+	<p>{e.body}</p>
+	{#if e.suggested_text}
+		<SuggestionDiff original="" suggested={e.suggested_text} />
+	{/if}
+	<!-- DriftBadge expects a status from the resolved anchor; passed in by caller in a future pass -->
+	<footer class="flex items-center justify-between text-xs text-gray-500">
+		<span>{state.status}</span>
+		{#if isAuthor}
+			<ResolveControls
+				commentId={e.id}
+				currentStatus={state.status}
+				onResolve={async (_status, _reply) => {
+					/* parent wires up */
+				}}
+			/>
+		{/if}
+	</footer>
+</li>
diff --git a/web/src/routes/share/[id]/components/CommentThread.svelte b/web/src/routes/share/[id]/components/CommentThread.svelte
new file mode 100644
index 0000000..4a0f6cc
--- /dev/null
+++ b/web/src/routes/share/[id]/components/CommentThread.svelte
@@ -0,0 +1,21 @@
+<script lang="ts">
+	import CommentCard from './CommentCard.svelte';
+	import type { CommentState } from '$lib/paste/events';
+
+	const { parent, replies, isAuthor } = $props<{
+		parent: CommentState;
+		replies: CommentState[];
+		isAuthor: boolean;
+	}>();
+</script>
+
+<div>
+	<CommentCard state={parent} {isAuthor} />
+	{#if replies.length}
+		<ul class="ml-6 mt-2 space-y-2 border-l pl-3">
+			{#each replies as r (r.event.id)}
+				<CommentCard state={r} {isAuthor} />
+			{/each}
+		</ul>
+	{/if}
+</div>
diff --git a/web/src/routes/share/[id]/components/DriftBadge.svelte b/web/src/routes/share/[id]/components/DriftBadge.svelte
new file mode 100644
index 0000000..5eca9fa
--- /dev/null
+++ b/web/src/routes/share/[id]/components/DriftBadge.svelte
@@ -0,0 +1,9 @@
+<script lang="ts">
+	const { status } = $props<{ status: 'ok' | 'drifted' | 'orphaned' }>();
+</script>
+
+{#if status === 'drifted'}
+	<span class="px-1.5 py-0.5 rounded bg-yellow-100 text-yellow-800 text-xs">anchor moved</span>
+{:else if status === 'orphaned'}
+	<span class="px-1.5 py-0.5 rounded bg-red-100 text-red-800 text-xs">content removed</span>
+{/if}
diff --git a/web/src/routes/share/[id]/components/LabelPicker.svelte b/web/src/routes/share/[id]/components/LabelPicker.svelte
new file mode 100644
index 0000000..6bc97fa
--- /dev/null
+++ b/web/src/routes/share/[id]/components/LabelPicker.svelte
@@ -0,0 +1,26 @@
+<script lang="ts">
+	import type { CommentType } from '$lib/paste/types';
+
+	const labels: { id: CommentType; emoji: string; color: string; tone: string }[] = [
+		{ id: 'praise', emoji: '🌟', color: 'bg-green-100 text-green-800', tone: 'Praise' },
+		{ id: 'issue', emoji: '🔴', color: 'bg-red-100 text-red-800', tone: 'Issue' },
+		{ id: 'suggestion', emoji: '💡', color: 'bg-blue-100 text-blue-800', tone: 'Suggestion' },
+		{ id: 'question', emoji: '❓', color: 'bg-yellow-100 text-yellow-800', tone: 'Question' },
+		{ id: 'nit', emoji: '💅', color: 'bg-gray-100 text-gray-800', tone: 'Nit' }
+	];
+
+	let { value = $bindable<CommentType>('comment') } = $props();
+</script>
+
+<div class="flex gap-1 flex-wrap">
+	{#each labels as l}
+		<button
+			type="button"
+			class="px-2 py-1 rounded text-xs {l.color} {value === l.id ? 'ring-2 ring-offset-1' : 'opacity-60'}"
+			onclick={() => (value = l.id)}
+		>
+			{l.emoji}
+			{l.tone}
+		</button>
+	{/each}
+</div>
diff --git a/web/src/routes/share/[id]/components/NamePromptModal.svelte b/web/src/routes/share/[id]/components/NamePromptModal.svelte
new file mode 100644
index 0000000..efb81b0
--- /dev/null
+++ b/web/src/routes/share/[id]/components/NamePromptModal.svelte
@@ -0,0 +1,28 @@
+<script lang="ts">
+	import { setReviewerName } from '$lib/paste/identity';
+
+	const { onSave } = $props<{ onSave: (name: string) => void }>();
+	let name = $state('');
+
+	function save() {
+		const trimmed = name.trim();
+		if (!trimmed) return;
+		setReviewerName(trimmed);
+		onSave(trimmed);
+	}
+</script>
+
+<div class="fixed inset-0 bg-black/50 flex items-center justify-center" role="dialog">
+	<div class="bg-white p-4 rounded shadow space-y-3 w-80">
+		<h2 class="font-semibold">What's your name?</h2>
+		<p class="text-sm text-gray-500">
+			This is shown alongside your review comments. Stored in this browser only.
+		</p>
+		<input bind:value={name} placeholder="Your name" class="w-full border p-2 rounded" />
+		<button
+			onclick={save}
+			class="w-full bg-blue-600 text-white p-2 rounded"
+			disabled={!name.trim()}>Save</button
+		>
+	</div>
+</div>
diff --git a/web/src/routes/share/[id]/components/PlanRenderer.svelte b/web/src/routes/share/[id]/components/PlanRenderer.svelte
new file mode 100644
index 0000000..e053bb5
--- /dev/null
+++ b/web/src/routes/share/[id]/components/PlanRenderer.svelte
@@ -0,0 +1,75 @@
+<script lang="ts">
+	import { slugify } from '$lib/paste/anchor';
+	import { marked } from 'marked';
+
+	const { markdown, onSelection } = $props<{
+		markdown: string;
+		onSelection: (a: {
+			lineStart: number;
+			lineEnd: number;
+			charStart?: number;
+			charEnd?: number;
+			quotedText: string;
+			headingSlug?: string;
+			contextBefore?: string;
+			contextAfter?: string;
+		}) => void;
+	}>();
+
+	const html = $derived(renderWithSourceLines(markdown));
+
+	function renderWithSourceLines(md: string): string {
+		// Simple v1: split by blank-line paragraphs, wrap each in a <div data-source-line>
+		// and pipe content through marked. Tracks source lines well enough for paragraph
+		// anchoring; refine later for sub-paragraph precision.
+		const lines = md.split('\n');
+		const blocks: { startLine: number; text: string }[] = [];
+		let cur: { startLine: number; lines: string[] } | null = null;
+		for (let i = 0; i < lines.length; i++) {
+			const ln = lines[i];
+			if (ln.trim() === '') {
+				if (cur) {
+					blocks.push({ startLine: cur.startLine, text: cur.lines.join('\n') });
+					cur = null;
+				}
+			} else {
+				if (!cur) cur = { startLine: i + 1, lines: [] };
+				cur.lines.push(ln);
+			}
+		}
+		if (cur) blocks.push({ startLine: cur.startLine, text: cur.lines.join('\n') });
+		return blocks
+			.map((b) => `<div data-source-line="${b.startLine}">${marked.parse(b.text)}</div>`)
+			.join('\n');
+	}
+
+	function handleMouseUp() {
+		const sel = window.getSelection();
+		if (!sel || sel.rangeCount === 0 || sel.toString().length === 0) return;
+		const range = sel.getRangeAt(0);
+		const startEl = (range.startContainer.parentElement)?.closest('[data-source-line]') as HTMLElement | null;
+		const endEl = (range.endContainer.parentElement)?.closest('[data-source-line]') as HTMLElement | null;
+		if (!startEl || !endEl) return;
+		const lineStart = Number(startEl.getAttribute('data-source-line'));
+		const lineEnd = Number(endEl.getAttribute('data-source-line'));
+		const quotedText = sel.toString();
+
+		// Find nearest preceding heading element for slug.
+		let headingSlug: string | undefined;
+		let cursor: Element | null = startEl;
+		while (cursor) {
+			const h = cursor.querySelector('h1,h2,h3,h4,h5,h6');
+			if (h) {
+				headingSlug = slugify(h.textContent ?? '');
+				break;
+			}
+			cursor = cursor.previousElementSibling;
+		}
+		onSelection({ lineStart, lineEnd, quotedText, headingSlug });
+	}
+</script>
+
+<!-- svelte-ignore a11y_no_noninteractive_element_interactions -->
+<div onmouseup={handleMouseUp} class="prose" role="document">
+	{@html html}
+</div>
diff --git a/web/src/routes/share/[id]/components/ResolveControls.svelte b/web/src/routes/share/[id]/components/ResolveControls.svelte
new file mode 100644
index 0000000..0642c41
--- /dev/null
+++ b/web/src/routes/share/[id]/components/ResolveControls.svelte
@@ -0,0 +1,42 @@
+<script lang="ts">
+	import type { CommentState } from '$lib/paste/events';
+	import type { ResolutionStatus } from '$lib/paste/types';
+
+	const { commentId: _commentId, currentStatus, onResolve } = $props<{
+		commentId: string;
+		currentStatus: CommentState['status'];
+		onResolve: (status: ResolutionStatus, reply?: string) => Promise<void>;
+	}>();
+
+	let showRejectReply = $state(false);
+	let rejectReply = $state('');
+</script>
+
+<span class="flex gap-1">
+	{#if currentStatus !== 'accepted'}
+		<button class="text-green-700" onclick={() => onResolve('accepted')}>✓ Accept</button>
+	{/if}
+	{#if currentStatus !== 'resolved'}
+		<button class="text-gray-700" onclick={() => onResolve('resolved')}>— Resolve</button>
+	{/if}
+	{#if currentStatus !== 'rejected'}
+		<button class="text-red-700" onclick={() => (showRejectReply = true)}>✕ Reject</button>
+	{/if}
+	{#if currentStatus === 'resolved' || currentStatus === 'rejected' || currentStatus === 'accepted'}
+		<button onclick={() => onResolve('reopened')}>Reopen</button>
+	{/if}
+</span>
+
+{#if showRejectReply}
+	<div class="mt-2 space-y-1">
+		<textarea bind:value={rejectReply} placeholder="Optional reply…" class="w-full" rows="2"
+		></textarea>
+		<button
+			onclick={async () => {
+				await onResolve('rejected', rejectReply);
+				showRejectReply = false;
+				rejectReply = '';
+			}}>Confirm reject</button
+		>
+	</div>
+{/if}
diff --git a/web/src/routes/share/[id]/components/SuggestionDiff.svelte b/web/src/routes/share/[id]/components/SuggestionDiff.svelte
new file mode 100644
index 0000000..3329625
--- /dev/null
+++ b/web/src/routes/share/[id]/components/SuggestionDiff.svelte
@@ -0,0 +1,10 @@
+<script lang="ts">
+	const { original, suggested } = $props<{ original: string; suggested: string }>();
+</script>
+
+<div class="text-sm font-mono">
+	{#if original}
+		<pre class="bg-red-50 line-through p-1">{original}</pre>
+	{/if}
+	<pre class="bg-green-50 p-1">{suggested}</pre>
+</div>

From 85cd69d7ad1b8ae2328b1be509d029bcf9d16ca1 Mon Sep 17 00:00:00 2001
From: Ben Firestone <ben.firestone@krypticlabs.com>
Date: Wed, 29 Apr 2026 13:58:58 -0700
Subject: [PATCH 08/20] feat(api): mount paste handlers in arc-server

Wire the paste package into arc-server so that /api/paste/* endpoints
are available at startup. Paste migrations run automatically on the same
SQLite DB as arc's main storage. The SPA fallback already handles
/share/[id] via the existing embed_webui.go handler.

- Add pastesqlite.Apply call in initSchema after arc migrations succeed
- Add DB() *sql.DB accessor to sqlite.Store for use by route registration
- Create paste_routes.go with registerPasteRoutes(e, db) helper
- Pass DB to api.Config in server.go (conditional: no-op when nil)
- Wire store.DB() into api.Config in internal/server/server.go
- Add TestPasteRoutesMounted and TestShareRouteFallsBackToSPA tests
---
 internal/api/paste_routes.go      | 18 +++++++
 internal/api/paste_routes_test.go | 87 +++++++++++++++++++++++++++++++
 internal/api/server.go            |  9 ++++
 internal/server/server.go         |  1 +
 internal/storage/sqlite/store.go  | 15 +++++-
 5 files changed, 129 insertions(+), 1 deletion(-)
 create mode 100644 internal/api/paste_routes.go
 create mode 100644 internal/api/paste_routes_test.go

diff --git a/internal/api/paste_routes.go b/internal/api/paste_routes.go
new file mode 100644
index 0000000..fc32b30
--- /dev/null
+++ b/internal/api/paste_routes.go
@@ -0,0 +1,18 @@
+package api
+
+import (
+	"database/sql"
+
+	"github.com/labstack/echo/v4"
+	"github.com/sentiolabs/arc/internal/paste"
+	pastesqlite "github.com/sentiolabs/arc/internal/paste/sqlite"
+)
+
+// registerPasteRoutes mounts the paste package's handlers under /api/paste.
+// The caller passes the same DB used for arc's main storage; paste tables
+// are added by pastesqlite.Apply during startup.
+func registerPasteRoutes(e *echo.Echo, db *sql.DB) {
+	store := pastesqlite.New(db)
+	handlers := paste.NewHandlers(store)
+	handlers.Register(e.Group("/api/paste"))
+}
diff --git a/internal/api/paste_routes_test.go b/internal/api/paste_routes_test.go
new file mode 100644
index 0000000..ebcfacf
--- /dev/null
+++ b/internal/api/paste_routes_test.go
@@ -0,0 +1,87 @@
+package api //nolint:testpackage // tests use internal helpers that access unexported fields
+
+import (
+	"bytes"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"path/filepath"
+	"testing"
+
+	"github.com/sentiolabs/arc/internal/paste"
+	"github.com/sentiolabs/arc/internal/storage/sqlite"
+	"github.com/sentiolabs/arc/web"
+)
+
+// testServerWithDB creates a test server with paste routes registered.
+func testServerWithDB(t *testing.T) (*Server, func()) {
+	t.Helper()
+
+	tmpDir := t.TempDir()
+	dbPath := filepath.Join(tmpDir, "test.db")
+	store, err := sqlite.New(dbPath)
+	if err != nil {
+		t.Fatalf("failed to create store: %v", err)
+	}
+
+	server := New(Config{
+		Address: ":0",
+		Store:   store,
+		DB:      store.DB(),
+	})
+
+	cleanup := func() {
+		store.Close()
+	}
+
+	return server, cleanup
+}
+
+func TestPasteRoutesMounted(t *testing.T) {
+	srv, cleanup := testServerWithDB(t)
+	defer cleanup()
+
+	body, _ := json.Marshal(paste.CreatePasteRequest{
+		PlanBlob:  []byte{1, 2, 3},
+		PlanIV:    []byte{4, 5, 6},
+		SchemaVer: 1,
+	})
+	req := httptest.NewRequest(http.MethodPost, "/api/paste", bytes.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+	rec := httptest.NewRecorder()
+	srv.echo.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusCreated {
+		t.Fatalf("expected 201, got %d: %s", rec.Code, rec.Body.String())
+	}
+	var resp paste.CreatePasteResponse
+	if err := json.Unmarshal(rec.Body.Bytes(), &resp); err != nil {
+		t.Fatalf("failed to unmarshal response: %v", err)
+	}
+	if resp.ID == "" {
+		t.Errorf("missing id in response: %+v", resp)
+	}
+	if resp.EditToken == "" {
+		t.Errorf("missing edit_token in response: %+v", resp)
+	}
+}
+
+func TestShareRouteFallsBackToSPA(t *testing.T) {
+	if !web.Enabled {
+		t.Skip("skipping SPA fallback test: webui not compiled (run with -tags webui)")
+	}
+
+	srv, cleanup := testServerWithDB(t)
+	defer cleanup()
+
+	req := httptest.NewRequest(http.MethodGet, "/share/abc", nil)
+	rec := httptest.NewRecorder()
+	srv.echo.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("expected 200 (SPA fallback), got %d", rec.Code)
+	}
+	if !bytes.Contains(rec.Body.Bytes(), []byte("<html")) {
+		t.Errorf("expected HTML body, got: %s", rec.Body.String()[:200])
+	}
+}
diff --git a/internal/api/server.go b/internal/api/server.go
index eea6ab2..a4a335d 100644
--- a/internal/api/server.go
+++ b/internal/api/server.go
@@ -5,6 +5,7 @@ package api
 
 import (
 	"context"
+	"database/sql"
 	"errors"
 	"fmt"
 	"log"
@@ -33,6 +34,9 @@ type Server struct {
 type Config struct {
 	Address string // e.g., ":7432" or "localhost:7432"
 	Store   storage.Storage
+	// DB is the underlying *sql.DB for the arc storage. When non-nil, paste
+	// routes are registered under /api/paste using this connection.
+	DB *sql.DB
 }
 
 // New creates a new API server.
@@ -65,6 +69,11 @@ func New(cfg Config) *Server {
 	// Register routes
 	s.registerRoutes()
 
+	// Register paste routes when a database connection is available.
+	if cfg.DB != nil {
+		registerPasteRoutes(e, cfg.DB)
+	}
+
 	// Serve embedded SPA for non-API routes
 	web.RegisterSPA(e)
 
diff --git a/internal/server/server.go b/internal/server/server.go
index 1384590..a355be6 100644
--- a/internal/server/server.go
+++ b/internal/server/server.go
@@ -67,6 +67,7 @@ func Run(cfg Config) error {
 	server := api.New(api.Config{
 		Address: cfg.Address,
 		Store:   store,
+		DB:      store.DB(),
 	})
 
 	// Start server in goroutine
diff --git a/internal/storage/sqlite/store.go b/internal/storage/sqlite/store.go
index 8de1e42..4cf5e04 100644
--- a/internal/storage/sqlite/store.go
+++ b/internal/storage/sqlite/store.go
@@ -12,6 +12,7 @@ import (
 
 	"github.com/sentiolabs/arc/internal/storage"
 	"github.com/sentiolabs/arc/internal/storage/sqlite/db"
+	pastesqlite "github.com/sentiolabs/arc/internal/paste/sqlite"
 
 	_ "modernc.org/sqlite"
 )
@@ -84,7 +85,7 @@ func New(path string) (*Store, error) {
 // initSchema backs up the database, then runs all pending migrations.
 // If a migration fails and a backup exists, the database is restored
 // to its pre-migration state.
-func (s *Store) initSchema(_ context.Context) error {
+func (s *Store) initSchema(ctx context.Context) error {
 	backupPath, err := backupForMigration(s.db, s.path)
 	if err != nil {
 		// Non-fatal: migrating without a backup is better than not migrating
@@ -112,9 +113,21 @@ func (s *Store) initSchema(_ context.Context) error {
 		_ = os.Remove(backupPath)
 	}
 
+	// Apply paste subsystem migrations on the same database.
+	if err := pastesqlite.Apply(ctx, s.db); err != nil {
+		return fmt.Errorf("apply paste migrations: %w", err)
+	}
+
 	return nil
 }
 
+// DB returns the underlying *sql.DB connection.
+// It is used by callers that need direct database access (e.g. to register
+// additional migration-based subsystems such as the paste package).
+func (s *Store) DB() *sql.DB {
+	return s.db
+}
+
 // Close closes the database connection.
 func (s *Store) Close() error {
 	return s.db.Close()

From 862e0dc52ebdf9987c3eefe12208f4c09e9129c0 Mon Sep 17 00:00:00 2001
From: Ben Firestone <ben.firestone@krypticlabs.com>
Date: Wed, 29 Apr 2026 13:56:59 -0700
Subject: [PATCH 09/20] feat(arc-paste): add standalone paste service binary

---
 Makefile               |  5 ++++
 arc-paste/Dockerfile   | 22 +++++++++++++++
 arc-paste/README.md    | 43 +++++++++++++++++++++++++++++
 arc-paste/main.go      | 61 ++++++++++++++++++++++++++++++++++++++++++
 arc-paste/main_test.go | 37 +++++++++++++++++++++++++
 5 files changed, 168 insertions(+)
 create mode 100644 arc-paste/Dockerfile
 create mode 100644 arc-paste/README.md
 create mode 100644 arc-paste/main.go
 create mode 100644 arc-paste/main_test.go

diff --git a/Makefile b/Makefile
index df40361..c168639 100644
--- a/Makefile
+++ b/Makefile
@@ -104,6 +104,11 @@ build-bin: ## Build arc binary with embedded web UI (requires frontend built fir
 build-quick: ## Build CLI-only binary (no embedded web UI)
 	$(BUILD_SCRIPT)
 
+.PHONY: build-paste
+build-paste: web-build ## Build arc-paste standalone binary
+	@echo "==> Building arc-paste binary..."
+	$(GO) build -o $(BIN_DIR)/arc-paste ./arc-paste
+
 .PHONY: release
 release: ## Build release with goreleaser (requires git tag)
 	goreleaser release --clean
diff --git a/arc-paste/Dockerfile b/arc-paste/Dockerfile
new file mode 100644
index 0000000..be1f5f5
--- /dev/null
+++ b/arc-paste/Dockerfile
@@ -0,0 +1,22 @@
+# Stage 1: Build the web UI
+FROM node:20-alpine AS web
+WORKDIR /web
+COPY web/package.json web/bun.lock* ./
+RUN npm install
+COPY web .
+RUN npm run build
+
+# Stage 2: Build the Go binary
+FROM golang:1.23-alpine AS go-build
+WORKDIR /build
+COPY go.mod go.sum ./
+RUN go mod download
+COPY . .
+COPY --from=web /web/build ./web/build
+RUN CGO_ENABLED=0 go build -o /out/arc-paste ./arc-paste
+
+# Stage 3: Runtime container
+FROM gcr.io/distroless/static-debian12
+COPY --from=go-build /out/arc-paste /arc-paste
+EXPOSE 7433
+ENTRYPOINT ["/arc-paste"]
diff --git a/arc-paste/README.md b/arc-paste/README.md
new file mode 100644
index 0000000..6231f69
--- /dev/null
+++ b/arc-paste/README.md
@@ -0,0 +1,43 @@
+# arc-paste
+
+A tiny standalone binary that exposes the arc paste API and serves the embedded SvelteKit SPA. Designed for public deployment as a zero-knowledge paste service for sharing arc plan reviews.
+
+## Building
+
+```bash
+make build-paste
+```
+
+Produces `./bin/arc-paste`.
+
+## Running
+
+```bash
+./bin/arc-paste
+```
+
+Starts the server on port 7433 by default.
+
+## Configuration
+
+- `ARC_PASTE_ADDR`: Listen address (default: `:7433`)
+- `ARC_PASTE_DB`: SQLite database path (default: `./arc-paste.db`)
+
+## API
+
+The binary serves:
+- `/api/paste/*` — Paste HTTP handlers (create, retrieve, update, delete pastes)
+- `/` — Embedded SPA (with index.html fallback for SPA routing)
+
+CORS is enabled for all origins.
+
+## Docker
+
+```bash
+make docker-build
+docker run -p 7433:7433 arc-paste:latest
+```
+
+## License
+
+See the main arc repository.
diff --git a/arc-paste/main.go b/arc-paste/main.go
new file mode 100644
index 0000000..4b27047
--- /dev/null
+++ b/arc-paste/main.go
@@ -0,0 +1,61 @@
+// Package main is arc-paste, a tiny standalone binary that exposes only the paste API
+// and serves the SvelteKit SPA. Designed for public deployment as a
+// zero-knowledge paste service for arc plan reviews.
+package main
+
+import (
+	"context"
+	"database/sql"
+	"log"
+	"os"
+
+	"github.com/labstack/echo/v4"
+	"github.com/labstack/echo/v4/middleware"
+	_ "modernc.org/sqlite" // match arc's driver
+
+	"github.com/sentiolabs/arc/internal/paste"
+	pastesqlite "github.com/sentiolabs/arc/internal/paste/sqlite"
+	"github.com/sentiolabs/arc/web"
+)
+
+func main() {
+	addr := envOr("ARC_PASTE_ADDR", ":7433")
+	dbPath := envOr("ARC_PASTE_DB", "./arc-paste.db")
+
+	db, err := sql.Open("sqlite", dbPath)
+	if err != nil {
+		log.Fatalf("open db: %v", err)
+	}
+	defer db.Close()
+
+	if err := pastesqlite.Apply(context.Background(), db); err != nil {
+		log.Fatalf("apply migrations: %v", err)
+	}
+
+	store := pastesqlite.New(db)
+	handlers := paste.NewHandlers(store)
+
+	e := echo.New()
+	e.HideBanner = true
+	e.Use(middleware.Logger())
+	e.Use(middleware.Recover())
+	e.Use(middleware.CORS())
+
+	// Mount paste handlers at /api/paste
+	handlers.Register(e.Group("/api/paste"))
+
+	// Serve embedded SPA with fallback to index.html for routing
+	web.RegisterSPA(e)
+
+	if err := e.Start(addr); err != nil {
+		log.Fatalf("start server: %v", err)
+	}
+}
+
+// envOr returns the value of env variable key, or defaultVal if not set.
+func envOr(key, defaultVal string) string {
+	if v, ok := os.LookupEnv(key); ok {
+		return v
+	}
+	return defaultVal
+}
diff --git a/arc-paste/main_test.go b/arc-paste/main_test.go
new file mode 100644
index 0000000..7fb9c49
--- /dev/null
+++ b/arc-paste/main_test.go
@@ -0,0 +1,37 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	"database/sql"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	_ "modernc.org/sqlite"
+	"github.com/labstack/echo/v4"
+	"github.com/sentiolabs/arc/internal/paste"
+	pastesqlite "github.com/sentiolabs/arc/internal/paste/sqlite"
+)
+
+func TestArcPasteCreate(t *testing.T) {
+	db, _ := sql.Open("sqlite", ":memory:")
+	defer db.Close()
+	_ = pastesqlite.Apply(context.Background(), db)
+	e := echo.New()
+	paste.NewHandlers(pastesqlite.New(db)).Register(e.Group("/api/paste"))
+
+	body, _ := json.Marshal(map[string]any{
+		"plan_blob":  []byte{1, 2, 3},
+		"plan_iv":    []byte{4, 5, 6},
+		"schema_ver": 1,
+	})
+	req := httptest.NewRequest("POST", "/api/paste", bytes.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+	rec := httptest.NewRecorder()
+	e.ServeHTTP(rec, req)
+	if rec.Code != http.StatusCreated {
+		t.Fatalf("expected 201, got %d", rec.Code)
+	}
+}

From 69edd9f7b12867b7656ca5d48f9386da89065de9 Mon Sep 17 00:00:00 2001
From: Ben Firestone <ben.firestone@krypticlabs.com>
Date: Wed, 29 Apr 2026 14:03:14 -0700
Subject: [PATCH 10/20] feat(cli): add arc share commands and shares.json
 registry

Implements `arc share create|list|show|comments|pull|approve|update|delete`
with client-side AES-GCM encryption via the paste package and persists
share metadata (key, edit_token) to ~/.arc/shares.json (mode 0600).
---
 cmd/arc/share.go                           | 508 +++++++++++++++++++++
 cmd/arc/share_test.go                      | 160 +++++++
 internal/sharesconfig/sharesconfig.go      | 122 +++++
 internal/sharesconfig/sharesconfig_test.go |  46 ++
 4 files changed, 836 insertions(+)
 create mode 100644 cmd/arc/share.go
 create mode 100644 cmd/arc/share_test.go
 create mode 100644 internal/sharesconfig/sharesconfig.go
 create mode 100644 internal/sharesconfig/sharesconfig_test.go

diff --git a/cmd/arc/share.go b/cmd/arc/share.go
new file mode 100644
index 0000000..e224242
--- /dev/null
+++ b/cmd/arc/share.go
@@ -0,0 +1,508 @@
+// Package main extends the arc CLI with `arc share` commands for creating
+// and managing zero-knowledge encrypted plan shares.
+package main
+
+import (
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/spf13/cobra"
+
+	"github.com/sentiolabs/arc/internal/paste"
+	"github.com/sentiolabs/arc/internal/sharesconfig"
+)
+
+// --- plaintext schemas (mirror web/src/lib/paste/types.ts) ---
+
+type planPlaintext struct {
+	Version    int    `json:"version"`
+	Markdown   string `json:"markdown"`
+	Title      string `json:"title,omitempty"`
+	AuthorName string `json:"author_name,omitempty"`
+	CreatedAt  string `json:"created_at"`
+}
+
+type commentEvent struct {
+	Kind          string `json:"kind"`
+	ID            string `json:"id"`
+	AuthorName    string `json:"author_name"`
+	CommentType   string `json:"comment_type"`
+	Severity      string `json:"severity,omitempty"`
+	Body          string `json:"body"`
+	SuggestedText string `json:"suggested_text,omitempty"`
+	ParentID      string `json:"parent_id,omitempty"`
+	Anchor        any    `json:"anchor"`
+	CreatedAt     string `json:"created_at"`
+}
+
+type resolutionEvent struct {
+	Kind      string `json:"kind"`
+	ID        string `json:"id"`
+	CommentID string `json:"comment_id"`
+	Status    string `json:"status"`
+	Reply     string `json:"reply,omitempty"`
+	AuthorName string `json:"author_name"`
+	CreatedAt  string `json:"created_at"`
+}
+
+type approvalEvent struct {
+	Kind       string `json:"kind"` // always "approval"
+	ID         string `json:"id"`
+	AuthorName string `json:"author_name"`
+	CreatedAt  string `json:"created_at"`
+}
+
+// --- commands ---
+
+var shareCmd = &cobra.Command{
+	Use:   "share",
+	Short: "Create and manage encrypted plan shares",
+}
+
+var shareCreateCmd = &cobra.Command{
+	Use:   "create <plan-file>",
+	Short: "Encrypt a plan and create a share",
+	Args:  cobra.ExactArgs(1),
+	RunE:  runShareCreate,
+}
+
+var shareListCmd = &cobra.Command{
+	Use:   "list",
+	Short: "List shares known to this machine",
+	RunE:  runShareList,
+}
+
+var shareShowCmd = &cobra.Command{
+	Use:   "show <id-or-url>",
+	Short: "Decrypt and print plan content",
+	Args:  cobra.ExactArgs(1),
+	RunE:  runShareShow,
+}
+
+var shareCommentsCmd = &cobra.Command{
+	Use:   "comments <id-or-url>",
+	Short: "Fetch and decrypt comments for a share",
+	Args:  cobra.ExactArgs(1),
+	RunE:  runShareComments,
+}
+
+var sharePullCmd = &cobra.Command{
+	Use:   "pull <id-or-url>",
+	Short: "Pull comments (alias for `comments` with --accepted-only by default)",
+	Args:  cobra.ExactArgs(1),
+	RunE:  runSharePull,
+}
+
+var shareApproveCmd = &cobra.Command{
+	Use:   "approve <id-or-url>",
+	Short: "Mark the share as approved",
+	Args:  cobra.ExactArgs(1),
+	RunE:  runShareApprove,
+}
+
+var shareUpdateCmd = &cobra.Command{
+	Use:   "update <id-or-url> <plan-file>",
+	Short: "Replace the encrypted plan content (uses edit_token from shares.json)",
+	Args:  cobra.ExactArgs(2),
+	RunE:  runShareUpdate,
+}
+
+var shareDeleteCmd = &cobra.Command{
+	Use:   "delete <id-or-url>",
+	Short: "Delete a share (uses edit_token from shares.json)",
+	Args:  cobra.ExactArgs(1),
+	RunE:  runShareDelete,
+}
+
+var (
+	shareCreateLocal      bool
+	shareCreateRemote     bool
+	shareCreateServer     string
+	shareCommentsAccepted bool
+	shareCommentsJSON     bool
+)
+
+func init() {
+	shareCreateCmd.Flags().BoolVar(&shareCreateLocal, "local", false, "Use the local arc-server")
+	shareCreateCmd.Flags().BoolVar(&shareCreateRemote, "share", false, "Use the configured remote share server")
+	shareCreateCmd.Flags().StringVar(&shareCreateServer, "server", "", "Override server URL")
+	shareCommentsCmd.Flags().BoolVar(&shareCommentsAccepted, "accepted-only", false, "Only print accepted comments")
+	shareCommentsCmd.Flags().BoolVar(&shareCommentsJSON, "json", false, "Output as JSON")
+
+	shareCmd.AddCommand(shareCreateCmd, shareListCmd, shareShowCmd, shareCommentsCmd,
+		sharePullCmd, shareApproveCmd, shareUpdateCmd, shareDeleteCmd)
+	rootCmd.AddCommand(shareCmd)
+}
+
+// --- run* functions ---
+
+func runShareCreate(cmd *cobra.Command, args []string) error {
+	planFile := args[0]
+	md, err := os.ReadFile(planFile)
+	if err != nil {
+		return err
+	}
+	server, kind := resolveServer(shareCreateLocal, shareCreateRemote, shareCreateServer)
+	key, err := paste.GenerateKey()
+	if err != nil {
+		return err
+	}
+	plain := planPlaintext{
+		Version:   1,
+		Markdown:  string(md),
+		CreatedAt: time.Now().UTC().Format(time.RFC3339),
+	}
+	blob, iv, err := paste.EncryptJSON(plain, key)
+	if err != nil {
+		return err
+	}
+	resp, err := postCreate(server, blob, iv)
+	if err != nil {
+		return err
+	}
+	keyB64 := base64.RawURLEncoding.EncodeToString(key)
+	if err := sharesconfig.Add(sharesconfig.Share{
+		ID:        resp.ID,
+		Kind:      kind,
+		URL:       server,
+		KeyB64Url: keyB64,
+		EditToken: resp.EditToken,
+		PlanFile:  planFile,
+		CreatedAt: time.Now().UTC(),
+	}); err != nil {
+		return err
+	}
+	fmt.Printf("Share URL:  %s/share/%s#k=%s\n", strings.TrimRight(server, "/"), resp.ID, keyB64)
+	fmt.Printf("Edit token: %s (saved in ~/.arc/shares.json — keep safe)\n", resp.EditToken)
+	return nil
+}
+
+func runShareList(cmd *cobra.Command, args []string) error {
+	f, err := sharesconfig.Load()
+	if err != nil {
+		return err
+	}
+	if len(f.Shares) == 0 {
+		fmt.Println("(no shares)")
+		return nil
+	}
+	for _, s := range f.Shares {
+		fmt.Printf("%s\t%s\t%s\t%s\n", s.ID, s.Kind, s.URL, s.PlanFile)
+	}
+	return nil
+}
+
+func runShareShow(cmd *cobra.Command, args []string) error {
+	id, server, key, err := resolveShareRef(args[0])
+	if err != nil {
+		return err
+	}
+	plan, _, err := fetchAndDecrypt(server, id, key)
+	if err != nil {
+		return err
+	}
+	fmt.Println(plan.Markdown)
+	return nil
+}
+
+func runShareComments(cmd *cobra.Command, args []string) error {
+	id, server, key, err := resolveShareRef(args[0])
+	if err != nil {
+		return err
+	}
+	return printComments(server, id, key, shareCommentsAccepted, shareCommentsJSON)
+}
+
+func runSharePull(cmd *cobra.Command, args []string) error {
+	id, server, key, err := resolveShareRef(args[0])
+	if err != nil {
+		return err
+	}
+	return printComments(server, id, key, true, false)
+}
+
+func runShareApprove(cmd *cobra.Command, args []string) error {
+	id, server, key, err := resolveShareRef(args[0])
+	if err != nil {
+		return err
+	}
+	plan, _, err := fetchAndDecrypt(server, id, key)
+	if err != nil {
+		return err
+	}
+	ev := approvalEvent{
+		Kind:       "approval",
+		ID:         fmt.Sprintf("a-%d", time.Now().UnixNano()),
+		AuthorName: plan.AuthorName,
+		CreatedAt:  time.Now().UTC().Format(time.RFC3339),
+	}
+	blob, iv, err := paste.EncryptJSON(ev, key)
+	if err != nil {
+		return err
+	}
+	return postEvent(server, id, blob, iv)
+}
+
+func runShareUpdate(cmd *cobra.Command, args []string) error {
+	ref, planFile := args[0], args[1]
+	md, err := os.ReadFile(planFile)
+	if err != nil {
+		return err
+	}
+	id, server, key, err := resolveShareRef(ref)
+	if err != nil {
+		return err
+	}
+	s, _ := sharesconfig.Find(id)
+	if s == nil || s.EditToken == "" {
+		return fmt.Errorf("no edit_token for share %s in ~/.arc/shares.json", id)
+	}
+	plain := planPlaintext{
+		Version:   1,
+		Markdown:  string(md),
+		CreatedAt: time.Now().UTC().Format(time.RFC3339),
+	}
+	blob, iv, err := paste.EncryptJSON(plain, key)
+	if err != nil {
+		return err
+	}
+	return putPlan(server, id, s.EditToken, blob, iv)
+}
+
+func runShareDelete(cmd *cobra.Command, args []string) error {
+	id, server, _, err := resolveShareRef(args[0])
+	if err != nil {
+		return err
+	}
+	s, _ := sharesconfig.Find(id)
+	if s == nil || s.EditToken == "" {
+		return fmt.Errorf("no edit_token for share %s in ~/.arc/shares.json", id)
+	}
+	if err := deleteShare(server, id, s.EditToken); err != nil {
+		return err
+	}
+	return sharesconfig.Remove(id)
+}
+
+// --- helpers ---
+
+// resolveServer returns the server URL and kind ("local" or "shared") based on
+// the provided flags.
+func resolveServer(local, share bool, override string) (string, string) {
+	if override != "" {
+		return override, "shared"
+	}
+	if share {
+		if env := os.Getenv("ARC_SHARE_SERVER"); env != "" {
+			return env, "shared"
+		}
+		return "https://share.arc.tools", "shared"
+	}
+	return cliConfigServerURL(), "local"
+}
+
+// cliConfigServerURL returns the server URL from the CLI config, falling back
+// to the default local URL.
+func cliConfigServerURL() string {
+	cfg, err := loadConfig()
+	if err != nil || cfg.ServerURL == "" {
+		return "http://localhost:7432"
+	}
+	return cfg.ServerURL
+}
+
+// postCreate sends a CreatePasteRequest to the server and returns the response.
+func postCreate(server string, blob, iv []byte) (*paste.CreatePasteResponse, error) {
+	u := strings.TrimRight(server, "/") + "/api/paste"
+	body, _ := json.Marshal(paste.CreatePasteRequest{PlanBlob: blob, PlanIV: iv, SchemaVer: 1})
+	resp, err := http.Post(u, "application/json", strings.NewReader(string(body)))
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusCreated {
+		b, _ := io.ReadAll(resp.Body)
+		return nil, fmt.Errorf("create paste: %s: %s", resp.Status, b)
+	}
+	var out paste.CreatePasteResponse
+	return &out, json.NewDecoder(resp.Body).Decode(&out)
+}
+
+// postEvent appends an encrypted event blob to an existing share.
+func postEvent(server, id string, blob, iv []byte) error {
+	u := strings.TrimRight(server, "/") + "/api/paste/" + url.PathEscape(id) + "/blobs"
+	body, _ := json.Marshal(paste.AppendEventRequest{Blob: blob, IV: iv})
+	resp, err := http.Post(u, "application/json", strings.NewReader(string(body)))
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusCreated {
+		b, _ := io.ReadAll(resp.Body)
+		return fmt.Errorf("append event: %s: %s", resp.Status, b)
+	}
+	return nil
+}
+
+// putPlan replaces the plan blob of an existing share using the edit token.
+func putPlan(server, id, token string, blob, iv []byte) error {
+	u := strings.TrimRight(server, "/") + "/api/paste/" + url.PathEscape(id)
+	body, _ := json.Marshal(map[string][]byte{"plan_blob": blob, "plan_iv": iv})
+	req, _ := http.NewRequest(http.MethodPut, u, strings.NewReader(string(body)))
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("Authorization", "Bearer "+token)
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusNoContent {
+		b, _ := io.ReadAll(resp.Body)
+		return fmt.Errorf("update plan: %s: %s", resp.Status, b)
+	}
+	return nil
+}
+
+// deleteShare deletes a share using the edit token.
+func deleteShare(server, id, token string) error {
+	u := strings.TrimRight(server, "/") + "/api/paste/" + url.PathEscape(id)
+	req, _ := http.NewRequest(http.MethodDelete, u, nil)
+	req.Header.Set("Authorization", "Bearer "+token)
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusNoContent {
+		b, _ := io.ReadAll(resp.Body)
+		return fmt.Errorf("delete share: %s: %s", resp.Status, b)
+	}
+	return nil
+}
+
+// fetchAndDecrypt retrieves a share from the server and decrypts the plan
+// blob using the provided key.
+func fetchAndDecrypt(server, id string, key []byte) (*planPlaintext, []paste.PasteEvent, error) {
+	resp, err := http.Get(strings.TrimRight(server, "/") + "/api/paste/" + url.PathEscape(id))
+	if err != nil {
+		return nil, nil, err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		return nil, nil, fmt.Errorf("get paste: %s", resp.Status)
+	}
+	var pr struct {
+		paste.PasteShare
+		Events []paste.PasteEvent `json:"events"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&pr); err != nil {
+		return nil, nil, err
+	}
+	var plan planPlaintext
+	if err := paste.DecryptJSON(pr.PlanBlob, pr.PlanIV, key, &plan); err != nil {
+		return nil, nil, err
+	}
+	return &plan, pr.Events, nil
+}
+
+// printComments fetches all events, decrypts them, and prints comments to
+// stdout. When acceptedOnly is true only accepted comments are printed. When
+// asJSON is true each comment is printed as a JSON object.
+func printComments(server, id string, key []byte, acceptedOnly, asJSON bool) error {
+	plan, events, err := fetchAndDecrypt(server, id, key)
+	if err != nil {
+		return err
+	}
+	comments := map[string]commentEvent{}
+	resolutions := map[string]resolutionEvent{}
+	for _, e := range events {
+		var raw json.RawMessage
+		if err := paste.DecryptJSON(e.Blob, e.IV, key, &raw); err != nil {
+			continue
+		}
+		var generic struct {
+			Kind string `json:"kind"`
+		}
+		_ = json.Unmarshal(raw, &generic)
+		switch generic.Kind {
+		case "comment":
+			var c commentEvent
+			if err := json.Unmarshal(raw, &c); err == nil {
+				comments[c.ID] = c
+			}
+		case "resolution":
+			var r resolutionEvent
+			if err := json.Unmarshal(raw, &r); err == nil {
+				if plan.AuthorName == "" || r.AuthorName == plan.AuthorName {
+					resolutions[r.CommentID] = r
+				}
+			}
+		}
+	}
+	for cid, c := range comments {
+		res, ok := resolutions[cid]
+		status := "open"
+		if ok {
+			status = res.Status
+		}
+		if acceptedOnly && status != "accepted" {
+			continue
+		}
+		if asJSON {
+			payload := map[string]any{"comment": c, "status": status}
+			if ok && res.Reply != "" {
+				payload["reply"] = res.Reply
+			}
+			out, _ := json.Marshal(payload)
+			fmt.Println(string(out))
+		} else {
+			fmt.Printf("[%s] %s (%s): %s\n", status, c.AuthorName, c.CommentType, c.Body)
+		}
+	}
+	return nil
+}
+
+// resolveShareRef parses a share reference which may be either a full share
+// URL (e.g. https://share.arc.tools/share/abc12345#k=KEY) or a bare share ID
+// known to ~/.arc/shares.json.
+func resolveShareRef(ref string) (string, string, []byte, error) {
+	if strings.Contains(ref, "://") {
+		u, err := url.Parse(ref)
+		if err != nil {
+			return "", "", nil, err
+		}
+		parts := strings.Split(strings.Trim(u.Path, "/"), "/")
+		if len(parts) < 2 || parts[0] != "share" {
+			return "", "", nil, fmt.Errorf("invalid share URL: %s", ref)
+		}
+		id := parts[1]
+		frag, _ := url.ParseQuery(u.Fragment)
+		keyB64 := frag.Get("k")
+		if keyB64 == "" {
+			if s, _ := sharesconfig.Find(id); s != nil {
+				keyB64 = s.KeyB64Url
+			}
+		}
+		key, err := base64.RawURLEncoding.DecodeString(keyB64)
+		if err != nil {
+			return "", "", nil, err
+		}
+		return id, u.Scheme + "://" + u.Host, key, nil
+	}
+	s, err := sharesconfig.Find(ref)
+	if err != nil {
+		return "", "", nil, err
+	}
+	if s == nil {
+		return "", "", nil, fmt.Errorf("unknown share id: %s", ref)
+	}
+	key, _ := base64.RawURLEncoding.DecodeString(s.KeyB64Url)
+	return s.ID, s.URL, key, nil
+}
diff --git a/cmd/arc/share_test.go b/cmd/arc/share_test.go
new file mode 100644
index 0000000..06094ca
--- /dev/null
+++ b/cmd/arc/share_test.go
@@ -0,0 +1,160 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	"database/sql"
+	"encoding/base64"
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/labstack/echo/v4"
+	_ "modernc.org/sqlite"
+
+	"github.com/sentiolabs/arc/internal/paste"
+	pastesqlite "github.com/sentiolabs/arc/internal/paste/sqlite"
+	"github.com/sentiolabs/arc/internal/sharesconfig"
+)
+
+func startTestPasteServer(t *testing.T) *httptest.Server {
+	t.Helper()
+	db, err := sql.Open("sqlite", ":memory:")
+	if err != nil {
+		t.Fatalf("open sqlite: %v", err)
+	}
+	if err := pastesqlite.Apply(context.Background(), db); err != nil {
+		t.Fatalf("apply migrations: %v", err)
+	}
+	e := echo.New()
+	paste.NewHandlers(pastesqlite.New(db)).Register(e.Group("/api/paste"))
+	return httptest.NewServer(e)
+}
+
+func TestShareCreateRoundTrip(t *testing.T) {
+	home := t.TempDir()
+	t.Setenv("HOME", home)
+	srv := startTestPasteServer(t)
+	defer srv.Close()
+
+	plan := filepath.Join(t.TempDir(), "plan.md")
+	_ = os.WriteFile(plan, []byte("# Hello\n\nBody."), 0o644)
+
+	shareCreateServer = srv.URL
+	if err := runShareCreate(shareCreateCmd, []string{plan}); err != nil {
+		t.Fatalf("runShareCreate: %v", err)
+	}
+
+	f, _ := sharesconfig.Load()
+	if len(f.Shares) != 1 {
+		t.Fatalf("expected 1 share recorded, got %d", len(f.Shares))
+	}
+	s := f.Shares[0]
+	if s.URL != srv.URL {
+		t.Errorf("URL mismatch: %s vs %s", s.URL, srv.URL)
+	}
+	if s.EditToken == "" || s.KeyB64Url == "" {
+		t.Errorf("missing edit_token or key: %+v", s)
+	}
+}
+
+func TestResolveShareRefFromURL(t *testing.T) {
+	id, server, key, err := resolveShareRef("https://share.arc.tools/share/abc12345#k=AAAA")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if id != "abc12345" || server != "https://share.arc.tools" || len(key) == 0 {
+		t.Errorf("bad parse: id=%s server=%s key=%v", id, server, key)
+	}
+}
+
+func TestRunShareCommentsRoundTrip(t *testing.T) {
+	home := t.TempDir()
+	t.Setenv("HOME", home)
+	srv := startTestPasteServer(t)
+	defer srv.Close()
+
+	// Create a plan
+	plan := filepath.Join(t.TempDir(), "p.md")
+	_ = os.WriteFile(plan, []byte("# P"), 0o644)
+	shareCreateServer = srv.URL
+	_ = runShareCreate(shareCreateCmd, []string{plan})
+
+	f, _ := sharesconfig.Load()
+	s := f.Shares[0]
+	keyBytes := mustDecodeKey(t, s.KeyB64Url)
+
+	// Manually post a comment event.
+	c := map[string]any{
+		"kind": "comment", "id": "c1", "author_name": "Alice", "comment_type": "comment",
+		"body": "looks good", "anchor": map[string]any{"line_start": 1, "line_end": 1, "quoted_text": "P"},
+		"created_at": "2026-04-29T00:00:00Z",
+	}
+	blob, iv, _ := paste.EncryptJSON(c, keyBytes)
+	body, _ := json.Marshal(paste.AppendEventRequest{Blob: blob, IV: iv})
+	if err := postRaw(t, srv.URL+"/api/paste/"+s.ID+"/blobs", body); err != nil {
+		t.Fatal(err)
+	}
+
+	// Capture stdout while running comments
+	out := captureStdout(t, func() { _ = runShareComments(shareCommentsCmd, []string{s.ID}) })
+	if !strings.Contains(out, "Alice") || !strings.Contains(out, "looks good") {
+		t.Errorf("expected Alice/looks good in output, got: %s", out)
+	}
+}
+
+// mustDecodeKey decodes a base64url key or fatals the test.
+func mustDecodeKey(t *testing.T, b64 string) []byte {
+	t.Helper()
+	key, err := base64.RawURLEncoding.DecodeString(b64)
+	if err != nil {
+		t.Fatalf("decode key: %v", err)
+	}
+	return key
+}
+
+// postRaw sends an HTTP POST with a JSON body to url and fails if the status
+// is not 2xx.
+func postRaw(t *testing.T, url string, body []byte) error {
+	t.Helper()
+	resp, err := http.Post(url, "application/json", bytes.NewReader(body))
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		b, _ := io.ReadAll(resp.Body)
+		t.Errorf("postRaw %s: %s: %s", url, resp.Status, b)
+	}
+	return nil
+}
+
+// captureStdout captures writes to os.Stdout during fn and returns the
+// captured output as a string.
+func captureStdout(t *testing.T, fn func()) string {
+	t.Helper()
+	old := os.Stdout
+	r, w, err := os.Pipe()
+	if err != nil {
+		t.Fatalf("pipe: %v", err)
+	}
+	os.Stdout = w
+
+	fn()
+
+	w.Close()
+	os.Stdout = old
+	var buf bytes.Buffer
+	_, _ = io.Copy(&buf, r)
+	return buf.String()
+}
+
+// contains is a convenience wrapper around strings.Contains.
+func contains(s, substr string) bool {
+	return strings.Contains(s, substr)
+}
diff --git a/internal/sharesconfig/sharesconfig.go b/internal/sharesconfig/sharesconfig.go
new file mode 100644
index 0000000..e7a7ac4
--- /dev/null
+++ b/internal/sharesconfig/sharesconfig.go
@@ -0,0 +1,122 @@
+// Package sharesconfig manages the registry of paste shares the user has
+// created, stored at ~/.arc/shares.json with file mode 0600.
+package sharesconfig
+
+import (
+	"encoding/json"
+	"errors"
+	"os"
+	"path/filepath"
+	"time"
+)
+
+// Share holds the metadata for a single paste share created by this machine.
+type Share struct {
+	ID        string    `json:"id"`
+	Kind      string    `json:"kind"` // "local" | "shared"
+	URL       string    `json:"url"`
+	KeyB64Url string    `json:"key_b64url"`
+	EditToken string    `json:"edit_token"`
+	PlanFile  string    `json:"plan_file,omitempty"`
+	CreatedAt time.Time `json:"created_at"`
+}
+
+// File is the top-level structure of ~/.arc/shares.json.
+type File struct {
+	Shares []Share `json:"shares"`
+}
+
+// defaultPath returns the path to ~/.arc/shares.json.
+func defaultPath() (string, error) {
+	home, err := os.UserHomeDir()
+	if err != nil {
+		return "", err
+	}
+	return filepath.Join(home, ".arc", "shares.json"), nil
+}
+
+// Load reads the shares file from disk. Returns an empty File if the file does
+// not exist yet.
+func Load() (*File, error) {
+	path, err := defaultPath()
+	if err != nil {
+		return nil, err
+	}
+	data, err := os.ReadFile(path)
+	if errors.Is(err, os.ErrNotExist) {
+		return &File{}, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	var f File
+	if err := json.Unmarshal(data, &f); err != nil {
+		return nil, err
+	}
+	return &f, nil
+}
+
+// Save writes the File to disk at ~/.arc/shares.json with mode 0600. The
+// parent directory is created with mode 0700 if it does not exist.
+func Save(f *File) error {
+	path, err := defaultPath()
+	if err != nil {
+		return err
+	}
+	if err := os.MkdirAll(filepath.Dir(path), 0o700); err != nil {
+		return err
+	}
+	data, err := json.MarshalIndent(f, "", "  ")
+	if err != nil {
+		return err
+	}
+	return os.WriteFile(path, data, 0o600)
+}
+
+// Add upserts a Share into the registry. If a share with the same ID already
+// exists it is replaced; otherwise the share is appended.
+func Add(s Share) error {
+	f, err := Load()
+	if err != nil {
+		return err
+	}
+	for i, existing := range f.Shares {
+		if existing.ID == s.ID {
+			f.Shares[i] = s
+			return Save(f)
+		}
+	}
+	f.Shares = append(f.Shares, s)
+	return Save(f)
+}
+
+// Find returns the Share with the given ID, or nil if not found.
+func Find(id string) (*Share, error) {
+	f, err := Load()
+	if err != nil {
+		return nil, err
+	}
+	for _, s := range f.Shares {
+		if s.ID == id {
+			return &s, nil
+		}
+	}
+	return nil, nil
+}
+
+// Remove deletes the share with the given ID from the registry. It is a no-op
+// if the ID does not exist.
+func Remove(id string) error {
+	f, err := Load()
+	if err != nil {
+		return err
+	}
+	out := f.Shares[:0]
+	for _, s := range f.Shares {
+		if s.ID != id {
+			out = append(out, s)
+		}
+	}
+	f.Shares = out
+	return Save(f)
+}
diff --git a/internal/sharesconfig/sharesconfig_test.go b/internal/sharesconfig/sharesconfig_test.go
new file mode 100644
index 0000000..5cfae4e
--- /dev/null
+++ b/internal/sharesconfig/sharesconfig_test.go
@@ -0,0 +1,46 @@
+package sharesconfig_test
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/sentiolabs/arc/internal/sharesconfig"
+)
+
+func TestAddAndFind(t *testing.T) {
+	t.Setenv("HOME", t.TempDir())
+	s := sharesconfig.Share{ID: "abc", Kind: "local", URL: "http://x", KeyB64Url: "k", EditToken: "t", CreatedAt: time.Now()}
+	if err := sharesconfig.Add(s); err != nil {
+		t.Fatal(err)
+	}
+	found, err := sharesconfig.Find("abc")
+	if err != nil || found == nil || found.ID != "abc" {
+		t.Errorf("unexpected: %+v err=%v", found, err)
+	}
+}
+
+func TestFileMode0600(t *testing.T) {
+	home := t.TempDir()
+	t.Setenv("HOME", home)
+	_ = sharesconfig.Add(sharesconfig.Share{ID: "x", Kind: "local", CreatedAt: time.Now()})
+	info, err := os.Stat(filepath.Join(home, ".arc", "shares.json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if info.Mode().Perm() != 0o600 {
+		t.Errorf("expected mode 0600, got %o", info.Mode().Perm())
+	}
+}
+
+func TestRemove(t *testing.T) {
+	t.Setenv("HOME", t.TempDir())
+	_ = sharesconfig.Add(sharesconfig.Share{ID: "a", CreatedAt: time.Now()})
+	_ = sharesconfig.Add(sharesconfig.Share{ID: "b", CreatedAt: time.Now()})
+	_ = sharesconfig.Remove("a")
+	f, _ := sharesconfig.Load()
+	if len(f.Shares) != 1 || f.Shares[0].ID != "b" {
+		t.Errorf("after remove, got %+v", f.Shares)
+	}
+}

From aca67c5e91d29dc041a95af796f97ed0c31ce6e6 Mon Sep 17 00:00:00 2001
From: Ben Firestone <ben.firestone@krypticlabs.com>
Date: Wed, 29 Apr 2026 16:56:41 -0700
Subject: [PATCH 11/20] feat(web): rebuild /share/[id] with editorial review UX
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Replaces the initial review surface with an Editorial Marginalia aesthetic
(dark paper, Newsreader serif body, ink-color metaphor) and a plannotator-style
floating toolbar. The selection-driven workflow now offers six distinct intents
(praise, comment, delete, suggest, quick-label, dismiss) instead of the original
inline AnnotationToolbar.

- Adds scoped --ink-* design tokens under .share-page in app.css
- Skips arc's sidebar + projects fetch on /share/* via isShareRoute guard
- Wraps quoted_text inline with <mark> via DOM walk (inline-annotations.ts)
- Splits the right rail into AnnotationsPanel + AnnotationCard
- Pulls comment/suggest into a single CommentPopover
- Adds QuickLabelPicker for ⚡ menu with 1..5 keyboard shortcuts
- Renders floating overlays inside .share-page so they inherit ink tokens
- Adds action: 'comment' | 'delete' field to CommentEvent
- Adds @tailwindcss/typography devDep

Removes superseded components: AnnotationToolbar, CommentCard, CommentThread,
DriftBadge, LabelPicker, ResolveControls, SuggestionDiff. Threading, suggestion
diff rendering, and drift badges are deferred (see status doc).
---
 web/bun.lock                                  |   7 +-
 web/package.json                              |   1 +
 web/src/app.css                               | 337 ++++++++++++-
 web/src/lib/paste/types.ts                    |  11 +
 web/src/routes/+layout.svelte                 |  70 +--
 web/src/routes/share/[id]/+page.svelte        | 447 ++++++++++++++----
 .../[id]/components/AnnotationCard.svelte     | 244 ++++++++++
 .../[id]/components/AnnotationToolbar.svelte  |  63 ---
 .../[id]/components/AnnotationsPanel.svelte   |  78 +++
 .../share/[id]/components/CommentCard.svelte  |  34 --
 .../[id]/components/CommentPopover.svelte     | 147 ++++++
 .../[id]/components/CommentThread.svelte      |  21 -
 .../share/[id]/components/DriftBadge.svelte   |   9 -
 .../[id]/components/FloatingToolbar.svelte    | 196 ++++++++
 .../share/[id]/components/LabelPicker.svelte  |  26 -
 .../[id]/components/NamePromptModal.svelte    |  52 +-
 .../share/[id]/components/PlanRenderer.svelte | 109 ++++-
 .../[id]/components/QuickLabelPicker.svelte   |  85 ++++
 .../[id]/components/ResolveControls.svelte    |  42 --
 .../[id]/components/SuggestionDiff.svelte     |  10 -
 .../[id]/components/inline-annotations.ts     | 119 +++++
 21 files changed, 1745 insertions(+), 363 deletions(-)
 create mode 100644 web/src/routes/share/[id]/components/AnnotationCard.svelte
 delete mode 100644 web/src/routes/share/[id]/components/AnnotationToolbar.svelte
 create mode 100644 web/src/routes/share/[id]/components/AnnotationsPanel.svelte
 delete mode 100644 web/src/routes/share/[id]/components/CommentCard.svelte
 create mode 100644 web/src/routes/share/[id]/components/CommentPopover.svelte
 delete mode 100644 web/src/routes/share/[id]/components/CommentThread.svelte
 delete mode 100644 web/src/routes/share/[id]/components/DriftBadge.svelte
 create mode 100644 web/src/routes/share/[id]/components/FloatingToolbar.svelte
 delete mode 100644 web/src/routes/share/[id]/components/LabelPicker.svelte
 create mode 100644 web/src/routes/share/[id]/components/QuickLabelPicker.svelte
 delete mode 100644 web/src/routes/share/[id]/components/ResolveControls.svelte
 delete mode 100644 web/src/routes/share/[id]/components/SuggestionDiff.svelte
 create mode 100644 web/src/routes/share/[id]/components/inline-annotations.ts

diff --git a/web/bun.lock b/web/bun.lock
index 6f52750..5fc526f 100644
--- a/web/bun.lock
+++ b/web/bun.lock
@@ -17,6 +17,7 @@
         "@sveltejs/adapter-static": "^3.0.10",
         "@sveltejs/kit": "^2.49.1",
         "@sveltejs/vite-plugin-svelte": "^6.2.1",
+        "@tailwindcss/typography": "^0.5.19",
         "@tailwindcss/vite": "^4.1.18",
         "@types/bun": "^1.3.10",
         "@types/dompurify": "^3.2.0",
@@ -292,6 +293,8 @@
 
     "@tailwindcss/oxide-win32-x64-msvc": ["@tailwindcss/oxide-win32-x64-msvc@4.1.18", "", { "os": "win32", "cpu": "x64" }, "sha512-bJWbyYpUlqamC8dpR7pfjA0I7vdF6t5VpUGMWRkXVE3AXgIZjYUYAK7II1GNaxR8J1SSrSrppRar8G++JekE3Q=="],
 
+    "@tailwindcss/typography": ["@tailwindcss/typography@0.5.19", "", { "dependencies": { "postcss-selector-parser": "6.0.10" }, "peerDependencies": { "tailwindcss": ">=3.0.0 || insiders || >=4.0.0-alpha.20 || >=4.0.0-beta.1" } }, "sha512-w31dd8HOx3k9vPtcQh5QHP9GwKcgbMp87j58qi6xgiBnFFtKEAgCWnDw4qUT8aHwkCp8bKvb/KGKWWHedP0AAg=="],
+
     "@tailwindcss/vite": ["@tailwindcss/vite@4.1.18", "", { "dependencies": { "@tailwindcss/node": "4.1.18", "@tailwindcss/oxide": "4.1.18", "tailwindcss": "4.1.18" }, "peerDependencies": { "vite": "^5.2.0 || ^6 || ^7" } }, "sha512-jVA+/UpKL1vRLg6Hkao5jldawNmRo7mQYrZtNHMIVpLfLhDml5nMRUo/8MwoX2vNXvnaXNNMedrMfMugAVX1nA=="],
 
     "@types/bun": ["@types/bun@1.3.10", "", { "dependencies": { "bun-types": "1.3.10" } }, "sha512-0+rlrUrOrTSskibryHbvQkDOWRJwJZqZlxrUs1u4oOoTln8+WIXBPmAuCF35SWB2z4Zl3E84Nl/D0P7803nigQ=="],
@@ -678,7 +681,7 @@
 
     "postcss-scss": ["postcss-scss@4.0.9", "", { "peerDependencies": { "postcss": "^8.4.29" } }, "sha512-AjKOeiwAitL/MXxQW2DliT28EKukvvbEWx3LBmJIRN8KfBGZbRTxNYW0kSqi1COiTZ57nZ9NW06S6ux//N1c9A=="],
 
-    "postcss-selector-parser": ["postcss-selector-parser@7.1.1", "", { "dependencies": { "cssesc": "^3.0.0", "util-deprecate": "^1.0.2" } }, "sha512-orRsuYpJVw8LdAwqqLykBj9ecS5/cRHlI5+nvTo8LcCKmzDmqVORXtOIYEEQuL9D4BxtA1lm5isAqzQZCoQ6Eg=="],
+    "postcss-selector-parser": ["postcss-selector-parser@6.0.10", "", { "dependencies": { "cssesc": "^3.0.0", "util-deprecate": "^1.0.2" } }, "sha512-IQ7TZdoaqbT+LCpShg46jnZVlhWD2w6iQYAcYXfHARZ7X1t/UGhhceQDs5X0cGqKvYlHNOuv7Oa1xmb0oQuA3w=="],
 
     "prelude-ls": ["prelude-ls@1.2.1", "", {}, "sha512-vkcDPrRZo1QZLbn5RLGPpg/WmIQ65qoWWhcGKf/b5eplkkarX0m9z8ppCat4mlOqUsWpyNuYgO3VRyrYHSzX5g=="],
 
@@ -870,6 +873,8 @@
 
     "playwright/fsevents": ["fsevents@2.3.2", "", { "os": "darwin" }, "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA=="],
 
+    "svelte-eslint-parser/postcss-selector-parser": ["postcss-selector-parser@7.1.1", "", { "dependencies": { "cssesc": "^3.0.0", "util-deprecate": "^1.0.2" } }, "sha512-orRsuYpJVw8LdAwqqLykBj9ecS5/cRHlI5+nvTo8LcCKmzDmqVORXtOIYEEQuL9D4BxtA1lm5isAqzQZCoQ6Eg=="],
+
     "@redocly/openapi-core/minimatch/brace-expansion": ["brace-expansion@2.0.2", "", { "dependencies": { "balanced-match": "^1.0.0" } }, "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ=="],
 
     "@typescript-eslint/typescript-estree/minimatch/brace-expansion": ["brace-expansion@2.0.2", "", { "dependencies": { "balanced-match": "^1.0.0" } }, "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ=="],
diff --git a/web/package.json b/web/package.json
index 5fc9659..b9ea30c 100644
--- a/web/package.json
+++ b/web/package.json
@@ -26,6 +26,7 @@
 		"@sveltejs/adapter-static": "^3.0.10",
 		"@sveltejs/kit": "^2.49.1",
 		"@sveltejs/vite-plugin-svelte": "^6.2.1",
+		"@tailwindcss/typography": "^0.5.19",
 		"@tailwindcss/vite": "^4.1.18",
 		"@types/bun": "^1.3.10",
 		"@types/dompurify": "^3.2.0",
diff --git a/web/src/app.css b/web/src/app.css
index 9e8272c..8c317de 100644
--- a/web/src/app.css
+++ b/web/src/app.css
@@ -1,8 +1,11 @@
 /* Import distinctive fonts - must come before @import "tailwindcss" */
-@import url("https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400;500;600;700&family=Instrument+Sans:wght@400;500;600;700&display=swap");
+@import url("https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400;500;600;700&family=Instrument+Sans:wght@400;500;600;700&family=Newsreader:ital,opsz,wght@0,6..72,400;0,6..72,500;0,6..72,600;0,6..72,700;1,6..72,400;1,6..72,500&family=Inter+Tight:wght@400;500;600;700&display=swap");
 
 @import "tailwindcss";
 
+/* Tailwind v4 plugin registration (CSS-first config) */
+@plugin "@tailwindcss/typography";
+
 /* Custom theme - Refined Terminal aesthetic */
 @theme {
 	/* Typography */
@@ -676,3 +679,335 @@
 		animation: spin 1s linear infinite;
 	}
 }
+
+/* ==========================================================================
+   Dark Editorial — scoped tokens for /share/[id]
+   Aesthetic: a manuscript on a copyeditor's desk, at night.
+   Newsreader serif body, Inter Tight UI, ink-color metaphor.
+   These tokens only apply inside `.share-page` so the rest of arc's UI
+   keeps its Refined Terminal aesthetic.
+   ========================================================================== */
+
+.share-page {
+	--ink-paper: oklch(0.16 0.02 260);
+	--ink-paper-raised: oklch(0.2 0.015 260);
+	--ink-paper-edge: oklch(0.24 0.015 260);
+	--ink-text: oklch(0.92 0.02 85);
+	--ink-text-muted: oklch(0.72 0.02 85);
+	--ink-text-faint: oklch(0.55 0.02 260);
+	--ink-rule: oklch(0.3 0.015 260);
+
+	/* Annotation inks */
+	--ink-comment: oklch(0.78 0.16 75); /* warm amber - quill on parchment */
+	--ink-comment-bg: oklch(0.78 0.16 75 / 0.16);
+	--ink-comment-edge: oklch(0.78 0.16 75 / 0.55);
+	--ink-delete: oklch(0.68 0.2 25); /* editorial red */
+	--ink-delete-bg: oklch(0.68 0.2 25 / 0.18);
+	--ink-delete-edge: oklch(0.68 0.2 25 / 0.55);
+	--ink-praise: oklch(0.72 0.14 150); /* sage / proofreader green */
+	--ink-praise-bg: oklch(0.72 0.14 150 / 0.16);
+
+	font-family: "Newsreader", ui-serif, Georgia, serif;
+	font-feature-settings: "kern", "liga", "clig", "calt", "onum";
+	background: var(--ink-paper);
+	color: var(--ink-text);
+	min-height: 100vh;
+}
+
+.share-page .ui-sans {
+	font-family: "Inter Tight", ui-sans-serif, system-ui, sans-serif;
+	font-feature-settings: "kern", "liga", "ss01", "cv11";
+}
+
+.share-page .ui-mono {
+	font-family: "JetBrains Mono", ui-monospace, monospace;
+}
+
+/* Document column — the "page" being read */
+.share-page .doc {
+	font-family: "Newsreader", ui-serif, Georgia, serif;
+	font-size: 1.0625rem; /* 17px */
+	line-height: 1.7;
+	color: var(--ink-text);
+}
+.share-page .doc h1,
+.share-page .doc h2,
+.share-page .doc h3,
+.share-page .doc h4 {
+	font-family: "Newsreader", ui-serif, Georgia, serif;
+	font-weight: 600;
+	letter-spacing: -0.01em;
+	color: var(--ink-text);
+	line-height: 1.25;
+}
+.share-page .doc h1 {
+	font-size: 2rem;
+	margin: 0 0 1.5rem 0;
+	font-weight: 600;
+	font-style: italic;
+	letter-spacing: -0.02em;
+}
+.share-page .doc h2 {
+	font-size: 1.375rem;
+	margin: 2.5rem 0 1rem 0;
+	border-bottom: 1px solid var(--ink-rule);
+	padding-bottom: 0.5rem;
+}
+.share-page .doc h3 {
+	font-size: 1.125rem;
+	margin: 2rem 0 0.75rem 0;
+}
+.share-page .doc h4 {
+	font-size: 1rem;
+	margin: 1.5rem 0 0.5rem 0;
+	color: var(--ink-text-muted);
+	text-transform: uppercase;
+	letter-spacing: 0.06em;
+	font-size: 0.85rem;
+}
+.share-page .doc p {
+	margin: 0 0 1rem 0;
+}
+.share-page .doc ul,
+.share-page .doc ol {
+	margin: 0 0 1rem 0;
+	padding-left: 1.5rem;
+}
+.share-page .doc ul li {
+	list-style: none;
+	position: relative;
+}
+.share-page .doc ul li::before {
+	content: "·";
+	position: absolute;
+	left: -1rem;
+	color: var(--ink-text-faint);
+	font-size: 1.4em;
+	line-height: 1;
+}
+.share-page .doc ol {
+	list-style: decimal;
+}
+.share-page .doc ol li::marker {
+	color: var(--ink-text-faint);
+	font-feature-settings: "onum";
+}
+.share-page .doc li {
+	margin: 0.25rem 0;
+}
+.share-page .doc strong {
+	font-weight: 600;
+	color: var(--ink-text);
+}
+.share-page .doc em {
+	font-style: italic;
+}
+.share-page .doc code {
+	font-family: "JetBrains Mono", ui-monospace, monospace;
+	font-size: 0.875em;
+	background: var(--ink-paper-edge);
+	padding: 0.125rem 0.375rem;
+	border-radius: 3px;
+	color: var(--ink-text);
+}
+.share-page .doc pre {
+	font-family: "JetBrains Mono", ui-monospace, monospace;
+	font-size: 0.8125rem;
+	background: var(--ink-paper-edge);
+	padding: 1rem 1.25rem;
+	border-radius: 6px;
+	border: 1px solid var(--ink-rule);
+	overflow-x: auto;
+	line-height: 1.6;
+	margin: 1rem 0;
+}
+.share-page .doc pre code {
+	background: transparent;
+	padding: 0;
+	border-radius: 0;
+}
+.share-page .doc blockquote {
+	border-left: 2px solid var(--ink-text-faint);
+	padding: 0.25rem 0 0.25rem 1.25rem;
+	margin: 1rem 0;
+	color: var(--ink-text-muted);
+	font-style: italic;
+}
+.share-page .doc hr {
+	border: none;
+	border-top: 1px solid var(--ink-rule);
+	margin: 2rem 0;
+}
+.share-page .doc a {
+	color: var(--ink-comment);
+	text-decoration: underline;
+	text-decoration-color: var(--ink-comment-edge);
+	text-underline-offset: 3px;
+}
+.share-page .doc table {
+	border-collapse: collapse;
+	margin: 1rem 0;
+	font-family: "Inter Tight", ui-sans-serif, sans-serif;
+	font-size: 0.9rem;
+}
+.share-page .doc th,
+.share-page .doc td {
+	border: 1px solid var(--ink-rule);
+	padding: 0.5rem 0.75rem;
+	text-align: left;
+}
+.share-page .doc th {
+	background: var(--ink-paper-raised);
+	font-weight: 600;
+}
+
+/* Inline annotation marks (added by inline-annotations.ts after render) */
+.share-page mark.anno-comment {
+	background: var(--ink-comment-bg);
+	color: var(--ink-text);
+	border-bottom: 1.5px dotted var(--ink-comment);
+	padding: 0 1px;
+	border-radius: 1px;
+	cursor: pointer;
+	transition: background 120ms ease-out;
+}
+.share-page mark.anno-comment:hover,
+.share-page mark.anno-comment.is-active {
+	background: oklch(from var(--ink-comment) l c h / 0.3);
+}
+.share-page mark.anno-delete {
+	background: var(--ink-delete-bg);
+	color: var(--ink-text-muted);
+	text-decoration: line-through;
+	text-decoration-color: var(--ink-delete);
+	text-decoration-thickness: 2px;
+	border-bottom: 1.5px wavy var(--ink-delete-edge);
+	padding: 0 1px;
+	border-radius: 1px;
+	cursor: pointer;
+}
+
+/* Native selection highlight */
+.share-page ::selection {
+	background: oklch(from var(--ink-comment) l c h / 0.35);
+	color: var(--ink-text);
+}
+
+/* Floating toolbar */
+.share-page .floating-toolbar {
+	background: var(--ink-paper-raised);
+	border: 1px solid var(--ink-rule);
+	border-radius: 8px;
+	box-shadow:
+		0 1px 0 oklch(1 0 0 / 0.04) inset,
+		0 8px 24px oklch(0 0 0 / 0.45),
+		0 2px 8px oklch(0 0 0 / 0.35);
+	backdrop-filter: blur(8px);
+}
+.share-page .floating-toolbar button {
+	font-family: "Inter Tight", ui-sans-serif, sans-serif;
+	transition:
+		background 120ms ease-out,
+		color 120ms ease-out;
+}
+
+/* Annotation card type chips */
+.share-page .chip-comment {
+	color: var(--ink-comment);
+	background: var(--ink-comment-bg);
+	border: 1px solid var(--ink-comment-edge);
+}
+.share-page .chip-delete {
+	color: var(--ink-delete);
+	background: var(--ink-delete-bg);
+	border: 1px solid var(--ink-delete-edge);
+}
+.share-page .chip-praise {
+	color: var(--ink-praise);
+	background: var(--ink-praise-bg);
+}
+
+/* Annotation cards */
+.share-page .anno-card {
+	background: var(--ink-paper-raised);
+	border: 1px solid var(--ink-rule);
+	border-radius: 8px;
+	transition:
+		border-color 150ms ease-out,
+		transform 150ms ease-out;
+}
+.share-page .anno-card:hover {
+	border-color: oklch(from var(--ink-rule) calc(l + 0.05) c h);
+}
+.share-page .anno-card.is-active {
+	border-color: var(--ink-comment-edge);
+}
+.share-page .anno-card .quote {
+	font-family: "Newsreader", ui-serif, Georgia, serif;
+	font-style: italic;
+	color: var(--ink-text-muted);
+	background: var(--ink-paper);
+	border-left: 2px solid var(--ink-text-faint);
+	padding: 0.5rem 0.75rem;
+	border-radius: 0 4px 4px 0;
+}
+.share-page .anno-card .body {
+	background: var(--ink-paper);
+	border: 1px solid var(--ink-rule);
+	border-radius: 4px;
+	padding: 0.5rem 0.75rem;
+	color: var(--ink-text);
+}
+
+/* Drop-cap animation entrance */
+@keyframes anno-card-in {
+	from {
+		opacity: 0;
+		transform: translateX(8px);
+	}
+	to {
+		opacity: 1;
+		transform: translateX(0);
+	}
+}
+.share-page .anno-card {
+	animation: anno-card-in 200ms cubic-bezier(0.16, 1, 0.3, 1);
+}
+
+@keyframes toolbar-in {
+	from {
+		opacity: 0;
+		transform: translate(-50%, 12px);
+	}
+	to {
+		opacity: 1;
+		transform: translate(-50%, 0);
+	}
+}
+.share-page .floating-toolbar {
+	animation: toolbar-in 150ms cubic-bezier(0.16, 1, 0.3, 1);
+}
+
+/* Subtle paper grain — barely-there to break up the flat dark surface */
+.share-page .doc-area {
+	background:
+		radial-gradient(circle at 0 0, oklch(1 0 0 / 0.015) 1px, transparent 1px),
+		radial-gradient(circle at 12px 12px, oklch(1 0 0 / 0.012) 1px, transparent 1px),
+		var(--ink-paper);
+	background-size:
+		24px 24px,
+		24px 24px;
+}
+
+/* Reviewer name chip */
+.share-page .name-chip {
+	font-family: "Inter Tight", ui-sans-serif, sans-serif;
+	font-size: 0.75rem;
+	font-weight: 500;
+	letter-spacing: 0.02em;
+	color: var(--ink-text-muted);
+	background: var(--ink-paper-raised);
+	border: 1px solid var(--ink-rule);
+	padding: 0.25rem 0.625rem;
+	border-radius: 9999px;
+}
diff --git a/web/src/lib/paste/types.ts b/web/src/lib/paste/types.ts
index 55ca90c..acfdbbe 100644
--- a/web/src/lib/paste/types.ts
+++ b/web/src/lib/paste/types.ts
@@ -52,12 +52,23 @@ export type Anchor = {
 	heading_slug?: string;
 };
 
+/**
+ * The reviewer's intent. Plannotator parity: COMMENT vs DELETION are the
+ * primary actions. `comment_type` (praise/issue/etc.) is a secondary label.
+ * Body is required for action='comment' but optional for 'delete' — the
+ * strikethrough IS the action.
+ */
+export type AnnotationAction = 'comment' | 'delete';
+
 export type CommentEvent = {
 	kind: 'comment';
 	id: string;
 	author_name: string;
+	/** Primary intent. Defaults to 'comment' for back-compat with v1 events. */
+	action?: AnnotationAction;
 	comment_type: CommentType;
 	severity?: Severity;
+	/** Required for action='comment'; may be empty for action='delete'. */
 	body: string;
 	suggested_text?: string;
 	parent_id?: string;
diff --git a/web/src/routes/+layout.svelte b/web/src/routes/+layout.svelte
index 4988f3d..797c439 100644
--- a/web/src/routes/+layout.svelte
+++ b/web/src/routes/+layout.svelte
@@ -19,9 +19,16 @@
 	const currentProjectId = $derived($page.params.projectId);
 	const currentProject = $derived($projectsStore.find((p) => p.id === currentProjectId));
 
-	// Load projects on mount
+	// /share/[id] is a focused review surface that opts out of arc's app shell.
+	// On a public arc-paste deploy, /api/v1/projects doesn't exist, so loading
+	// projects there would put the entire SPA into an error state and the
+	// share page would never render. Even on local arc-server, hiding arc's
+	// chrome keeps the share URL behaving consistently across hosts.
+	const isShareRoute = $derived($page.url.pathname.startsWith('/share/'));
+
+	// Load projects on mount (skipped on /share routes)
 	$effect(() => {
-		loadProjects();
+		if (!isShareRoute) loadProjects();
 	});
 
 	async function loadProjects() {
@@ -45,33 +52,38 @@
 	<meta name="description" content="AI-assisted issue tracking for modern development workflows" />
 </svelte:head>
 
-<div class="flex min-h-screen bg-surface-900">
-	<Sidebar projects={$projectsStore} currentProject={currentProject} />
+{#if isShareRoute}
+	<!-- Focused share-review mode: no arc chrome, no projects fetch. -->
+	{@render children()}
+{:else}
+	<div class="flex min-h-screen bg-surface-900">
+		<Sidebar projects={$projectsStore} {currentProject} />
 
-	<main class="flex-1 min-w-0 flex flex-col">
-		{#if $loadingStore}
-			<div class="flex-1 flex items-center justify-center">
-				<div class="text-text-muted animate-pulse">Loading...</div>
-			</div>
-		{:else if $errorStore}
-			<div class="flex-1 flex items-center justify-center p-8">
-				<div class="card p-8 text-center max-w-md">
-					<div
-						class="w-12 h-12 bg-status-blocked/20 rounded-xl flex items-center justify-center mx-auto mb-4"
-					>
-						<svg class="w-6 h-6 text-status-blocked" viewBox="0 0 24 24" fill="currentColor">
-							<path
-								d="M12 2C6.48 2 2 6.48 2 12s4.48 10 10 10 10-4.48 10-10S17.52 2 12 2zm1 15h-2v-2h2v2zm0-4h-2V7h2v6z"
-							/>
-						</svg>
+		<main class="flex-1 min-w-0 flex flex-col">
+			{#if $loadingStore}
+				<div class="flex-1 flex items-center justify-center">
+					<div class="text-text-muted animate-pulse">Loading...</div>
+				</div>
+			{:else if $errorStore}
+				<div class="flex-1 flex items-center justify-center p-8">
+					<div class="card p-8 text-center max-w-md">
+						<div
+							class="w-12 h-12 bg-status-blocked/20 rounded-xl flex items-center justify-center mx-auto mb-4"
+						>
+							<svg class="w-6 h-6 text-status-blocked" viewBox="0 0 24 24" fill="currentColor">
+								<path
+									d="M12 2C6.48 2 2 6.48 2 12s4.48 10 10 10 10-4.48 10-10S17.52 2 12 2zm1 15h-2v-2h2v2zm0-4h-2V7h2v6z"
+								/>
+							</svg>
+						</div>
+						<h2 class="text-lg font-semibold text-text-primary mb-2">Connection Error</h2>
+						<p class="text-sm text-text-secondary mb-4">{$errorStore}</p>
+						<button class="btn btn-primary" onclick={loadProjects}>Retry</button>
 					</div>
-					<h2 class="text-lg font-semibold text-text-primary mb-2">Connection Error</h2>
-					<p class="text-sm text-text-secondary mb-4">{$errorStore}</p>
-					<button class="btn btn-primary" onclick={loadProjects}>Retry</button>
 				</div>
-			</div>
-		{:else}
-			{@render children()}
-		{/if}
-	</main>
-</div>
+			{:else}
+				{@render children()}
+			{/if}
+		</main>
+	</div>
+{/if}
diff --git a/web/src/routes/share/[id]/+page.svelte b/web/src/routes/share/[id]/+page.svelte
index e452848..f90987b 100644
--- a/web/src/routes/share/[id]/+page.svelte
+++ b/web/src/routes/share/[id]/+page.svelte
@@ -9,134 +9,397 @@
 		EventPlaintext,
 		CommentEvent,
 		CommentType,
-		Severity,
+		ResolutionEvent,
+		ResolutionStatus,
 		Anchor
 	} from '$lib/paste/types';
 	import PlanRenderer from './components/PlanRenderer.svelte';
-	import AnnotationToolbar from './components/AnnotationToolbar.svelte';
-	import CommentCard from './components/CommentCard.svelte';
+	import FloatingToolbar, { type ToolbarAction } from './components/FloatingToolbar.svelte';
+	import CommentPopover, { type PopoverMode } from './components/CommentPopover.svelte';
+	import QuickLabelPicker from './components/QuickLabelPicker.svelte';
+	import AnnotationsPanel from './components/AnnotationsPanel.svelte';
 	import NamePromptModal from './components/NamePromptModal.svelte';
+	import type { InlineMark } from './components/inline-annotations.ts';
 
-	const { data } = $props<{ data: { id: string } }>();
+	const { data }: { data: { id: string } } = $props();
+
+	// --- Decrypted state ---
 	let plan = $state<PlanPlaintext | null>(null);
 	let comments = $state(new Map<string, CommentState>());
 	let key = $state<CryptoKey | null>(null);
-	let reviewerName = $state(getReviewerName());
+	let loadError = $state<string | null>(null);
+
+	// --- Reviewer identity ---
+	let reviewerName = $state<string | null>(null);
 	let showNamePrompt = $state(false);
-	let pendingComment = $state<{
-		body: string;
-		comment_type: CommentType;
-		severity?: Severity;
-		suggested_text?: string;
-		anchor: Anchor;
-	} | null>(null);
-	let selection = $state<{
+	let pendingAfterName: (() => void) | null = null;
+
+	// --- UI state for selection-driven actions ---
+	type SelectionInfo = {
 		lineStart: number;
 		lineEnd: number;
-		charStart?: number;
-		charEnd?: number;
 		quotedText: string;
 		headingSlug?: string;
 		contextBefore?: string;
 		contextAfter?: string;
-	} | undefined>(undefined);
-
-	const anchor = $derived(
-		selection
-			? ({
-					line_start: selection.lineStart,
-					line_end: selection.lineEnd,
-					char_start: selection.charStart,
-					char_end: selection.charEnd,
-					quoted_text: selection.quotedText,
-					heading_slug: selection.headingSlug,
-					context_before: selection.contextBefore,
-					context_after: selection.contextAfter
-				} satisfies Anchor)
-			: undefined
+		rect: DOMRect;
+	};
+	let activeSelection = $state<SelectionInfo | null>(null);
+	let popoverMode = $state<PopoverMode | null>(null);
+	let showQuickLabel = $state(false);
+	let activeMarkId = $state<string | undefined>(undefined);
+
+	let client: PasteClient | undefined;
+
+	const isAuthor = $derived(
+		reviewerName !== null &&
+			plan !== null &&
+			!!plan.author_name &&
+			plan.author_name === reviewerName
 	);
 
-	const client = new PasteClient(window.location.origin);
+	const orderedStates = $derived.by(() => {
+		return [...comments.values()].sort((a, b) =>
+			b.event.created_at.localeCompare(a.event.created_at)
+		);
+	});
+
+	const marks = $derived.by((): InlineMark[] => {
+		const out: InlineMark[] = [];
+		for (const state of comments.values()) {
+			if (state.status === 'resolved' || state.status === 'rejected') continue;
+			out.push({
+				id: state.event.id,
+				kind: state.event.action === 'delete' ? 'delete' : 'comment',
+				lineStart: state.event.anchor.line_start,
+				lineEnd: state.event.anchor.line_end,
+				quotedText: state.event.anchor.quoted_text
+			});
+		}
+		return out;
+	});
 
 	onMount(async () => {
-		const fragment = window.location.hash.replace(/^#/, '');
-		const params = new URLSearchParams(fragment);
-		const k = params.get('k');
-		if (!k) {
-			console.error('missing #k=<key> in URL');
-			return;
-		}
-		key = await importKey(k);
-
-		const resp = await client.get(data.id);
-		plan = await decryptJSON<PlanPlaintext>(b64ToBytes(resp.plan_blob), b64ToBytes(resp.plan_iv), key);
-
-		const events: EventPlaintext[] = [];
-		for (const ev of resp.events) {
-			const { blob, iv } = eventBytes(ev);
-			try {
-				events.push(await decryptJSON<EventPlaintext>(blob, iv, key));
-			} catch {
-				// skip undecryptable events (corrupt or tampered)
+		reviewerName = getReviewerName();
+		client = new PasteClient(window.location.origin);
+
+		try {
+			const fragment = window.location.hash.replace(/^#/, '');
+			const params = new URLSearchParams(fragment);
+			const k = params.get('k');
+			if (!k) {
+				loadError = 'Missing #k=<key> in URL — share link is incomplete.';
+				return;
+			}
+			key = await importKey(k);
+
+			const resp = await client.get(data.id);
+			plan = await decryptJSON<PlanPlaintext>(
+				b64ToBytes(resp.plan_blob),
+				b64ToBytes(resp.plan_iv),
+				key
+			);
+
+			const events: EventPlaintext[] = [];
+			for (const ev of resp.events) {
+				const { blob, iv } = eventBytes(ev);
+				try {
+					events.push(await decryptJSON<EventPlaintext>(blob, iv, key));
+				} catch {
+					// skip undecryptable events
+				}
 			}
+			comments = replayEvents(plan?.author_name, events);
+		} catch (err) {
+			loadError = (err as Error)?.message ?? 'Failed to load share';
 		}
-		comments = replayEvents(plan?.author_name, events);
 	});
 
-	async function handleSubmitComment(payload: typeof pendingComment) {
-		if (!payload || !key || !plan) return;
-		if (!reviewerName) {
-			pendingComment = payload;
-			showNamePrompt = true;
+	function ensureName(after: () => void) {
+		if (reviewerName) {
+			after();
 			return;
 		}
+		pendingAfterName = after;
+		showNamePrompt = true;
+	}
+
+	function handleNameSaved(name: string) {
+		reviewerName = name;
+		showNamePrompt = false;
+		const cb = pendingAfterName;
+		pendingAfterName = null;
+		cb?.();
+	}
+
+	function clearSelection() {
+		activeSelection = null;
+		popoverMode = null;
+		showQuickLabel = false;
+		const sel = window.getSelection();
+		sel?.removeAllRanges();
+	}
+
+	async function postEvent(event: EventPlaintext) {
+		if (!key || !client) return;
+		const { blob, iv } = await encryptJSON(event, key);
+		await client.appendEvent(data.id, blob, iv);
+	}
+
+	function buildAnchor(sel: SelectionInfo): Anchor {
+		return {
+			line_start: sel.lineStart,
+			line_end: sel.lineEnd,
+			quoted_text: sel.quotedText,
+			heading_slug: sel.headingSlug,
+			context_before: sel.contextBefore,
+			context_after: sel.contextAfter
+		};
+	}
+
+	async function createComment(opts: {
+		body: string;
+		comment_type?: CommentType;
+		action?: 'comment' | 'delete';
+		suggested_text?: string;
+		anchor: Anchor;
+	}) {
+		if (!reviewerName) return;
 		const event: CommentEvent = {
 			kind: 'comment',
 			id: `c-${crypto.randomUUID()}`,
 			author_name: reviewerName,
-			comment_type: payload.comment_type,
-			severity: payload.severity,
-			body: payload.body,
-			suggested_text: payload.suggested_text,
-			anchor: payload.anchor,
+			action: opts.action ?? 'comment',
+			comment_type: opts.comment_type ?? 'comment',
+			body: opts.body,
+			suggested_text: opts.suggested_text,
+			anchor: opts.anchor,
 			created_at: new Date().toISOString()
 		};
-		const { blob, iv } = await encryptJSON(event, key);
-		await client.appendEvent(data.id, blob, iv);
+		await postEvent(event);
 		const next = new Map(comments);
 		next.set(event.id, { event, status: 'open' });
 		comments = next;
-		pendingComment = null;
+	}
+
+	async function handleToolbarAction(action: ToolbarAction) {
+		if (!activeSelection) return;
+		const sel = activeSelection;
+
+		switch (action) {
+			case 'praise':
+				ensureName(async () => {
+					await createComment({
+						body: 'Looks good',
+						comment_type: 'praise',
+						action: 'comment',
+						anchor: buildAnchor(sel)
+					});
+					clearSelection();
+				});
+				return;
+			case 'comment':
+				ensureName(() => {
+					popoverMode = 'comment';
+				});
+				return;
+			case 'delete':
+				ensureName(async () => {
+					await createComment({
+						body: '',
+						comment_type: 'comment',
+						action: 'delete',
+						anchor: buildAnchor(sel)
+					});
+					clearSelection();
+				});
+				return;
+			case 'suggest':
+				ensureName(() => {
+					popoverMode = 'suggest';
+				});
+				return;
+			case 'quick-label':
+				ensureName(() => {
+					showQuickLabel = true;
+				});
+				return;
+		}
+	}
+
+	async function handlePopoverSave(body: string, suggestedText?: string) {
+		if (!activeSelection) return;
+		await createComment({
+			body,
+			comment_type: suggestedText ? 'suggestion' : 'comment',
+			action: 'comment',
+			suggested_text: suggestedText,
+			anchor: buildAnchor(activeSelection)
+		});
+		clearSelection();
+	}
+
+	async function handleQuickLabelPick(label: CommentType, presetBody: string) {
+		if (!activeSelection) return;
+		const sel = activeSelection;
+		showQuickLabel = false;
+		if (presetBody) {
+			await createComment({
+				body: presetBody,
+				comment_type: label,
+				action: 'comment',
+				anchor: buildAnchor(sel)
+			});
+			clearSelection();
+		} else {
+			// No preset — open the comment popover so the user can write a body
+			popoverMode = 'comment';
+		}
+	}
+
+	async function handleResolve(commentId: string, status: ResolutionStatus, reply?: string) {
+		if (!reviewerName) return;
+		const event: ResolutionEvent = {
+			kind: 'resolution',
+			id: `r-${crypto.randomUUID()}`,
+			comment_id: commentId,
+			status,
+			reply,
+			author_name: reviewerName,
+			created_at: new Date().toISOString()
+		};
+		await postEvent(event);
+		const next = new Map(comments);
+		const target = next.get(commentId);
+		if (target && plan?.author_name === reviewerName) {
+			next.set(commentId, { ...target, status, reply, replyAt: event.created_at });
+		}
+		comments = next;
+	}
+
+	function handleSelection(sel: SelectionInfo | null) {
+		if (!sel) {
+			if (!popoverMode && !showQuickLabel) activeSelection = null;
+			return;
+		}
+		activeSelection = sel;
+		popoverMode = null;
+		showQuickLabel = false;
+	}
+
+	function handleMarkClick(id: string) {
+		activeMarkId = activeMarkId === id ? undefined : id;
+		document
+			.querySelector(`[data-anno-card-id="${id}"]`)
+			?.scrollIntoView({ behavior: 'smooth', block: 'center' });
+	}
+
+	function handleCardClick(id: string) {
+		activeMarkId = activeMarkId === id ? undefined : id;
 	}
 </script>
 
-{#if !plan}
-	<p class="p-4 text-gray-500">Loading…</p>
-{:else}
-	<div class="grid grid-cols-[1fr_320px] gap-4 p-4">
-		<PlanRenderer
-			markdown={plan.markdown}
-			onSelection={(a) => {
-				selection = a;
-			}}
+<svelte:head>
+	<title>{plan?.title ?? 'Plan review'} · arc</title>
+</svelte:head>
+
+<div class="share-page grid h-screen grid-cols-[1fr_360px]">
+	<!-- Document area: dark paper with subtle grain background -->
+	<main class="doc-area overflow-y-auto">
+		<div class="mx-auto flex max-w-[760px] flex-col px-10 py-12">
+			<header
+				class="mb-10 flex items-baseline justify-between border-b border-[var(--ink-rule)] pb-6"
+			>
+				<div>
+					<div
+						class="ui-mono mb-1 text-[10px] uppercase tracking-[0.16em] text-[var(--ink-text-faint)]"
+					>
+						Plan · {data.id}
+					</div>
+					<h1 class="ui-sans text-xl font-semibold text-[var(--ink-text)]">
+						{plan?.title ?? 'Untitled plan'}
+					</h1>
+				</div>
+				{#if reviewerName}
+					<span class="name-chip">
+						{reviewerName}{isAuthor ? ' · author' : ''}
+					</span>
+				{:else}
+					<button
+						type="button"
+						class="name-chip cursor-pointer hover:border-[var(--ink-comment-edge)]"
+						onclick={() => (showNamePrompt = true)}
+					>
+						Sign in
+					</button>
+				{/if}
+			</header>
+
+			{#if loadError}
+				<div
+					class="rounded-md border border-[var(--ink-delete-edge)] bg-[var(--ink-delete-bg)] p-4 text-sm text-[var(--ink-delete)]"
+				>
+					<strong class="font-semibold">Couldn't load plan.</strong>
+					<div class="mt-1 text-[var(--ink-text-muted)]">{loadError}</div>
+				</div>
+			{:else if !plan}
+				<div class="text-sm italic text-[var(--ink-text-faint)]">Decrypting plan…</div>
+			{:else}
+				<PlanRenderer
+					markdown={plan.markdown}
+					{marks}
+					{activeMarkId}
+					onSelection={handleSelection}
+					onMarkClick={handleMarkClick}
+				/>
+			{/if}
+		</div>
+	</main>
+
+	<!-- Right rail: annotations panel -->
+	<div class="border-l border-[var(--ink-rule)] bg-[var(--ink-paper-raised)]">
+		<AnnotationsPanel
+			states={orderedStates}
+			{isAuthor}
+			{reviewerName}
+			activeId={activeMarkId}
+			onCardClick={handleCardClick}
+			onResolve={handleResolve}
 		/>
-		<aside>
-			<AnnotationToolbar onSubmit={handleSubmitComment} anchor={anchor} />
-			<ul class="space-y-2 mt-4">
-				{#each [...comments.values()] as state (state.event.id)}
-					<CommentCard {state} isAuthor={reviewerName === plan.author_name} />
-				{/each}
-			</ul>
-		</aside>
 	</div>
-{/if}
-
-{#if showNamePrompt}
-	<NamePromptModal
-		onSave={(name) => {
-			reviewerName = name;
-			showNamePrompt = false;
-			if (pendingComment) handleSubmitComment(pendingComment);
-		}}
-	/>
-{/if}
+
+	<!--
+		Floating overlays must live inside `.share-page` so they inherit the
+		`--ink-*` design tokens defined in app.css. Fixed positioning takes them
+		out of grid flow, so they don't claim a grid cell.
+	-->
+	{#if activeSelection && !popoverMode && !showQuickLabel}
+		<FloatingToolbar
+			anchorRect={activeSelection.rect}
+			onAction={handleToolbarAction}
+			onDismiss={clearSelection}
+		/>
+	{/if}
+
+	{#if activeSelection && popoverMode}
+		<CommentPopover
+			anchorRect={activeSelection.rect}
+			mode={popoverMode}
+			quotedText={activeSelection.quotedText}
+			onSave={handlePopoverSave}
+			onCancel={clearSelection}
+		/>
+	{/if}
+
+	{#if activeSelection && showQuickLabel}
+		<QuickLabelPicker
+			anchorRect={activeSelection.rect}
+			onPick={handleQuickLabelPick}
+			onDismiss={() => (showQuickLabel = false)}
+		/>
+	{/if}
+
+	{#if showNamePrompt}
+		<NamePromptModal onSave={handleNameSaved} />
+	{/if}
+</div>
diff --git a/web/src/routes/share/[id]/components/AnnotationCard.svelte b/web/src/routes/share/[id]/components/AnnotationCard.svelte
new file mode 100644
index 0000000..7aac5f8
--- /dev/null
+++ b/web/src/routes/share/[id]/components/AnnotationCard.svelte
@@ -0,0 +1,244 @@
+<script lang="ts">
+	import type { CommentState } from '$lib/paste/events';
+	import type { ResolutionStatus } from '$lib/paste/types';
+
+	const {
+		entry,
+		isAuthor,
+		reviewerName,
+		isActive = false,
+		onClick,
+		onResolve
+	}: {
+		entry: CommentState;
+		isAuthor: boolean;
+		reviewerName: string | null;
+		isActive?: boolean;
+		onClick: () => void;
+		onResolve: (status: ResolutionStatus, reply?: string) => Promise<void>;
+	} = $props();
+
+	const e = $derived(entry.event);
+	const isMine = $derived(reviewerName !== null && e.author_name === reviewerName);
+	const isDelete = $derived(e.action === 'delete');
+	const isSuggestion = $derived(!!e.suggested_text);
+
+	const chipClass = $derived(
+		isDelete ? 'chip-delete' : e.comment_type === 'praise' ? 'chip-praise' : 'chip-comment'
+	);
+
+	const chipLabel = $derived(
+		isDelete
+			? 'Delete'
+			: isSuggestion
+				? 'Suggest'
+				: e.comment_type === 'praise'
+					? 'Praise'
+					: e.comment_type === 'issue'
+						? 'Issue'
+						: e.comment_type === 'question'
+							? 'Question'
+							: e.comment_type === 'nit'
+								? 'Nit'
+								: 'Comment'
+	);
+
+	const chipIcon = $derived(
+		isDelete
+			? '✕'
+			: isSuggestion
+				? '💡'
+				: e.comment_type === 'praise'
+					? '👍'
+					: e.comment_type === 'question'
+						? '❓'
+						: e.comment_type === 'nit'
+							? '💅'
+							: '💬'
+	);
+
+	function timeLabel(iso: string): string {
+		const d = new Date(iso);
+		const seconds = Math.max(0, Math.floor((Date.now() - d.getTime()) / 1000));
+		if (seconds < 60) return 'now';
+		if (seconds < 3600) return `${Math.floor(seconds / 60)}m`;
+		if (seconds < 86400) return `${Math.floor(seconds / 3600)}h`;
+		return `${Math.floor(seconds / 86400)}d`;
+	}
+
+	let showRejectReply = $state(false);
+	let rejectReply = $state('');
+</script>
+
+<div
+	class="anno-card ui-sans block w-full cursor-pointer px-3.5 py-3 text-left {isActive
+		? 'is-active'
+		: ''}"
+	role="button"
+	tabindex="0"
+	data-anno-card-id={entry.event.id}
+	onclick={onClick}
+	onkeydown={(e) => {
+		if (e.key === 'Enter' || e.key === ' ') {
+			e.preventDefault();
+			onClick();
+		}
+	}}
+>
+	<header class="mb-2 flex items-center justify-between gap-2 text-[11px]">
+		<div class="flex items-center gap-1.5 text-[var(--ink-text-muted)]">
+			<svg
+				class="h-3 w-3"
+				viewBox="0 0 24 24"
+				fill="none"
+				stroke="currentColor"
+				stroke-width="2"
+				aria-hidden="true"
+			>
+				<circle cx="12" cy="8" r="3.5" />
+				<path stroke-linecap="round" d="M5 20c0-3.5 3-6 7-6s7 2.5 7 6" />
+			</svg>
+			<span class="font-medium">{e.author_name}</span>
+			{#if isMine}
+				<span class="text-[var(--ink-text-faint)]">(me)</span>
+			{/if}
+		</div>
+		<span class="ui-mono text-[10px] text-[var(--ink-text-faint)]">
+			{timeLabel(e.created_at)}
+		</span>
+	</header>
+
+	<div class="mb-2 flex items-center gap-2">
+		<span
+			class="{chipClass} inline-flex items-center gap-1 rounded-full px-2 py-0.5 text-[10px] font-semibold uppercase tracking-[0.08em]"
+		>
+			<span aria-hidden="true">{chipIcon}</span>
+			{chipLabel}
+		</span>
+		{#if entry.status !== 'open'}
+			<span class="text-[10px] uppercase tracking-[0.08em] text-[var(--ink-text-faint)]">
+				· {entry.status}
+			</span>
+		{/if}
+	</div>
+
+	<!-- Quoted source text -->
+	<div class="quote mb-2 text-[13px]">
+		"{e.anchor.quoted_text}"
+	</div>
+
+	<!-- Body / suggestion -->
+	{#if e.suggested_text}
+		<div class="mb-2 space-y-1">
+			<div class="text-[10px] uppercase tracking-[0.08em] text-[var(--ink-text-faint)]">
+				Replacement
+			</div>
+			<div class="body text-[13px] text-[var(--ink-praise)]">
+				{e.suggested_text}
+			</div>
+		</div>
+		{#if e.body}
+			<div class="body text-[13px]">{e.body}</div>
+		{/if}
+	{:else if e.body}
+		<div class="body text-[13px]">{e.body}</div>
+	{/if}
+
+	{#if entry.reply}
+		<div
+			class="mt-2 border-l-2 border-[var(--ink-rule)] pl-2 text-[12px] italic text-[var(--ink-text-muted)]"
+		>
+			↪ {entry.reply}
+		</div>
+	{/if}
+
+	{#if isAuthor && !showRejectReply}
+		<div class="mt-3 flex flex-wrap gap-1.5 border-t border-[var(--ink-rule)] pt-2">
+			{#if entry.status !== 'accepted'}
+				<button
+					type="button"
+					class="rounded-md px-2 py-1 text-[11px] text-[var(--ink-praise)] hover:bg-[var(--ink-praise-bg)]"
+					onclick={(e) => {
+						e.stopPropagation();
+						onResolve('accepted');
+					}}
+				>
+					✓ Accept
+				</button>
+			{/if}
+			{#if entry.status !== 'resolved'}
+				<button
+					type="button"
+					class="rounded-md px-2 py-1 text-[11px] text-[var(--ink-text-muted)] hover:bg-[var(--ink-paper)]"
+					onclick={(e) => {
+						e.stopPropagation();
+						onResolve('resolved');
+					}}
+				>
+					— Resolve
+				</button>
+			{/if}
+			{#if entry.status !== 'rejected'}
+				<button
+					type="button"
+					class="rounded-md px-2 py-1 text-[11px] text-[var(--ink-delete)] hover:bg-[var(--ink-delete-bg)]"
+					onclick={(e) => {
+						e.stopPropagation();
+						showRejectReply = true;
+					}}
+				>
+					✕ Reject
+				</button>
+			{/if}
+			{#if entry.status !== 'open' && entry.status !== 'reopened'}
+				<button
+					type="button"
+					class="rounded-md px-2 py-1 text-[11px] text-[var(--ink-text-muted)] hover:bg-[var(--ink-paper)]"
+					onclick={(e) => {
+						e.stopPropagation();
+						onResolve('reopened');
+					}}
+				>
+					↻ Reopen
+				</button>
+			{/if}
+		</div>
+	{/if}
+
+	{#if showRejectReply}
+		<div class="mt-3 space-y-2 border-t border-[var(--ink-rule)] pt-2">
+			<textarea
+				bind:value={rejectReply}
+				rows="2"
+				placeholder="Reason (optional)…"
+				class="w-full rounded-md border border-[var(--ink-rule)] bg-[var(--ink-paper)] p-2 text-xs text-[var(--ink-text)] focus:border-[var(--ink-delete-edge)] focus:outline-none"
+				onclick={(e) => e.stopPropagation()}
+			></textarea>
+			<div class="flex justify-end gap-2">
+				<button
+					type="button"
+					class="rounded-md px-2 py-1 text-[11px] text-[var(--ink-text-muted)]"
+					onclick={(e) => {
+						e.stopPropagation();
+						showRejectReply = false;
+						rejectReply = '';
+					}}
+				>
+					Cancel
+				</button>
+				<button
+					type="button"
+					class="rounded-md border border-[var(--ink-delete-edge)] bg-[var(--ink-delete-bg)] px-2 py-1 text-[11px] font-medium text-[var(--ink-delete)]"
+					onclick={async (e) => {
+						e.stopPropagation();
+						await onResolve('rejected', rejectReply);
+						showRejectReply = false;
+						rejectReply = '';
+					}}
+				>
+					Confirm reject
+				</button>
+			</div>
+		</div>
+	{/if}
+</div>
diff --git a/web/src/routes/share/[id]/components/AnnotationToolbar.svelte b/web/src/routes/share/[id]/components/AnnotationToolbar.svelte
deleted file mode 100644
index dd593e7..0000000
--- a/web/src/routes/share/[id]/components/AnnotationToolbar.svelte
+++ /dev/null
@@ -1,63 +0,0 @@
-<script lang="ts">
-	import LabelPicker from './LabelPicker.svelte';
-	import type { CommentType, Severity, Anchor } from '$lib/paste/types';
-
-	const { onSubmit, anchor } = $props<{
-		onSubmit: (payload: {
-			body: string;
-			comment_type: CommentType;
-			severity?: Severity;
-			suggested_text?: string;
-			anchor: Anchor;
-		}) => Promise<void>;
-		anchor?: Anchor;
-	}>();
-
-	let body = $state('');
-	let commentType = $state<CommentType>('comment');
-	let severity = $state<Severity | undefined>(undefined);
-	let suggested = $state('');
-	let showSuggested = $state(false);
-
-	async function submit() {
-		if (!anchor || !body.trim()) return;
-		await onSubmit({
-			body: body.trim(),
-			comment_type: commentType,
-			severity: commentType === 'issue' ? severity : undefined,
-			suggested_text: showSuggested ? suggested : undefined,
-			anchor
-		});
-		body = '';
-		suggested = '';
-		showSuggested = false;
-	}
-</script>
-
-<div class="space-y-2 p-2 border rounded">
-	<textarea bind:value={body} placeholder="Comment…" class="w-full" rows="3"></textarea>
-	<LabelPicker bind:value={commentType} />
-	{#if commentType === 'issue'}
-		<label>
-			<input
-				type="checkbox"
-				checked={severity === 'important'}
-				onchange={(e) => (severity = e.currentTarget.checked ? 'important' : 'nit')}
-			/>
-			Important
-		</label>
-	{/if}
-	<label>
-		<input type="checkbox" bind:checked={showSuggested} />
-		Suggest replacement text
-	</label>
-	{#if showSuggested}
-		<textarea
-			bind:value={suggested}
-			placeholder="Proposed replacement…"
-			class="w-full"
-			rows="3"
-		></textarea>
-	{/if}
-	<button onclick={submit} disabled={!body.trim() || !anchor}>Post</button>
-</div>
diff --git a/web/src/routes/share/[id]/components/AnnotationsPanel.svelte b/web/src/routes/share/[id]/components/AnnotationsPanel.svelte
new file mode 100644
index 0000000..1c450d5
--- /dev/null
+++ b/web/src/routes/share/[id]/components/AnnotationsPanel.svelte
@@ -0,0 +1,78 @@
+<script lang="ts">
+	import type { CommentState } from '$lib/paste/events';
+	import AnnotationCard from './AnnotationCard.svelte';
+
+	const {
+		states,
+		isAuthor,
+		reviewerName,
+		activeId,
+		onCardClick,
+		onResolve
+	}: {
+		states: CommentState[];
+		isAuthor: boolean;
+		reviewerName: string | null;
+		activeId?: string;
+		onCardClick: (id: string) => void;
+		onResolve: (
+			commentId: string,
+			status: 'accepted' | 'rejected' | 'resolved' | 'reopened',
+			reply?: string
+		) => Promise<void>;
+	} = $props();
+
+	const visibleStates = $derived(states); // could filter by status later
+</script>
+
+<aside class="ui-sans flex h-full flex-col" aria-label="Annotations">
+	<header class="flex items-center justify-between border-b border-[var(--ink-rule)] px-5 py-4">
+		<h2 class="text-[11px] font-semibold uppercase tracking-[0.12em] text-[var(--ink-text-muted)]">
+			Annotations
+		</h2>
+		<span
+			class="ui-mono text-[11px] text-[var(--ink-text-faint)]"
+			aria-label="{visibleStates.length} annotations"
+		>
+			{visibleStates.length}
+		</span>
+	</header>
+
+	<div class="flex-1 overflow-y-auto px-5 py-4">
+		{#if visibleStates.length === 0}
+			<div class="flex flex-col items-center justify-center py-16 text-center">
+				<svg
+					class="mb-3 h-8 w-8 text-[var(--ink-text-faint)]"
+					viewBox="0 0 24 24"
+					fill="none"
+					stroke="currentColor"
+					stroke-width="1.5"
+					aria-hidden="true"
+				>
+					<path
+						stroke-linecap="round"
+						stroke-linejoin="round"
+						d="M3 6.5L7.5 11l-2 7 7-3 7 3-2-7L21 6.5l-7-1L12 0l-2 5.5-7 1z"
+					/>
+				</svg>
+				<p class="text-xs italic text-[var(--ink-text-faint)]">No annotations yet</p>
+				<p class="mt-1 text-[11px] text-[var(--ink-text-faint)]">Highlight text to begin</p>
+			</div>
+		{:else}
+			<ul class="space-y-3">
+				{#each visibleStates as entry (entry.event.id)}
+					<li>
+						<AnnotationCard
+							{entry}
+							{isAuthor}
+							{reviewerName}
+							isActive={activeId === entry.event.id}
+							onClick={() => onCardClick(entry.event.id)}
+							onResolve={(status, reply) => onResolve(entry.event.id, status, reply)}
+						/>
+					</li>
+				{/each}
+			</ul>
+		{/if}
+	</div>
+</aside>
diff --git a/web/src/routes/share/[id]/components/CommentCard.svelte b/web/src/routes/share/[id]/components/CommentCard.svelte
deleted file mode 100644
index 0c504a6..0000000
--- a/web/src/routes/share/[id]/components/CommentCard.svelte
+++ /dev/null
@@ -1,34 +0,0 @@
-<script lang="ts">
-	import type { CommentState } from '$lib/paste/events';
-	import ResolveControls from './ResolveControls.svelte';
-	import SuggestionDiff from './SuggestionDiff.svelte';
-
-	const { state, isAuthor } = $props<{ state: CommentState; isAuthor: boolean }>();
-	const e = $derived(state.event);
-</script>
-
-<li class="p-3 border rounded space-y-2">
-	<header class="flex items-center justify-between text-xs">
-		<span class="font-semibold">{e.author_name}</span>
-		<span class="px-2 py-0.5 rounded bg-gray-100"
-			>{e.comment_type}{e.severity ? ` · ${e.severity}` : ''}</span
-		>
-	</header>
-	<p>{e.body}</p>
-	{#if e.suggested_text}
-		<SuggestionDiff original="" suggested={e.suggested_text} />
-	{/if}
-	<!-- DriftBadge expects a status from the resolved anchor; passed in by caller in a future pass -->
-	<footer class="flex items-center justify-between text-xs text-gray-500">
-		<span>{state.status}</span>
-		{#if isAuthor}
-			<ResolveControls
-				commentId={e.id}
-				currentStatus={state.status}
-				onResolve={async (_status, _reply) => {
-					/* parent wires up */
-				}}
-			/>
-		{/if}
-	</footer>
-</li>
diff --git a/web/src/routes/share/[id]/components/CommentPopover.svelte b/web/src/routes/share/[id]/components/CommentPopover.svelte
new file mode 100644
index 0000000..44b7071
--- /dev/null
+++ b/web/src/routes/share/[id]/components/CommentPopover.svelte
@@ -0,0 +1,147 @@
+<script lang="ts">
+	import { onMount, onDestroy, tick } from 'svelte';
+
+	export type PopoverMode = 'comment' | 'suggest';
+
+	const {
+		anchorRect,
+		mode,
+		quotedText,
+		initialBody = '',
+		onSave,
+		onCancel
+	}: {
+		anchorRect: DOMRect;
+		mode: PopoverMode;
+		quotedText: string;
+		initialBody?: string;
+		onSave: (body: string, suggestedText?: string) => void;
+		onCancel: () => void;
+	} = $props();
+
+	let popover: HTMLDivElement | undefined = $state();
+	let bodyInput: HTMLTextAreaElement | undefined = $state();
+	let body = $state('');
+	let suggested = $state('');
+	$effect(() => {
+		// Initialize body once from the prop's initial value
+		if (initialBody && body === '') body = initialBody;
+	});
+
+	function computePosition(rect: DOMRect, m: PopoverMode): { top: number; left: number } {
+		// Same anchoring as toolbar: above the selection.
+		const POPOVER_HEIGHT = m === 'suggest' ? 200 : 120;
+		const GAP = 12;
+		const top = rect.top + window.scrollY - POPOVER_HEIGHT - GAP;
+		const left = rect.left + window.scrollX + rect.width / 2;
+		return { top: Math.max(8 + window.scrollY, top), left };
+	}
+
+	const position = $derived(computePosition(anchorRect, mode));
+	const isSuggest = $derived(mode === 'suggest');
+
+	function handleKeydown(e: KeyboardEvent) {
+		if (e.key === 'Escape') {
+			e.preventDefault();
+			onCancel();
+		} else if (e.key === 'Enter' && (e.metaKey || e.ctrlKey)) {
+			e.preventDefault();
+			save();
+		}
+	}
+
+	function handleDocumentClick(e: MouseEvent) {
+		if (!popover) return;
+		if (popover.contains(e.target as Node)) return;
+		onCancel();
+	}
+
+	function save() {
+		const trimmedBody = body.trim();
+		if (mode === 'comment' && !trimmedBody) return;
+		if (mode === 'suggest' && !suggested.trim()) return;
+		onSave(trimmedBody, mode === 'suggest' ? suggested : undefined);
+	}
+
+	onMount(async () => {
+		document.addEventListener('keydown', handleKeydown);
+		document.addEventListener('mousedown', handleDocumentClick);
+		await tick();
+		bodyInput?.focus();
+	});
+
+	onDestroy(() => {
+		document.removeEventListener('keydown', handleKeydown);
+		document.removeEventListener('mousedown', handleDocumentClick);
+	});
+</script>
+
+<div
+	bind:this={popover}
+	class="floating-toolbar fixed z-[100] w-[360px] p-3 ui-sans"
+	style="top: {position.top}px; left: {position.left}px; transform: translateX(-50%);"
+	role="dialog"
+	aria-label={isSuggest ? 'Propose replacement text' : 'Add a comment'}
+>
+	<div class="mb-2 text-[10px] uppercase tracking-[0.08em] text-[var(--ink-text-faint)]">
+		{isSuggest ? 'Suggest replacement' : 'Comment'}
+	</div>
+
+	<div class="quote mb-2 text-sm">
+		"{quotedText.length > 80 ? quotedText.slice(0, 80) + '…' : quotedText}"
+	</div>
+
+	{#if isSuggest}
+		<label class="mb-2 block text-[10px] uppercase tracking-[0.08em] text-[var(--ink-text-faint)]">
+			<span class="mb-1 block">Replacement</span>
+			<textarea
+				bind:value={suggested}
+				rows="3"
+				placeholder="Replacement text…"
+				class="w-full rounded-md border border-[var(--ink-rule)] bg-[var(--ink-paper)] p-2 text-sm normal-case tracking-normal text-[var(--ink-text)] focus:border-[var(--ink-comment-edge)] focus:outline-none"
+			></textarea>
+		</label>
+	{/if}
+
+	<label class="block text-[10px] uppercase tracking-[0.08em] text-[var(--ink-text-faint)]">
+		{#if isSuggest}
+			<span class="mb-1 block">Reason (optional)</span>
+		{/if}
+		<textarea
+			bind:this={bodyInput}
+			bind:value={body}
+			rows={isSuggest ? 2 : 3}
+			placeholder={isSuggest ? 'Why this change?' : 'Add a comment…'}
+			class="w-full rounded-md border border-[var(--ink-rule)] bg-[var(--ink-paper)] p-2 text-sm normal-case tracking-normal text-[var(--ink-text)] focus:border-[var(--ink-comment-edge)] focus:outline-none"
+		></textarea>
+	</label>
+
+	<div class="mt-3 flex items-center justify-between gap-2">
+		<div class="text-[10px] text-[var(--ink-text-faint)]">
+			<kbd class="ui-mono rounded border border-[var(--ink-rule)] bg-[var(--ink-paper)] px-1 py-0.5"
+				>⌘ ⏎</kbd
+			>
+			to save ·
+			<kbd class="ui-mono rounded border border-[var(--ink-rule)] bg-[var(--ink-paper)] px-1 py-0.5"
+				>esc</kbd
+			> to cancel
+		</div>
+		<div class="flex gap-2">
+			<button
+				type="button"
+				class="rounded-md px-2.5 py-1.5 text-xs font-medium text-[var(--ink-text-muted)] hover:bg-[var(--ink-paper)]"
+				onclick={onCancel}
+			>
+				Cancel
+			</button>
+			<button
+				type="button"
+				disabled={mode === 'comment' ? !body.trim() : !suggested.trim()}
+				class="rounded-md border border-[var(--ink-comment-edge)] bg-[var(--ink-comment-bg)] px-2.5 py-1.5 text-xs font-medium text-[var(--ink-comment)] hover:bg-[var(--ink-comment-bg)] disabled:cursor-not-allowed disabled:opacity-50"
+				onclick={save}
+			>
+				Save
+			</button>
+		</div>
+	</div>
+</div>
diff --git a/web/src/routes/share/[id]/components/CommentThread.svelte b/web/src/routes/share/[id]/components/CommentThread.svelte
deleted file mode 100644
index 4a0f6cc..0000000
--- a/web/src/routes/share/[id]/components/CommentThread.svelte
+++ /dev/null
@@ -1,21 +0,0 @@
-<script lang="ts">
-	import CommentCard from './CommentCard.svelte';
-	import type { CommentState } from '$lib/paste/events';
-
-	const { parent, replies, isAuthor } = $props<{
-		parent: CommentState;
-		replies: CommentState[];
-		isAuthor: boolean;
-	}>();
-</script>
-
-<div>
-	<CommentCard state={parent} {isAuthor} />
-	{#if replies.length}
-		<ul class="ml-6 mt-2 space-y-2 border-l pl-3">
-			{#each replies as r (r.event.id)}
-				<CommentCard state={r} {isAuthor} />
-			{/each}
-		</ul>
-	{/if}
-</div>
diff --git a/web/src/routes/share/[id]/components/DriftBadge.svelte b/web/src/routes/share/[id]/components/DriftBadge.svelte
deleted file mode 100644
index 5eca9fa..0000000
--- a/web/src/routes/share/[id]/components/DriftBadge.svelte
+++ /dev/null
@@ -1,9 +0,0 @@
-<script lang="ts">
-	const { status } = $props<{ status: 'ok' | 'drifted' | 'orphaned' }>();
-</script>
-
-{#if status === 'drifted'}
-	<span class="px-1.5 py-0.5 rounded bg-yellow-100 text-yellow-800 text-xs">anchor moved</span>
-{:else if status === 'orphaned'}
-	<span class="px-1.5 py-0.5 rounded bg-red-100 text-red-800 text-xs">content removed</span>
-{/if}
diff --git a/web/src/routes/share/[id]/components/FloatingToolbar.svelte b/web/src/routes/share/[id]/components/FloatingToolbar.svelte
new file mode 100644
index 0000000..0fb6e15
--- /dev/null
+++ b/web/src/routes/share/[id]/components/FloatingToolbar.svelte
@@ -0,0 +1,196 @@
+<script lang="ts">
+	import { onMount, onDestroy } from 'svelte';
+
+	export type ToolbarAction = 'praise' | 'comment' | 'delete' | 'suggest' | 'quick-label';
+
+	const {
+		anchorRect,
+		onAction,
+		onDismiss
+	}: {
+		anchorRect: DOMRect;
+		onAction: (a: ToolbarAction) => void;
+		onDismiss: () => void;
+	} = $props();
+
+	let toolbar: HTMLDivElement | undefined = $state();
+
+	function computePosition(rect: DOMRect): { top: number; left: number } {
+		const TOOLBAR_HEIGHT = 44;
+		const GAP = 12;
+		const top = rect.top + window.scrollY - TOOLBAR_HEIGHT - GAP;
+		const left = rect.left + window.scrollX + rect.width / 2;
+		return { top: Math.max(8 + window.scrollY, top), left };
+	}
+
+	const position = $derived(computePosition(anchorRect));
+
+	function handleKeydown(e: KeyboardEvent) {
+		if (e.key === 'Escape') {
+			e.preventDefault();
+			onDismiss();
+		}
+	}
+
+	function handleDocumentClick(e: MouseEvent) {
+		if (!toolbar) return;
+		if (toolbar.contains(e.target as Node)) return;
+		const sel = window.getSelection();
+		if (sel && sel.toString().trim().length > 0) return;
+		onDismiss();
+	}
+
+	onMount(() => {
+		document.addEventListener('keydown', handleKeydown);
+		document.addEventListener('mousedown', handleDocumentClick);
+	});
+
+	onDestroy(() => {
+		document.removeEventListener('keydown', handleKeydown);
+		document.removeEventListener('mousedown', handleDocumentClick);
+	});
+
+	type Tone = 'praise' | 'comment' | 'delete' | 'muted';
+	const toneClass: Record<Tone, string> = {
+		praise: 'text-[var(--ink-praise)] hover:bg-[var(--ink-praise-bg)]',
+		comment: 'text-[var(--ink-comment)] hover:bg-[var(--ink-comment-bg)]',
+		delete: 'text-[var(--ink-delete)] hover:bg-[var(--ink-delete-bg)]',
+		muted: 'text-[var(--ink-text-muted)] hover:bg-[var(--ink-paper)]'
+	};
+</script>
+
+<div
+	bind:this={toolbar}
+	class="floating-toolbar fixed z-[100] flex items-center gap-0.5 p-1 ui-sans"
+	style="top: {position.top}px; left: {position.left}px; transform: translateX(-50%);"
+	role="toolbar"
+	aria-label="Annotation actions"
+>
+	<button
+		type="button"
+		class="rounded-md p-2 transition-colors {toneClass.praise}"
+		title="Mark as praise (looks good)"
+		onclick={() => onAction('praise')}
+	>
+		<svg
+			class="h-4 w-4"
+			viewBox="0 0 24 24"
+			fill="none"
+			stroke="currentColor"
+			stroke-width="2"
+			aria-hidden="true"
+		>
+			<path
+				stroke-linecap="round"
+				stroke-linejoin="round"
+				d="M7 11v10H3V11h4zm14-2.5a2 2 0 00-2-2h-5l1.4-4.4a1 1 0 00-1.5-1.1L8 6v15l8.5-1a3 3 0 002.7-2.4l1.7-7.5a2 2 0 00.1-1.6z"
+			/>
+		</svg>
+	</button>
+
+	<button
+		type="button"
+		class="rounded-md p-2 transition-colors {toneClass.comment}"
+		title="Add a comment"
+		onclick={() => onAction('comment')}
+	>
+		<svg
+			class="h-4 w-4"
+			viewBox="0 0 24 24"
+			fill="none"
+			stroke="currentColor"
+			stroke-width="2"
+			aria-hidden="true"
+		>
+			<path
+				stroke-linecap="round"
+				stroke-linejoin="round"
+				d="M8 12h.01M12 12h.01M16 12h.01M21 12c0 4.418-4.03 8-9 8a9.863 9.863 0 01-4.255-.949L3 20l1.395-3.72C3.512 15.042 3 13.574 3 12c0-4.418 4.03-8 9-8s9 3.582 9 8z"
+			/>
+		</svg>
+	</button>
+
+	<div class="mx-0.5 h-5 w-px bg-[var(--ink-rule)]"></div>
+
+	<button
+		type="button"
+		class="rounded-md p-2 transition-colors {toneClass.delete}"
+		title="Propose removing this text"
+		onclick={() => onAction('delete')}
+	>
+		<svg
+			class="h-4 w-4"
+			viewBox="0 0 24 24"
+			fill="none"
+			stroke="currentColor"
+			stroke-width="2"
+			aria-hidden="true"
+		>
+			<path
+				stroke-linecap="round"
+				stroke-linejoin="round"
+				d="M19 7l-.867 12.142A2 2 0 0116.138 21H7.862a2 2 0 01-1.995-1.858L5 7m5 4v6m4-6v6m1-10V4a1 1 0 00-1-1h-4a1 1 0 00-1 1v3M4 7h16"
+			/>
+		</svg>
+	</button>
+
+	<button
+		type="button"
+		class="rounded-md p-2 transition-colors {toneClass.comment}"
+		title="Propose replacement text"
+		onclick={() => onAction('suggest')}
+	>
+		<svg
+			class="h-4 w-4"
+			viewBox="0 0 24 24"
+			fill="none"
+			stroke="currentColor"
+			stroke-width="2"
+			aria-hidden="true"
+		>
+			<path
+				stroke-linecap="round"
+				stroke-linejoin="round"
+				d="M9.663 17h4.673M12 3v1m6.364 1.636l-.707.707M21 12h-1M4 12H3m3.343-5.657l-.707-.707m2.828 9.9a5 5 0 117.072 0l-.548.547A3.374 3.374 0 0014 18.469V19a2 2 0 11-4 0v-.531c0-.895-.356-1.754-.988-2.386l-.548-.547z"
+			/>
+		</svg>
+	</button>
+
+	<button
+		type="button"
+		class="rounded-md p-2 transition-colors {toneClass.praise}"
+		title="Pick a label"
+		onclick={() => onAction('quick-label')}
+	>
+		<svg
+			class="h-4 w-4"
+			viewBox="0 0 24 24"
+			fill="none"
+			stroke="currentColor"
+			stroke-width="2"
+			aria-hidden="true"
+		>
+			<path stroke-linecap="round" stroke-linejoin="round" d="M13 10V3L4 14h7v7l9-11h-7z" />
+		</svg>
+	</button>
+
+	<div class="mx-0.5 h-5 w-px bg-[var(--ink-rule)]"></div>
+
+	<button
+		type="button"
+		class="rounded-md p-2 transition-colors {toneClass.muted}"
+		title="Cancel (Esc)"
+		onclick={onDismiss}
+	>
+		<svg
+			class="h-4 w-4"
+			viewBox="0 0 24 24"
+			fill="none"
+			stroke="currentColor"
+			stroke-width="2"
+			aria-hidden="true"
+		>
+			<path stroke-linecap="round" stroke-linejoin="round" d="M6 18L18 6M6 6l12 12" />
+		</svg>
+	</button>
+</div>
diff --git a/web/src/routes/share/[id]/components/LabelPicker.svelte b/web/src/routes/share/[id]/components/LabelPicker.svelte
deleted file mode 100644
index 6bc97fa..0000000
--- a/web/src/routes/share/[id]/components/LabelPicker.svelte
+++ /dev/null
@@ -1,26 +0,0 @@
-<script lang="ts">
-	import type { CommentType } from '$lib/paste/types';
-
-	const labels: { id: CommentType; emoji: string; color: string; tone: string }[] = [
-		{ id: 'praise', emoji: '🌟', color: 'bg-green-100 text-green-800', tone: 'Praise' },
-		{ id: 'issue', emoji: '🔴', color: 'bg-red-100 text-red-800', tone: 'Issue' },
-		{ id: 'suggestion', emoji: '💡', color: 'bg-blue-100 text-blue-800', tone: 'Suggestion' },
-		{ id: 'question', emoji: '❓', color: 'bg-yellow-100 text-yellow-800', tone: 'Question' },
-		{ id: 'nit', emoji: '💅', color: 'bg-gray-100 text-gray-800', tone: 'Nit' }
-	];
-
-	let { value = $bindable<CommentType>('comment') } = $props();
-</script>
-
-<div class="flex gap-1 flex-wrap">
-	{#each labels as l}
-		<button
-			type="button"
-			class="px-2 py-1 rounded text-xs {l.color} {value === l.id ? 'ring-2 ring-offset-1' : 'opacity-60'}"
-			onclick={() => (value = l.id)}
-		>
-			{l.emoji}
-			{l.tone}
-		</button>
-	{/each}
-</div>
diff --git a/web/src/routes/share/[id]/components/NamePromptModal.svelte b/web/src/routes/share/[id]/components/NamePromptModal.svelte
index efb81b0..e922a18 100644
--- a/web/src/routes/share/[id]/components/NamePromptModal.svelte
+++ b/web/src/routes/share/[id]/components/NamePromptModal.svelte
@@ -1,8 +1,10 @@
 <script lang="ts">
+	import { onMount, tick } from 'svelte';
 	import { setReviewerName } from '$lib/paste/identity';
 
-	const { onSave } = $props<{ onSave: (name: string) => void }>();
+	const { onSave }: { onSave: (name: string) => void } = $props();
 	let name = $state('');
+	let input: HTMLInputElement | undefined = $state();
 
 	function save() {
 		const trimmed = name.trim();
@@ -10,19 +12,51 @@
 		setReviewerName(trimmed);
 		onSave(trimmed);
 	}
+
+	function handleKey(e: KeyboardEvent) {
+		if (e.key === 'Enter' && name.trim()) {
+			e.preventDefault();
+			save();
+		}
+	}
+
+	onMount(async () => {
+		await tick();
+		input?.focus();
+	});
 </script>
 
-<div class="fixed inset-0 bg-black/50 flex items-center justify-center" role="dialog">
-	<div class="bg-white p-4 rounded shadow space-y-3 w-80">
-		<h2 class="font-semibold">What's your name?</h2>
-		<p class="text-sm text-gray-500">
-			This is shown alongside your review comments. Stored in this browser only.
+<div
+	class="ui-sans fixed inset-0 z-[200] flex items-center justify-center bg-[oklch(0_0_0_/_0.65)] backdrop-blur-sm"
+	role="dialog"
+	aria-modal="true"
+>
+	<div
+		class="anno-card w-[400px] p-6"
+		style="animation: anno-card-in 250ms cubic-bezier(0.16, 1, 0.3, 1);"
+	>
+		<div class="mb-1 text-[10px] uppercase tracking-[0.12em] text-[var(--ink-text-faint)]">
+			Sign your review
+		</div>
+		<h2 class="mb-2 text-lg font-semibold text-[var(--ink-text)]">What's your name?</h2>
+		<p class="mb-4 text-sm text-[var(--ink-text-muted)]">
+			Shown alongside your annotations. Stored in this browser only — never sent in plaintext to the
+			server.
 		</p>
-		<input bind:value={name} placeholder="Your name" class="w-full border p-2 rounded" />
+		<input
+			bind:this={input}
+			bind:value={name}
+			onkeydown={handleKey}
+			placeholder="Your name"
+			class="mb-4 w-full rounded-md border border-[var(--ink-rule)] bg-[var(--ink-paper)] px-3 py-2 text-sm text-[var(--ink-text)] focus:border-[var(--ink-comment-edge)] focus:outline-none"
+		/>
 		<button
+			type="button"
 			onclick={save}
-			class="w-full bg-blue-600 text-white p-2 rounded"
-			disabled={!name.trim()}>Save</button
+			disabled={!name.trim()}
+			class="w-full rounded-md border border-[var(--ink-comment-edge)] bg-[var(--ink-comment-bg)] px-3 py-2 text-sm font-medium text-[var(--ink-comment)] transition-colors hover:bg-[oklch(from_var(--ink-comment)_l_c_h_/_0.24)] disabled:cursor-not-allowed disabled:opacity-50"
 		>
+			Continue
+		</button>
 	</div>
 </div>
diff --git a/web/src/routes/share/[id]/components/PlanRenderer.svelte b/web/src/routes/share/[id]/components/PlanRenderer.svelte
index e053bb5..bc56ea7 100644
--- a/web/src/routes/share/[id]/components/PlanRenderer.svelte
+++ b/web/src/routes/share/[id]/components/PlanRenderer.svelte
@@ -1,27 +1,37 @@
 <script lang="ts">
-	import { slugify } from '$lib/paste/anchor';
+	import { tick } from 'svelte';
 	import { marked } from 'marked';
+	import { slugify } from '$lib/paste/anchor';
+	import { applyInlineAnnotations, type InlineMark } from './inline-annotations';
+
+	type SelectionPayload = {
+		lineStart: number;
+		lineEnd: number;
+		quotedText: string;
+		headingSlug?: string;
+		contextBefore?: string;
+		contextAfter?: string;
+		rect: DOMRect;
+	};
 
-	const { markdown, onSelection } = $props<{
+	const {
+		markdown,
+		marks = [],
+		onSelection,
+		onMarkClick,
+		activeMarkId
+	}: {
 		markdown: string;
-		onSelection: (a: {
-			lineStart: number;
-			lineEnd: number;
-			charStart?: number;
-			charEnd?: number;
-			quotedText: string;
-			headingSlug?: string;
-			contextBefore?: string;
-			contextAfter?: string;
-		}) => void;
-	}>();
+		marks?: InlineMark[];
+		onSelection?: (sel: SelectionPayload | null) => void;
+		onMarkClick?: (id: string) => void;
+		activeMarkId?: string;
+	} = $props();
 
+	let container: HTMLElement | undefined = $state();
 	const html = $derived(renderWithSourceLines(markdown));
 
 	function renderWithSourceLines(md: string): string {
-		// Simple v1: split by blank-line paragraphs, wrap each in a <div data-source-line>
-		// and pipe content through marked. Tracks source lines well enough for paragraph
-		// anchoring; refine later for sub-paragraph precision.
 		const lines = md.split('\n');
 		const blocks: { startLine: number; text: string }[] = [];
 		let cur: { startLine: number; lines: string[] } | null = null;
@@ -43,33 +53,80 @@
 			.join('\n');
 	}
 
-	function handleMouseUp() {
+	$effect(() => {
+		void html;
+		void marks;
+		void activeMarkId;
+		if (!container) return;
+		void tick().then(() => {
+			if (container) applyInlineAnnotations(container, marks, activeMarkId);
+		});
+	});
+
+	function handleMouseUp(e: MouseEvent) {
+		const target = e.target as Element | null;
+		const existingMark = target?.closest('mark[data-anno-id]') as HTMLElement | null;
+		if (existingMark) {
+			onMarkClick?.(existingMark.dataset.annoId!);
+			return;
+		}
+
 		const sel = window.getSelection();
-		if (!sel || sel.rangeCount === 0 || sel.toString().length === 0) return;
+		if (!sel || sel.rangeCount === 0 || sel.toString().trim().length === 0) {
+			onSelection?.(null);
+			return;
+		}
 		const range = sel.getRangeAt(0);
-		const startEl = (range.startContainer.parentElement)?.closest('[data-source-line]') as HTMLElement | null;
-		const endEl = (range.endContainer.parentElement)?.closest('[data-source-line]') as HTMLElement | null;
-		if (!startEl || !endEl) return;
+		const startEl = (range.startContainer.parentElement as Element | null)?.closest(
+			'[data-source-line]'
+		) as HTMLElement | null;
+		const endEl = (range.endContainer.parentElement as Element | null)?.closest(
+			'[data-source-line]'
+		) as HTMLElement | null;
+		if (!startEl || !endEl) {
+			onSelection?.(null);
+			return;
+		}
+
 		const lineStart = Number(startEl.getAttribute('data-source-line'));
 		const lineEnd = Number(endEl.getAttribute('data-source-line'));
 		const quotedText = sel.toString();
+		const rect = range.getBoundingClientRect();
 
-		// Find nearest preceding heading element for slug.
 		let headingSlug: string | undefined;
 		let cursor: Element | null = startEl;
 		while (cursor) {
-			const h = cursor.querySelector('h1,h2,h3,h4,h5,h6');
+			const h = cursor.querySelector('h1, h2, h3, h4, h5, h6');
 			if (h) {
 				headingSlug = slugify(h.textContent ?? '');
 				break;
 			}
 			cursor = cursor.previousElementSibling;
 		}
-		onSelection({ lineStart, lineEnd, quotedText, headingSlug });
+
+		const blockText = startEl.textContent ?? '';
+		const idx = blockText.indexOf(quotedText);
+		const contextBefore = idx > 0 ? blockText.slice(Math.max(0, idx - 40), idx) : undefined;
+		const contextAfter =
+			idx >= 0 ? blockText.slice(idx + quotedText.length, idx + quotedText.length + 40) : undefined;
+
+		onSelection?.({
+			lineStart,
+			lineEnd,
+			quotedText,
+			headingSlug,
+			contextBefore,
+			contextAfter,
+			rect
+		});
 	}
 </script>
 
+<!-- The mouseup handler captures text selections; there's no keyboard equivalent
+     to "select text and click a floating toolbar button", so the listener is
+     mouse-only by design. -->
 <!-- svelte-ignore a11y_no_noninteractive_element_interactions -->
-<div onmouseup={handleMouseUp} class="prose" role="document">
+<article bind:this={container} class="doc" onmouseup={handleMouseUp}>
+	<!-- eslint-disable-next-line svelte/no-at-html-tags -->
 	{@html html}
-</div>
+</article>
diff --git a/web/src/routes/share/[id]/components/QuickLabelPicker.svelte b/web/src/routes/share/[id]/components/QuickLabelPicker.svelte
new file mode 100644
index 0000000..155f9f0
--- /dev/null
+++ b/web/src/routes/share/[id]/components/QuickLabelPicker.svelte
@@ -0,0 +1,85 @@
+<script lang="ts">
+	import { onMount, onDestroy } from 'svelte';
+	import type { CommentType } from '$lib/paste/types';
+
+	const {
+		anchorRect,
+		onPick,
+		onDismiss
+	}: {
+		anchorRect: DOMRect;
+		onPick: (label: CommentType, presetBody: string) => void;
+		onDismiss: () => void;
+	} = $props();
+
+	const labels: { id: CommentType; emoji: string; label: string; preset: string }[] = [
+		{ id: 'praise', emoji: '🌟', label: 'Praise', preset: 'Looks good' },
+		{ id: 'issue', emoji: '🔴', label: 'Issue', preset: '' },
+		{ id: 'suggestion', emoji: '💡', label: 'Suggestion', preset: '' },
+		{ id: 'question', emoji: '❓', label: 'Question', preset: '' },
+		{ id: 'nit', emoji: '💅', label: 'Nit', preset: '' }
+	];
+
+	let popover: HTMLDivElement | undefined = $state();
+
+	function computePosition(rect: DOMRect): { top: number; left: number } {
+		const HEIGHT = 220;
+		const GAP = 12;
+		const top = rect.top + window.scrollY - HEIGHT - GAP;
+		const left = rect.left + window.scrollX + rect.width / 2;
+		return { top: Math.max(8 + window.scrollY, top), left };
+	}
+
+	const position = $derived(computePosition(anchorRect));
+
+	function handleKeydown(e: KeyboardEvent) {
+		if (e.key === 'Escape') {
+			e.preventDefault();
+			onDismiss();
+		}
+		// Number shortcuts: 1..5 picks the corresponding label
+		const n = parseInt(e.key, 10);
+		if (!isNaN(n) && n >= 1 && n <= labels.length) {
+			e.preventDefault();
+			const l = labels[n - 1];
+			onPick(l.id, l.preset);
+		}
+	}
+
+	function handleDocumentClick(e: MouseEvent) {
+		if (!popover) return;
+		if (popover.contains(e.target as Node)) return;
+		onDismiss();
+	}
+
+	onMount(() => {
+		document.addEventListener('keydown', handleKeydown);
+		document.addEventListener('mousedown', handleDocumentClick);
+	});
+
+	onDestroy(() => {
+		document.removeEventListener('keydown', handleKeydown);
+		document.removeEventListener('mousedown', handleDocumentClick);
+	});
+</script>
+
+<div
+	bind:this={popover}
+	class="floating-toolbar fixed z-[100] w-[220px] p-1 ui-sans"
+	style="top: {position.top}px; left: {position.left}px; transform: translateX(-50%);"
+	role="menu"
+	aria-label="Pick a label"
+>
+	{#each labels as l, i (l.id)}
+		<button
+			type="button"
+			class="flex w-full items-center gap-2 rounded-md px-2 py-1.5 text-left text-sm text-[var(--ink-text)] hover:bg-[var(--ink-paper)]"
+			onclick={() => onPick(l.id, l.preset)}
+			role="menuitem"
+		>
+			<span class="text-base leading-none">{l.emoji}</span>
+			<span class="flex-1">{l.label}</span>
+			<span class="ui-mono text-[10px] text-[var(--ink-text-faint)]">{i + 1}</span>
+		</button>
+	{/each}
+</div>
diff --git a/web/src/routes/share/[id]/components/ResolveControls.svelte b/web/src/routes/share/[id]/components/ResolveControls.svelte
deleted file mode 100644
index 0642c41..0000000
--- a/web/src/routes/share/[id]/components/ResolveControls.svelte
+++ /dev/null
@@ -1,42 +0,0 @@
-<script lang="ts">
-	import type { CommentState } from '$lib/paste/events';
-	import type { ResolutionStatus } from '$lib/paste/types';
-
-	const { commentId: _commentId, currentStatus, onResolve } = $props<{
-		commentId: string;
-		currentStatus: CommentState['status'];
-		onResolve: (status: ResolutionStatus, reply?: string) => Promise<void>;
-	}>();
-
-	let showRejectReply = $state(false);
-	let rejectReply = $state('');
-</script>
-
-<span class="flex gap-1">
-	{#if currentStatus !== 'accepted'}
-		<button class="text-green-700" onclick={() => onResolve('accepted')}>✓ Accept</button>
-	{/if}
-	{#if currentStatus !== 'resolved'}
-		<button class="text-gray-700" onclick={() => onResolve('resolved')}>— Resolve</button>
-	{/if}
-	{#if currentStatus !== 'rejected'}
-		<button class="text-red-700" onclick={() => (showRejectReply = true)}>✕ Reject</button>
-	{/if}
-	{#if currentStatus === 'resolved' || currentStatus === 'rejected' || currentStatus === 'accepted'}
-		<button onclick={() => onResolve('reopened')}>Reopen</button>
-	{/if}
-</span>
-
-{#if showRejectReply}
-	<div class="mt-2 space-y-1">
-		<textarea bind:value={rejectReply} placeholder="Optional reply…" class="w-full" rows="2"
-		></textarea>
-		<button
-			onclick={async () => {
-				await onResolve('rejected', rejectReply);
-				showRejectReply = false;
-				rejectReply = '';
-			}}>Confirm reject</button
-		>
-	</div>
-{/if}
diff --git a/web/src/routes/share/[id]/components/SuggestionDiff.svelte b/web/src/routes/share/[id]/components/SuggestionDiff.svelte
deleted file mode 100644
index 3329625..0000000
--- a/web/src/routes/share/[id]/components/SuggestionDiff.svelte
+++ /dev/null
@@ -1,10 +0,0 @@
-<script lang="ts">
-	const { original, suggested } = $props<{ original: string; suggested: string }>();
-</script>
-
-<div class="text-sm font-mono">
-	{#if original}
-		<pre class="bg-red-50 line-through p-1">{original}</pre>
-	{/if}
-	<pre class="bg-green-50 p-1">{suggested}</pre>
-</div>
diff --git a/web/src/routes/share/[id]/components/inline-annotations.ts b/web/src/routes/share/[id]/components/inline-annotations.ts
new file mode 100644
index 0000000..6a91ea5
--- /dev/null
+++ b/web/src/routes/share/[id]/components/inline-annotations.ts
@@ -0,0 +1,119 @@
+/**
+ * Apply inline annotation marks to already-rendered markdown.
+ *
+ * Strategy: walk text nodes inside each block (data-source-line) referenced by
+ * the anchor, find the first occurrence of the anchor's quoted_text, and wrap
+ * it in a <mark> with the right CSS class. This is similar to plannotator's
+ * web-highlighter but tailored to our line-anchored model.
+ *
+ * The implementation rebuilds the marks every render rather than diffing; this
+ * is fine for the volume we expect (tens of annotations per plan).
+ */
+
+export type InlineMark = {
+	id: string;
+	kind: 'comment' | 'delete';
+	lineStart: number;
+	lineEnd: number;
+	quotedText: string;
+};
+
+const CLASS_BY_KIND: Record<InlineMark['kind'], string> = {
+	comment: 'anno-comment',
+	delete: 'anno-delete'
+};
+
+export function applyInlineAnnotations(
+	container: HTMLElement,
+	marks: InlineMark[],
+	activeId?: string
+): void {
+	// Tear down any prior marks so we don't double-wrap on re-render.
+	clearMarks(container);
+
+	for (const mark of marks) {
+		const block = container.querySelector<HTMLElement>(`[data-source-line="${mark.lineStart}"]`);
+		if (!block) continue;
+		wrapFirstOccurrence(block, mark, mark.id === activeId);
+	}
+}
+
+function clearMarks(container: HTMLElement): void {
+	const marks = container.querySelectorAll<HTMLElement>('mark[data-anno-id]');
+	for (const m of marks) {
+		const parent = m.parentNode;
+		if (!parent) continue;
+		while (m.firstChild) parent.insertBefore(m.firstChild, m);
+		parent.removeChild(m);
+		// Merge adjacent text nodes that were split when we wrapped.
+		parent.normalize();
+	}
+}
+
+function wrapFirstOccurrence(block: HTMLElement, mark: InlineMark, isActive: boolean): void {
+	const needle = mark.quotedText;
+	if (!needle) return;
+
+	// Walk text nodes in document order; track running offset so we can find the
+	// first occurrence even when the needle spans multiple text nodes.
+	const walker = document.createTreeWalker(block, NodeFilter.SHOW_TEXT);
+	const textNodes: Text[] = [];
+	let acc = '';
+	while (walker.nextNode()) {
+		const t = walker.currentNode as Text;
+		textNodes.push(t);
+		acc += t.data;
+	}
+
+	const offset = acc.indexOf(needle);
+	if (offset < 0) return; // anchor lost; caller already showed a drift badge
+
+	const start = offset;
+	const end = offset + needle.length;
+
+	// Find the start text node + offset within it.
+	let cum = 0;
+	let startNode: Text | null = null;
+	let startInner = 0;
+	let endNode: Text | null = null;
+	let endInner = 0;
+	for (const t of textNodes) {
+		const next = cum + t.data.length;
+		if (startNode === null && start < next) {
+			startNode = t;
+			startInner = start - cum;
+		}
+		if (endNode === null && end <= next) {
+			endNode = t;
+			endInner = end - cum;
+			break;
+		}
+		cum = next;
+	}
+	if (!startNode || !endNode) return;
+
+	try {
+		const range = document.createRange();
+		range.setStart(startNode, startInner);
+		range.setEnd(endNode, endInner);
+
+		const wrapper = document.createElement('mark');
+		wrapper.className = CLASS_BY_KIND[mark.kind] + (isActive ? ' is-active' : '');
+		wrapper.dataset.annoId = mark.id;
+
+		// `surroundContents` works for ranges that don't cross element boundaries.
+		// For multi-element ranges we extract+wrap+reinsert which works for inline
+		// content (text + simple inline elements like <code>, <strong>).
+		try {
+			range.surroundContents(wrapper);
+		} catch {
+			const frag = range.extractContents();
+			wrapper.appendChild(frag);
+			range.insertNode(wrapper);
+		}
+	} catch {
+		// Range manipulation can fail on edge cases (e.g., needle spans across
+		// block elements). Skip silently — the right-rail card still shows the
+		// annotation so the reviewer's intent isn't lost.
+	}
+}

From 4450aa2d70fd249c67eefe1f4ca237945ff08ba4 Mon Sep 17 00:00:00 2001
From: Ben Firestone <ben.firestone@krypticlabs.com>
Date: Wed, 29 Apr 2026 16:56:54 -0700
Subject: [PATCH 12/20] chore(web): scope vitest, refine paste crypto helper,
 format pass
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Three small, low-risk cleanups bundled together:

- Scope vitest's include glob to src/lib/paste/** so it doesn't pick up
  legacy bun:test files elsewhere in web/.
- Replace `as any` gymnastics in paste/crypto.ts with a single asArrayBuffer()
  helper. Functionally identical, just clearer.
- Run `bun run format` + lint:fix across web/. No behavioral changes — only
  trailing commas, line breaks, and quoting normalized by Biome/Prettier.

The format pass touches a lot of files that look unrelated; verifying with
`git diff --stat` shows no functional edits outside the paste lib.
---
 web/playwright.e2e.config.ts                  |   8 +-
 web/src/lib/api/ai.test.ts                    |   8 +-
 web/src/lib/api/ai.ts                         |   9 +-
 web/src/lib/api/index.ts                      |  42 ++-
 web/src/lib/components/CopyIdButton.svelte    |  14 +-
 .../lib/components/FilesystemBrowser.svelte   |  34 ++-
 web/src/lib/components/Header.svelte          |  13 +-
 .../lib/components/InlineMarkdownEdit.svelte  |  48 ++--
 web/src/lib/components/InlineSelect.svelte    |   4 +-
 web/src/lib/components/InlineTextEdit.svelte  |  15 +-
 web/src/lib/components/IssueCard.svelte       |  16 +-
 web/src/lib/components/IssuePicker.svelte     |   8 +-
 web/src/lib/components/LabelPicker.svelte     |   4 +-
 web/src/lib/components/MultiSelect.svelte     |  15 +-
 .../components/ProjectPageIntegration.test.ts |   4 +-
 .../lib/components/RecentAISessions.svelte    |  34 ++-
 .../lib/components/RecentAISessions.test.ts   |   5 +-
 web/src/lib/components/RoleLane.svelte        |   5 +-
 web/src/lib/components/Sidebar.svelte         |   4 +-
 web/src/lib/components/TeamIssueCard.svelte   |   8 +-
 .../lib/components/TranscriptViewer.svelte    |  34 ++-
 .../lib/components/TranscriptViewer.test.ts   |   5 +-
 .../lib/components/review/FileTree.test.ts    |   5 +-
 web/src/lib/paste/anchor.test.ts              |   4 +-
 web/src/lib/paste/anchor.ts                   |   6 +-
 web/src/lib/paste/client.test.ts              |  16 +-
 web/src/lib/paste/client.ts                   |  29 +-
 web/src/lib/paste/crypto.test.ts              |   2 +-
 web/src/lib/paste/crypto.ts                   |  39 +--
 web/src/lib/paste/events.test.ts              |   6 +-
 web/src/lib/paste/events.ts                   |   2 +-
 web/src/lib/stores/filters.svelte.ts          |   4 +-
 web/src/routes/+page.svelte                   | 249 +++++++++++++-----
 web/src/routes/[projectId]/+page.svelte       | 249 ++++++++++++++----
 web/src/routes/[projectId]/ai/+page.svelte    |  75 ++++--
 .../[projectId]/ai/[sessionId]/+page.svelte   |  14 +-
 .../[sessionId]/agents/[agentId]/+page.svelte |  16 +-
 .../routes/[projectId]/blocked/+page.svelte   |   2 +-
 .../routes/[projectId]/issues/+page.svelte    |   9 +-
 .../[projectId]/issues/[issueId]/+page.svelte |  27 +-
 .../[projectId]/issues/new/+page.svelte       |   2 +-
 web/src/routes/[projectId]/ready/+page.svelte |   2 +-
 web/src/routes/[projectId]/teams/+page.svelte |  27 +-
 web/src/routes/planner/[planId]/+page.svelte  |  68 +++--
 web/tests/e2e/comments-events.e2e.spec.ts     |   4 +-
 web/tests/e2e/dependencies.e2e.spec.ts        |   4 +-
 web/tests/e2e/fixtures.ts                     |  54 ++--
 web/tests/e2e/issue-lifecycle.e2e.spec.ts     |  36 ++-
 web/tests/e2e/team-context.e2e.spec.ts        |  16 +-
 web/tests/e2e/workspace-crud.e2e.spec.ts      |  52 ++--
 web/tests/issue-detail-inline-edit.spec.ts    |   5 +-
 web/tests/workspace-deletion.spec.ts          |   4 +-
 web/vitest.config.ts                          |   9 +-
 53 files changed, 893 insertions(+), 481 deletions(-)

diff --git a/web/playwright.e2e.config.ts b/web/playwright.e2e.config.ts
index 4ac2aca..189224d 100644
--- a/web/playwright.e2e.config.ts
+++ b/web/playwright.e2e.config.ts
@@ -11,13 +11,13 @@ export default defineConfig({
 	reporter: [['html', { open: 'never' }]],
 	use: {
 		baseURL: 'http://localhost:7433',
-		trace: 'on-first-retry',
+		trace: 'on-first-retry'
 	},
 	projects: [
 		{
 			name: 'chromium',
-			use: { ...devices['Desktop Chrome'] },
-		},
-	],
+			use: { ...devices['Desktop Chrome'] }
+		}
+	]
 	// No webServer block — test server is managed externally by docker compose
 });
diff --git a/web/src/lib/api/ai.test.ts b/web/src/lib/api/ai.test.ts
index da42599..57b57f6 100644
--- a/web/src/lib/api/ai.test.ts
+++ b/web/src/lib/api/ai.test.ts
@@ -28,9 +28,7 @@ describe('AI API client - project-scoped paths', () => {
 	});
 
 	test('getAIAgent calls correct project-scoped API endpoint', () => {
-		expect(apiSource).toContain(
-			"'/projects/{projectId}/ai/sessions/{sessionId}/agents/{agentId}'"
-		);
+		expect(apiSource).toContain("'/projects/{projectId}/ai/sessions/{sessionId}/agents/{agentId}'");
 		expect(apiSource).toContain('path: { projectId, sessionId, agentId }');
 	});
 
@@ -54,9 +52,7 @@ describe('AI API client - project-scoped paths', () => {
 	});
 
 	test('deleteAISession uses project-scoped API path', () => {
-		expect(apiSource).toContain(
-			"api.DELETE('/projects/{projectId}/ai/sessions/{sessionId}'"
-		);
+		expect(apiSource).toContain("api.DELETE('/projects/{projectId}/ai/sessions/{sessionId}'");
 	});
 
 	test('batchDeleteAISessions accepts projectId as first parameter', () => {
diff --git a/web/src/lib/api/ai.ts b/web/src/lib/api/ai.ts
index 4139b56..95566e0 100644
--- a/web/src/lib/api/ai.ts
+++ b/web/src/lib/api/ai.ts
@@ -118,12 +118,9 @@ export async function listAIAgents(
 	projectId: string,
 	sessionId: string
 ): Promise<AIAgentResponse[]> {
-	const { data, error } = await api.GET(
-		'/projects/{projectId}/ai/sessions/{sessionId}/agents',
-		{
-			params: { path: { projectId, sessionId } }
-		}
-	);
+	const { data, error } = await api.GET('/projects/{projectId}/ai/sessions/{sessionId}/agents', {
+		params: { path: { projectId, sessionId } }
+	});
 	if (error) {
 		if (typeof error === 'object' && error !== null && 'error' in error) {
 			throw new Error(String((error as { error: string }).error));
diff --git a/web/src/lib/api/index.ts b/web/src/lib/api/index.ts
index 7f306dd..46dd5f9 100644
--- a/web/src/lib/api/index.ts
+++ b/web/src/lib/api/index.ts
@@ -208,10 +208,7 @@ export async function getIssue(
 
 export type CreateIssueRequest = components['schemas']['CreateIssueRequest'];
 
-export async function createIssue(
-	projectId: string,
-	request: CreateIssueRequest
-): Promise<Issue> {
+export async function createIssue(projectId: string, request: CreateIssueRequest): Promise<Issue> {
 	const { data, error } = await api.POST('/projects/{projectId}/issues', {
 		params: { path: { projectId } },
 		body: request
@@ -325,12 +322,9 @@ export async function removeLabelFromIssue(
 	issueId: string,
 	labelName: string
 ): Promise<void> {
-	const { error } = await api.DELETE(
-		'/projects/{projectId}/issues/{issueId}/labels/{labelName}',
-		{
-			params: { path: { projectId, issueId, labelName } }
-		}
-	);
+	const { error } = await api.DELETE('/projects/{projectId}/issues/{issueId}/labels/{labelName}', {
+		params: { path: { projectId, issueId, labelName } }
+	});
 	if (error) handleError(error);
 }
 
@@ -348,24 +342,17 @@ export async function createComment(
 	issueId: string,
 	text: string
 ): Promise<Comment> {
-	const { data, error } = await api.POST(
-		'/projects/{projectId}/issues/{issueId}/comments',
-		{
-			params: { path: { projectId, issueId } },
-			body: { text }
-		}
-	);
+	const { data, error } = await api.POST('/projects/{projectId}/issues/{issueId}/comments', {
+		params: { path: { projectId, issueId } },
+		body: { text }
+	});
 	if (error) handleError(error);
 	if (!data) throw new Error('Failed to create comment');
 	return data;
 }
 
 // Event APIs
-export async function getEvents(
-	projectId: string,
-	issueId: string,
-	limit = 50
-): Promise<Event[]> {
+export async function getEvents(projectId: string, issueId: string, limit = 50): Promise<Event[]> {
 	const { data, error } = await api.GET('/projects/{projectId}/issues/{issueId}/events', {
 		params: {
 			path: { projectId, issueId },
@@ -464,7 +451,11 @@ export async function listPlanComments(planId: string): Promise<PlanComment[]> {
 	return data ?? [];
 }
 
-export async function createPlanComment(planId: string, content: string, lineNumber?: number): Promise<PlanComment> {
+export async function createPlanComment(
+	planId: string,
+	content: string,
+	lineNumber?: number
+): Promise<PlanComment> {
 	const { data, error } = await api.POST('/plans/{planId}/comments', {
 		params: { path: { planId } },
 		body: { content, line_number: lineNumber ?? null }
@@ -475,10 +466,7 @@ export async function createPlanComment(planId: string, content: string, lineNum
 }
 
 // Team Context APIs
-export async function getTeamContext(
-	projectId: string,
-	epicId?: string
-): Promise<TeamContext> {
+export async function getTeamContext(projectId: string, epicId?: string): Promise<TeamContext> {
 	const { data, error } = await api.GET('/projects/{projectId}/team-context', {
 		params: {
 			path: { projectId },
diff --git a/web/src/lib/components/CopyIdButton.svelte b/web/src/lib/components/CopyIdButton.svelte
index 828e68f..847dd33 100644
--- a/web/src/lib/components/CopyIdButton.svelte
+++ b/web/src/lib/components/CopyIdButton.svelte
@@ -14,11 +14,7 @@
 	let timeoutId: ReturnType<typeof setTimeout> | undefined;
 
 	const opacity = $derived(
-		copied ? 1
-		: hovered ? 1
-		: reveal === 'visible' ? 0.5
-		: groupHovered ? 0.5
-		: 0
+		copied ? 1 : hovered ? 1 : reveal === 'visible' ? 0.5 : groupHovered ? 0.5 : 0
 	);
 
 	function copyToClipboard(text: string) {
@@ -65,7 +61,9 @@
 		</svg>
 	{:else}
 		<svg class="copy-id-icon" viewBox="0 0 24 24" fill="currentColor">
-			<path d="M16 1H4c-1.1 0-2 .9-2 2v14h2V3h12V1zm3 4H8c-1.1 0-2 .9-2 2v14c0 1.1.9 2 2 2h11c1.1 0 2-.9 2-2V7c0-1.1-.9-2-2-2zm0 16H8V7h11v14z" />
+			<path
+				d="M16 1H4c-1.1 0-2 .9-2 2v14h2V3h12V1zm3 4H8c-1.1 0-2 .9-2 2v14c0 1.1.9 2 2 2h11c1.1 0 2-.9 2-2V7c0-1.1-.9-2-2-2zm0 16H8V7h11v14z"
+			/>
 		</svg>
 	{/if}
 
@@ -88,7 +86,9 @@
 		padding: 0;
 		line-height: 1;
 		position: relative;
-		transition: opacity 150ms ease, color 150ms ease;
+		transition:
+			opacity 150ms ease,
+			color 150ms ease;
 	}
 
 	.copy-id-btn:hover {
diff --git a/web/src/lib/components/FilesystemBrowser.svelte b/web/src/lib/components/FilesystemBrowser.svelte
index bd824f2..2b7323c 100644
--- a/web/src/lib/components/FilesystemBrowser.svelte
+++ b/web/src/lib/components/FilesystemBrowser.svelte
@@ -68,7 +68,13 @@
 			disabled={loading || !currentDir.trim()}
 		>
 			{#if loading}
-				<svg class="w-4 h-4 animate-spin" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+				<svg
+					class="w-4 h-4 animate-spin"
+					viewBox="0 0 24 24"
+					fill="none"
+					stroke="currentColor"
+					stroke-width="2"
+				>
 					<path d="M12 2a10 10 0 0 1 10 10" stroke-linecap="round" />
 				</svg>
 			{:else}
@@ -104,7 +110,9 @@
 
 	<!-- Error display -->
 	{#if error}
-		<div class="p-3 bg-status-blocked/10 border border-status-blocked/30 rounded-lg text-sm text-status-blocked">
+		<div
+			class="p-3 bg-status-blocked/10 border border-status-blocked/30 rounded-lg text-sm text-status-blocked"
+		>
 			{error}
 		</div>
 	{/if}
@@ -124,17 +132,31 @@
 						onclick={() => navigateTo(entry.path)}
 					>
 						<!-- Folder icon -->
-						<svg class="w-4 h-4 flex-shrink-0 {entry.is_git_repo ? 'text-primary-400' : 'text-text-muted'}" viewBox="0 0 24 24" fill="currentColor">
-							<path d="M10 4H4c-1.1 0-1.99.9-1.99 2L2 18c0 1.1.9 2 2 2h16c1.1 0 2-.9 2-2V8c0-1.1-.9-2-2-2h-8l-2-2z" />
+						<svg
+							class="w-4 h-4 flex-shrink-0 {entry.is_git_repo
+								? 'text-primary-400'
+								: 'text-text-muted'}"
+							viewBox="0 0 24 24"
+							fill="currentColor"
+						>
+							<path
+								d="M10 4H4c-1.1 0-1.99.9-1.99 2L2 18c0 1.1.9 2 2 2h16c1.1 0 2-.9 2-2V8c0-1.1-.9-2-2-2h-8l-2-2z"
+							/>
 						</svg>
 						<span class="truncate font-mono text-text-primary">{entry.name}</span>
 						{#if entry.is_git_repo}
-							<span class="flex-shrink-0 text-xs px-1.5 py-0.5 rounded bg-primary-600/20 text-primary-400 font-medium">
+							<span
+								class="flex-shrink-0 text-xs px-1.5 py-0.5 rounded bg-primary-600/20 text-primary-400 font-medium"
+							>
 								git
 							</span>
 						{/if}
 						<!-- Chevron right -->
-						<svg class="w-4 h-4 flex-shrink-0 text-text-muted ml-auto" viewBox="0 0 24 24" fill="currentColor">
+						<svg
+							class="w-4 h-4 flex-shrink-0 text-text-muted ml-auto"
+							viewBox="0 0 24 24"
+							fill="currentColor"
+						>
 							<path d="M10 6L8.59 7.41 13.17 12l-4.58 4.59L10 18l6-6z" />
 						</svg>
 					</button>
diff --git a/web/src/lib/components/Header.svelte b/web/src/lib/components/Header.svelte
index 985207a..f3d7741 100644
--- a/web/src/lib/components/Header.svelte
+++ b/web/src/lib/components/Header.svelte
@@ -78,10 +78,7 @@
 		<div class="flex items-center gap-3 min-w-0">
 			{#if project}
 				<nav class="flex items-center gap-2 text-sm">
-					<a
-						href="/{project.id}"
-						class="text-text-muted hover:text-text-primary transition-colors"
-					>
+					<a href="/{project.id}" class="text-text-muted hover:text-text-primary transition-colors">
 						{project.name}
 					</a>
 					{#if title}
@@ -152,12 +149,16 @@
 						onclick={() => (menuOpen = !menuOpen)}
 					>
 						<svg class="w-5 h-5" viewBox="0 0 24 24" fill="currentColor">
-							<path d="M12 8c1.1 0 2-.9 2-2s-.9-2-2-2-2 .9-2 2 .9 2 2 2zm0 2c-1.1 0-2 .9-2 2s.9 2 2 2 2-.9 2-2-.9-2-2-2zm0 6c-1.1 0-2 .9-2 2s.9 2 2 2 2-.9 2-2-.9-2-2-2z" />
+							<path
+								d="M12 8c1.1 0 2-.9 2-2s-.9-2-2-2-2 .9-2 2 .9 2 2 2zm0 2c-1.1 0-2 .9-2 2s.9 2 2 2 2-.9 2-2-.9-2-2-2zm0 6c-1.1 0-2 .9-2 2s.9 2 2 2 2-.9 2-2-.9-2-2-2z"
+							/>
 						</svg>
 					</button>
 
 					{#if menuOpen}
-						<div class="absolute right-0 top-full mt-1 bg-surface-800 border border-border rounded-lg shadow-lg min-w-[180px] py-1 animate-fade-in z-20">
+						<div
+							class="absolute right-0 top-full mt-1 bg-surface-800 border border-border rounded-lg shadow-lg min-w-[180px] py-1 animate-fade-in z-20"
+						>
 							{#each actions as action (action.id)}
 								<button
 									type="button"
diff --git a/web/src/lib/components/InlineMarkdownEdit.svelte b/web/src/lib/components/InlineMarkdownEdit.svelte
index 609363c..d1108d9 100644
--- a/web/src/lib/components/InlineMarkdownEdit.svelte
+++ b/web/src/lib/components/InlineMarkdownEdit.svelte
@@ -60,41 +60,29 @@
 			{placeholder}
 		></textarea>
 		<div class="flex gap-2 mt-2">
-			<button
-				type="button"
-				onclick={save}
-				disabled={saving}
-				class="btn btn-primary text-sm"
-			>
+			<button type="button" onclick={save} disabled={saving} class="btn btn-primary text-sm">
 				{saving ? 'Saving...' : 'Save'}
 			</button>
-			<button
-				type="button"
-				onclick={cancel}
-				disabled={saving}
-				class="btn btn-ghost text-sm"
-			>
+			<button type="button" onclick={cancel} disabled={saving} class="btn btn-ghost text-sm">
 				Cancel
 			</button>
 		</div>
+	{:else if value}
+		<button
+			type="button"
+			onclick={startEdit}
+			class="absolute top-1 right-1 text-xs text-text-muted hover:text-text-primary cursor-pointer transition-colors z-10"
+		>
+			Edit
+		</button>
+		<Markdown content={value} />
 	{:else}
-		{#if value}
-			<button
-				type="button"
-				onclick={startEdit}
-				class="absolute top-1 right-1 text-xs text-text-muted hover:text-text-primary cursor-pointer transition-colors z-10"
-			>
-				Edit
-			</button>
-			<Markdown content={value} />
-		{:else}
-			<button
-				type="button"
-				onclick={startEdit}
-				class="w-full text-left cursor-pointer hover:bg-surface-700/50 rounded px-2 py-2 transition-colors"
-			>
-				<span class="text-text-muted italic">{placeholder}</span>
-			</button>
-		{/if}
+		<button
+			type="button"
+			onclick={startEdit}
+			class="w-full text-left cursor-pointer hover:bg-surface-700/50 rounded px-2 py-2 transition-colors"
+		>
+			<span class="text-text-muted italic">{placeholder}</span>
+		</button>
 	{/if}
 </div>
diff --git a/web/src/lib/components/InlineSelect.svelte b/web/src/lib/components/InlineSelect.svelte
index 5a40345..d4342e6 100644
--- a/web/src/lib/components/InlineSelect.svelte
+++ b/web/src/lib/components/InlineSelect.svelte
@@ -132,7 +132,9 @@
 			class="select-dropdown"
 			role="listbox"
 			tabindex="-1"
-			aria-activedescendant={highlightedIndex >= 0 ? `select-${instanceId}-option-${highlightedIndex}` : undefined}
+			aria-activedescendant={highlightedIndex >= 0
+				? `select-${instanceId}-option-${highlightedIndex}`
+				: undefined}
 		>
 			{#each options as option, i (option.value)}
 				<!-- svelte-ignore a11y_click_events_have_key_events -->
diff --git a/web/src/lib/components/InlineTextEdit.svelte b/web/src/lib/components/InlineTextEdit.svelte
index c88e6b6..4805b27 100644
--- a/web/src/lib/components/InlineTextEdit.svelte
+++ b/web/src/lib/components/InlineTextEdit.svelte
@@ -108,8 +108,19 @@
 					>
 						{#if saving}
 							<svg class="w-3.5 h-3.5 animate-spin" viewBox="0 0 24 24" fill="none">
-								<circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4"></circle>
-								<path class="opacity-75" fill="currentColor" d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"></path>
+								<circle
+									class="opacity-25"
+									cx="12"
+									cy="12"
+									r="10"
+									stroke="currentColor"
+									stroke-width="4"
+								></circle>
+								<path
+									class="opacity-75"
+									fill="currentColor"
+									d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"
+								></path>
 							</svg>
 						{:else}
 							Save
diff --git a/web/src/lib/components/IssueCard.svelte b/web/src/lib/components/IssueCard.svelte
index e862f70..9e35bc7 100644
--- a/web/src/lib/components/IssueCard.svelte
+++ b/web/src/lib/components/IssueCard.svelte
@@ -67,7 +67,13 @@
 						{issue.id}
 					</span>
 					<!-- svelte-ignore a11y_click_events_have_key_events a11y_no_static_element_interactions -->
-					<span role="presentation" onclick={(e) => { e.preventDefault(); e.stopPropagation(); }}>
+					<span
+						role="presentation"
+						onclick={(e) => {
+							e.preventDefault();
+							e.stopPropagation();
+						}}
+					>
 						<CopyIdButton value={issue.id} reveal="hover" groupHovered={cardHovered} />
 					</span>
 				</span>
@@ -97,7 +103,13 @@
 			<div class="flex items-center gap-2 flex-wrap">
 				{#if onStatusChange}
 					<!-- svelte-ignore a11y_click_events_have_key_events a11y_no_static_element_interactions -->
-					<div role="presentation" onclick={(e) => { e.preventDefault(); e.stopPropagation(); }}>
+					<div
+						role="presentation"
+						onclick={(e) => {
+							e.preventDefault();
+							e.stopPropagation();
+						}}
+					>
 						<InlineSelect
 							value={issue.status}
 							options={statusOptions}
diff --git a/web/src/lib/components/IssuePicker.svelte b/web/src/lib/components/IssuePicker.svelte
index 718f524..93676b3 100644
--- a/web/src/lib/components/IssuePicker.svelte
+++ b/web/src/lib/components/IssuePicker.svelte
@@ -107,13 +107,7 @@
 			{#if loading}
 				<div class="flex items-center justify-center py-8 text-text-muted text-sm">
 					<svg class="w-4 h-4 animate-spin mr-2" viewBox="0 0 24 24" fill="none">
-						<circle
-							class="opacity-25"
-							cx="12"
-							cy="12"
-							r="10"
-							stroke="currentColor"
-							stroke-width="4"
+						<circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4"
 						></circle>
 						<path
 							class="opacity-75"
diff --git a/web/src/lib/components/LabelPicker.svelte b/web/src/lib/components/LabelPicker.svelte
index bc555cd..270ff27 100644
--- a/web/src/lib/components/LabelPicker.svelte
+++ b/web/src/lib/components/LabelPicker.svelte
@@ -74,9 +74,7 @@
 		{@const color = getLabelColor(label)}
 		<span
 			class="px-2 py-1 text-xs font-medium rounded border inline-flex items-center gap-1"
-			style={color
-				? `background-color: ${color}20; color: ${color}; border-color: ${color}40`
-				: ''}
+			style={color ? `background-color: ${color}20; color: ${color}; border-color: ${color}40` : ''}
 			class:bg-surface-600={!color}
 			class:text-text-secondary={!color}
 			class:border-transparent={!color}
diff --git a/web/src/lib/components/MultiSelect.svelte b/web/src/lib/components/MultiSelect.svelte
index e45f068..29c2475 100644
--- a/web/src/lib/components/MultiSelect.svelte
+++ b/web/src/lib/components/MultiSelect.svelte
@@ -131,10 +131,15 @@
 						role="button"
 						tabindex="0"
 						onclick={(e) => removeValue(chip.value, e)}
-						onkeydown={(e) => { if (e.key === 'Enter' || e.key === ' ') { e.preventDefault(); removeValue(chip.value, e); } }}
+						onkeydown={(e) => {
+							if (e.key === 'Enter' || e.key === ' ') {
+								e.preventDefault();
+								removeValue(chip.value, e);
+							}
+						}}
 						aria-label="Remove {chip.label}"
-						class="chip-remove"
-					>&times;</span>
+						class="chip-remove">&times;</span
+					>
 				</span>
 			{/each}
 			{#if overflowCount > 0}
@@ -161,7 +166,9 @@
 					id="multi-option-{i}"
 					role="option"
 					aria-selected={values.includes(option.value)}
-					class="select-option {i === highlightedIndex ? 'highlighted' : ''} {values.includes(option.value)
+					class="select-option {i === highlightedIndex ? 'highlighted' : ''} {values.includes(
+						option.value
+					)
 						? 'selected'
 						: ''}"
 					onclick={() => toggleOption(option)}
diff --git a/web/src/lib/components/ProjectPageIntegration.test.ts b/web/src/lib/components/ProjectPageIntegration.test.ts
index aa1b08f..b6400cd 100644
--- a/web/src/lib/components/ProjectPageIntegration.test.ts
+++ b/web/src/lib/components/ProjectPageIntegration.test.ts
@@ -10,7 +10,9 @@ const pageSource = readFileSync(
 
 describe('Project page AI sessions integration', () => {
 	test('imports RecentAISessions component', () => {
-		expect(pageSource).toContain("import RecentAISessions from '$lib/components/RecentAISessions.svelte'");
+		expect(pageSource).toContain(
+			"import RecentAISessions from '$lib/components/RecentAISessions.svelte'"
+		);
 	});
 
 	test('renders RecentAISessions with projectId prop', () => {
diff --git a/web/src/lib/components/RecentAISessions.svelte b/web/src/lib/components/RecentAISessions.svelte
index a0c161b..b5cfb20 100644
--- a/web/src/lib/components/RecentAISessions.svelte
+++ b/web/src/lib/components/RecentAISessions.svelte
@@ -40,7 +40,9 @@
 		return `${days}d ago`;
 	}
 
-	function formatStatusSummary(summary: AISessionResponse['agent_summary']): Array<{ text: string; className: string }> {
+	function formatStatusSummary(
+		summary: AISessionResponse['agent_summary']
+	): Array<{ text: string; className: string }> {
 		if (!summary) return [];
 		const parts: Array<{ text: string; className: string }> = [];
 		if (summary.running_count && summary.running_count > 0) {
@@ -70,19 +72,32 @@
 <section class="mb-8">
 	<div class="flex items-center justify-between mb-3">
 		<div class="flex items-center gap-3">
-			<svg class="w-5 h-5 text-text-muted" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
-				<path d="M12 2a4 4 0 0 1 4 4c0 1.5-.8 2.8-2 3.4V11h3a3 3 0 0 1 3 3v1.5a2.5 2.5 0 0 1 0 5V21a1 1 0 0 1-1 1H5a1 1 0 0 1-1-1v-.5a2.5 2.5 0 0 1 0-5V14a3 3 0 0 1 3-3h3V9.4A4 4 0 0 1 12 2z" />
+			<svg
+				class="w-5 h-5 text-text-muted"
+				viewBox="0 0 24 24"
+				fill="none"
+				stroke="currentColor"
+				stroke-width="2"
+			>
+				<path
+					d="M12 2a4 4 0 0 1 4 4c0 1.5-.8 2.8-2 3.4V11h3a3 3 0 0 1 3 3v1.5a2.5 2.5 0 0 1 0 5V21a1 1 0 0 1-1 1H5a1 1 0 0 1-1-1v-.5a2.5 2.5 0 0 1 0-5V14a3 3 0 0 1 3-3h3V9.4A4 4 0 0 1 12 2z"
+				/>
 				<circle cx="9" cy="17" r="1" fill="currentColor" />
 				<circle cx="15" cy="17" r="1" fill="currentColor" />
 			</svg>
 			<h2 class="text-lg font-semibold text-text-primary">Recent AI Sessions</h2>
 			{#if !loading && sessions.length > 0}
-				<span class="inline-flex items-center px-2 py-0.5 rounded-full text-xs font-medium bg-surface-700 text-text-muted">
+				<span
+					class="inline-flex items-center px-2 py-0.5 rounded-full text-xs font-medium bg-surface-700 text-text-muted"
+				>
 					{sessions.length}
 				</span>
 			{/if}
 		</div>
-		<a href="/{projectId}/ai" class="text-sm text-accent-blue hover:text-accent-blue/80 transition-colors">
+		<a
+			href="/{projectId}/ai"
+			class="text-sm text-accent-blue hover:text-accent-blue/80 transition-colors"
+		>
 			View all &rarr;
 		</a>
 	</div>
@@ -90,8 +105,13 @@
 	{#if loading}
 		<div class="flex items-center gap-2 text-sm text-text-muted py-4">
 			<svg class="w-4 h-4 animate-spin" viewBox="0 0 24 24" fill="none">
-				<circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4"></circle>
-				<path class="opacity-75" fill="currentColor" d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"></path>
+				<circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4"
+				></circle>
+				<path
+					class="opacity-75"
+					fill="currentColor"
+					d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"
+				></path>
 			</svg>
 			Loading sessions...
 		</div>
diff --git a/web/src/lib/components/RecentAISessions.test.ts b/web/src/lib/components/RecentAISessions.test.ts
index 570a95e..24a9f85 100644
--- a/web/src/lib/components/RecentAISessions.test.ts
+++ b/web/src/lib/components/RecentAISessions.test.ts
@@ -3,10 +3,7 @@ import { describe, expect, test } from 'bun:test';
 import { readFileSync } from 'node:fs';
 import { resolve } from 'node:path';
 
-const componentSource = readFileSync(
-	resolve(import.meta.dir, 'RecentAISessions.svelte'),
-	'utf-8'
-);
+const componentSource = readFileSync(resolve(import.meta.dir, 'RecentAISessions.svelte'), 'utf-8');
 
 describe('RecentAISessions component', () => {
 	test('uses Svelte 5 runes for props', () => {
diff --git a/web/src/lib/components/RoleLane.svelte b/web/src/lib/components/RoleLane.svelte
index b44f995..73b406b 100644
--- a/web/src/lib/components/RoleLane.svelte
+++ b/web/src/lib/components/RoleLane.svelte
@@ -19,10 +19,7 @@
 <div class="flex flex-col min-w-[280px] max-w-[340px]">
 	<!-- Lane header -->
 	<div class="flex items-center gap-3 mb-3 pb-2 border-b-2" style="border-color: {color}">
-		<div
-			class="w-2 h-2 rounded-full flex-shrink-0"
-			style="background-color: {color}"
-		></div>
+		<div class="w-2 h-2 rounded-full flex-shrink-0" style="background-color: {color}"></div>
 		<h3 class="text-sm font-semibold text-text-primary uppercase tracking-wider">
 			{displayRole}
 		</h3>
diff --git a/web/src/lib/components/Sidebar.svelte b/web/src/lib/components/Sidebar.svelte
index 4ba4c65..f1acf37 100644
--- a/web/src/lib/components/Sidebar.svelte
+++ b/web/src/lib/components/Sidebar.svelte
@@ -81,9 +81,7 @@
 	<!-- Project List with Search (only when viewing a project) -->
 	{#if projects.length > 0 && currentProject}
 		<div class="p-3 border-b border-border">
-			<div class="text-xs font-medium text-text-muted uppercase tracking-wider mb-2">
-				Projects
-			</div>
+			<div class="text-xs font-medium text-text-muted uppercase tracking-wider mb-2">Projects</div>
 			<!-- Search input -->
 			<div class="relative mb-2">
 				<svg
diff --git a/web/src/lib/components/TeamIssueCard.svelte b/web/src/lib/components/TeamIssueCard.svelte
index 24a9222..c95f4e3 100644
--- a/web/src/lib/components/TeamIssueCard.svelte
+++ b/web/src/lib/components/TeamIssueCard.svelte
@@ -36,7 +36,13 @@
 					{issue.id}
 				</span>
 				<!-- svelte-ignore a11y_click_events_have_key_events a11y_no_static_element_interactions -->
-				<span role="presentation" onclick={(e) => { e.preventDefault(); e.stopPropagation(); }}>
+				<span
+					role="presentation"
+					onclick={(e) => {
+						e.preventDefault();
+						e.stopPropagation();
+					}}
+				>
 					<CopyIdButton value={issue.id} reveal="hover" groupHovered={cardHovered} />
 				</span>
 			</span>
diff --git a/web/src/lib/components/TranscriptViewer.svelte b/web/src/lib/components/TranscriptViewer.svelte
index fa58759..e302f31 100644
--- a/web/src/lib/components/TranscriptViewer.svelte
+++ b/web/src/lib/components/TranscriptViewer.svelte
@@ -24,7 +24,9 @@
 	}
 
 	function isToolUse(msg: TranscriptMessage): boolean {
-		return msg.type === 'tool_use' || msg.type === 'tool_result' || !!msg.tool_name || !!msg.tool_use_id;
+		return (
+			msg.type === 'tool_use' || msg.type === 'tool_result' || !!msg.tool_name || !!msg.tool_use_id
+		);
 	}
 
 	function getToolName(msg: TranscriptMessage): string {
@@ -136,13 +138,21 @@
 							{#if msg.input}
 								<div class="mb-2">
 									<div class="text-xs text-text-muted mb-1">Input</div>
-									<pre class="text-xs bg-surface-900 rounded p-2 overflow-x-auto font-mono text-text-secondary max-h-96">{JSON.stringify(msg.input, null, 2)}</pre>
+									<pre
+										class="text-xs bg-surface-900 rounded p-2 overflow-x-auto font-mono text-text-secondary max-h-96">{JSON.stringify(
+											msg.input,
+											null,
+											2
+										)}</pre>
 								</div>
 							{/if}
 							{#if msg.content !== undefined}
 								<div>
 									<div class="text-xs text-text-muted mb-1">Result</div>
-									<pre class="text-xs bg-surface-900 rounded p-2 overflow-x-auto font-mono text-text-secondary max-h-96">{formatContent(msg.content)}</pre>
+									<pre
+										class="text-xs bg-surface-900 rounded p-2 overflow-x-auto font-mono text-text-secondary max-h-96">{formatContent(
+											msg.content
+										)}</pre>
 								</div>
 							{/if}
 						</div>
@@ -155,10 +165,8 @@
 
 					{#if role === 'system'}
 						<div class="text-xs text-text-muted whitespace-pre-wrap">{blocks.text}</div>
-					{:else}
-						{#if blocks.text}
-							<div class="text-sm text-text-primary whitespace-pre-wrap">{blocks.text}</div>
-						{/if}
+					{:else if blocks.text}
+						<div class="text-sm text-text-primary whitespace-pre-wrap">{blocks.text}</div>
 					{/if}
 
 					<!-- Inline tool use blocks -->
@@ -178,13 +186,21 @@
 									{#if tool.input}
 										<div class="mt-2">
 											<div class="text-xs text-text-muted mb-1">Input</div>
-											<pre class="text-xs bg-surface-900 rounded p-2 overflow-x-auto font-mono text-text-secondary max-h-96">{JSON.stringify(tool.input, null, 2)}</pre>
+											<pre
+												class="text-xs bg-surface-900 rounded p-2 overflow-x-auto font-mono text-text-secondary max-h-96">{JSON.stringify(
+													tool.input,
+													null,
+													2
+												)}</pre>
 										</div>
 									{/if}
 									{#if tool.result !== undefined}
 										<div class="mt-2">
 											<div class="text-xs text-text-muted mb-1">Result</div>
-											<pre class="text-xs bg-surface-900 rounded p-2 overflow-x-auto font-mono text-text-secondary max-h-96">{formatContent(tool.result)}</pre>
+											<pre
+												class="text-xs bg-surface-900 rounded p-2 overflow-x-auto font-mono text-text-secondary max-h-96">{formatContent(
+													tool.result
+												)}</pre>
 										</div>
 									{/if}
 								</div>
diff --git a/web/src/lib/components/TranscriptViewer.test.ts b/web/src/lib/components/TranscriptViewer.test.ts
index d8318c8..9aca0b6 100644
--- a/web/src/lib/components/TranscriptViewer.test.ts
+++ b/web/src/lib/components/TranscriptViewer.test.ts
@@ -3,10 +3,7 @@ import { describe, expect, test } from 'bun:test';
 import { readFileSync } from 'node:fs';
 import { resolve } from 'node:path';
 
-const componentSource = readFileSync(
-	resolve(import.meta.dir, 'TranscriptViewer.svelte'),
-	'utf-8'
-);
+const componentSource = readFileSync(resolve(import.meta.dir, 'TranscriptViewer.svelte'), 'utf-8');
 
 describe('TranscriptViewer component', () => {
 	test('accepts transcript prop', () => {
diff --git a/web/src/lib/components/review/FileTree.test.ts b/web/src/lib/components/review/FileTree.test.ts
index a7f102d..fe86652 100644
--- a/web/src/lib/components/review/FileTree.test.ts
+++ b/web/src/lib/components/review/FileTree.test.ts
@@ -3,10 +3,7 @@ import { describe, expect, test } from 'bun:test';
 import { readFileSync } from 'node:fs';
 import { resolve } from 'node:path';
 
-const componentSource = readFileSync(
-	resolve(import.meta.dir, 'FileTree.svelte'),
-	'utf-8'
-);
+const componentSource = readFileSync(resolve(import.meta.dir, 'FileTree.svelte'), 'utf-8');
 
 describe('FileTree component', () => {
 	test('button element has title={name} for tooltip', () => {
diff --git a/web/src/lib/paste/anchor.test.ts b/web/src/lib/paste/anchor.test.ts
index f7b5a41..407418e 100644
--- a/web/src/lib/paste/anchor.test.ts
+++ b/web/src/lib/paste/anchor.test.ts
@@ -15,7 +15,7 @@ describe('resolveAnchor', () => {
 			line_start: 3,
 			line_end: 3,
 			quoted_text: 'First paragraph.',
-			heading_slug: 'title',
+			heading_slug: 'title'
 		});
 		expect(r.status).toBe('drifted');
 	});
@@ -26,7 +26,7 @@ describe('resolveAnchor', () => {
 			line_start: 3,
 			line_end: 3,
 			quoted_text: 'First paragraph.',
-			heading_slug: 'title',
+			heading_slug: 'title'
 		});
 		expect(r.status).toBe('orphaned');
 	});
diff --git a/web/src/lib/paste/anchor.ts b/web/src/lib/paste/anchor.ts
index a0ba6ac..2ebcfbd 100644
--- a/web/src/lib/paste/anchor.ts
+++ b/web/src/lib/paste/anchor.ts
@@ -19,7 +19,7 @@ export function resolveAnchor(plan: string, anchor: Anchor): AnchorResolution {
 				line_end: anchor.line_end,
 				char_start: anchor.char_start,
 				char_end: anchor.char_end,
-				status: 'ok',
+				status: 'ok'
 			};
 		}
 	}
@@ -34,7 +34,7 @@ export function resolveAnchor(plan: string, anchor: Anchor): AnchorResolution {
 				return {
 					line_start: lineNum,
 					line_end: lineNum + countNewlinesBefore(anchor.quoted_text, anchor.quoted_text.length),
-					status: 'drifted',
+					status: 'drifted'
 				};
 			}
 		}
@@ -48,7 +48,7 @@ export function resolveAnchor(plan: string, anchor: Anchor): AnchorResolution {
 			return {
 				line_start: lineNum,
 				line_end: lineNum + countNewlinesBefore(anchor.quoted_text, anchor.quoted_text.length),
-				status: 'drifted',
+				status: 'drifted'
 			};
 		}
 	}
diff --git a/web/src/lib/paste/client.test.ts b/web/src/lib/paste/client.test.ts
index 7cf9d4b..63e3e48 100644
--- a/web/src/lib/paste/client.test.ts
+++ b/web/src/lib/paste/client.test.ts
@@ -5,15 +5,17 @@ describe('PasteClient', () => {
 	beforeEach(() => vi.restoreAllMocks());
 
 	it('POSTs base64-encoded blob+iv on create', async () => {
-		const fetchMock = vi.spyOn(globalThis, 'fetch').mockResolvedValue(
-			new Response(JSON.stringify({ id: 'abc', edit_token: 'tok' }), { status: 201 }),
-		);
+		const fetchMock = vi
+			.spyOn(globalThis, 'fetch')
+			.mockResolvedValue(
+				new Response(JSON.stringify({ id: 'abc', edit_token: 'tok' }), { status: 201 })
+			);
 		const c = new PasteClient('http://x');
 		const res = await c.create(new Uint8Array([1, 2]), new Uint8Array([3, 4]));
 		expect(res.id).toBe('abc');
 		expect(fetchMock).toHaveBeenCalledWith(
 			'http://x/api/paste',
-			expect.objectContaining({ method: 'POST' }),
+			expect.objectContaining({ method: 'POST' })
 		);
 		const body = JSON.parse((fetchMock.mock.calls[0][1] as RequestInit).body as string);
 		expect(body.schema_ver).toBe(1);
@@ -21,9 +23,9 @@ describe('PasteClient', () => {
 	});
 
 	it('sends Bearer token on update', async () => {
-		const fetchMock = vi.spyOn(globalThis, 'fetch').mockResolvedValue(
-			new Response(null, { status: 204 }),
-		);
+		const fetchMock = vi
+			.spyOn(globalThis, 'fetch')
+			.mockResolvedValue(new Response(null, { status: 204 }));
 		const c = new PasteClient('http://x');
 		await c.updatePlan('abc', 'mytoken', new Uint8Array([1]), new Uint8Array([2]));
 		const opts = fetchMock.mock.calls[0][1] as RequestInit;
diff --git a/web/src/lib/paste/client.ts b/web/src/lib/paste/client.ts
index 82cf47c..381ebcb 100644
--- a/web/src/lib/paste/client.ts
+++ b/web/src/lib/paste/client.ts
@@ -1,21 +1,21 @@
-import type {
-	CreatePasteResponse,
-	GetPasteResponse,
-	PasteEventResponse,
-} from './types';
+import type { CreatePasteResponse, GetPasteResponse, PasteEventResponse } from './types';
 
 export class PasteClient {
 	constructor(private baseUrl: string) {}
 
-	async create(planBlob: Uint8Array, planIv: Uint8Array, schemaVer = 1): Promise<CreatePasteResponse> {
+	async create(
+		planBlob: Uint8Array,
+		planIv: Uint8Array,
+		schemaVer = 1
+	): Promise<CreatePasteResponse> {
 		const res = await fetch(`${this.baseUrl}/api/paste`, {
 			method: 'POST',
 			headers: { 'Content-Type': 'application/json' },
 			body: JSON.stringify({
 				plan_blob: bytesToB64(planBlob),
 				plan_iv: bytesToB64(planIv),
-				schema_ver: schemaVer,
-			}),
+				schema_ver: schemaVer
+			})
 		});
 		if (!res.ok) throw new Error(`create paste failed: ${res.status}`);
 		return await res.json();
@@ -31,17 +31,22 @@ export class PasteClient {
 		const res = await fetch(`${this.baseUrl}/api/paste/${id}/blobs`, {
 			method: 'POST',
 			headers: { 'Content-Type': 'application/json' },
-			body: JSON.stringify({ blob: bytesToB64(blob), iv: bytesToB64(iv) }),
+			body: JSON.stringify({ blob: bytesToB64(blob), iv: bytesToB64(iv) })
 		});
 		if (!res.ok) throw new Error(`append event failed: ${res.status}`);
 		return await res.json();
 	}
 
-	async updatePlan(id: string, editToken: string, planBlob: Uint8Array, planIv: Uint8Array): Promise<void> {
+	async updatePlan(
+		id: string,
+		editToken: string,
+		planBlob: Uint8Array,
+		planIv: Uint8Array
+	): Promise<void> {
 		const res = await fetch(`${this.baseUrl}/api/paste/${id}`, {
 			method: 'PUT',
-			headers: { 'Content-Type': 'application/json', 'Authorization': `Bearer ${editToken}` },
-			body: JSON.stringify({ plan_blob: bytesToB64(planBlob), plan_iv: bytesToB64(planIv) }),
+			headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${editToken}` },
+			body: JSON.stringify({ plan_blob: bytesToB64(planBlob), plan_iv: bytesToB64(planIv) })
 		});
 		if (!res.ok) throw new Error(`update plan failed: ${res.status}`);
 	}
diff --git a/web/src/lib/paste/crypto.test.ts b/web/src/lib/paste/crypto.test.ts
index 5326ba9..5bd1598 100644
--- a/web/src/lib/paste/crypto.test.ts
+++ b/web/src/lib/paste/crypto.test.ts
@@ -6,7 +6,7 @@ import {
 	exportKey,
 	importKey,
 	base64UrlEncode,
-	base64UrlDecode,
+	base64UrlDecode
 } from './crypto';
 
 describe('paste crypto', () => {
diff --git a/web/src/lib/paste/crypto.ts b/web/src/lib/paste/crypto.ts
index 8b23e65..487f1ce 100644
--- a/web/src/lib/paste/crypto.ts
+++ b/web/src/lib/paste/crypto.ts
@@ -2,10 +2,23 @@ const ALGO = 'AES-GCM';
 const KEY_LEN_BITS = 256;
 const IV_LEN_BYTES = 12;
 
+/**
+ * Web Crypto APIs accept `BufferSource = ArrayBuffer | ArrayBufferView`, but
+ * TypeScript's strict types reject `Uint8Array<ArrayBufferLike>` because the
+ * `ArrayBufferLike` union includes `SharedArrayBuffer`, which Web Crypto
+ * forbids. Copy bytes into a fresh `ArrayBuffer` to satisfy both the runtime
+ * contract and the type checker.
+ */
+function asArrayBuffer(view: Uint8Array): ArrayBuffer {
+	const out = new ArrayBuffer(view.byteLength);
+	new Uint8Array(out).set(view);
+	return out;
+}
+
 export async function generateKey(): Promise<CryptoKey> {
 	return crypto.subtle.generateKey({ name: ALGO, length: KEY_LEN_BITS }, true, [
 		'encrypt',
-		'decrypt',
+		'decrypt'
 	]);
 }
 
@@ -15,39 +28,35 @@ export async function exportKey(key: CryptoKey): Promise<string> {
 }
 
 export async function importKey(b64url: string): Promise<CryptoKey> {
-	const decoded = base64UrlDecode(b64url);
-	// Copy to ensure backing buffer is ArrayBuffer, not SharedArrayBuffer
-	const raw = new Uint8Array(decoded.buffer.slice(decoded.byteOffset, decoded.byteOffset + decoded.byteLength)) as Uint8Array<ArrayBuffer>;
+	const raw = asArrayBuffer(base64UrlDecode(b64url));
 	return crypto.subtle.importKey('raw', raw, { name: ALGO }, true, ['encrypt', 'decrypt']);
 }
 
 export async function encryptJSON<T>(
 	value: T,
-	key: CryptoKey,
+	key: CryptoKey
 ): Promise<{ blob: Uint8Array; iv: Uint8Array }> {
 	const iv = crypto.getRandomValues(new Uint8Array(IV_LEN_BYTES));
 	const plaintext = new TextEncoder().encode(JSON.stringify(value));
-	// Copy to ensure backing buffer is ArrayBuffer, not SharedArrayBuffer
-	const plaintextAsArrayBuffer = plaintext as unknown as Uint8Array<ArrayBuffer>;
-	const plaintextCopy = new Uint8Array(plaintextAsArrayBuffer.buffer.slice(plaintextAsArrayBuffer.byteOffset, plaintextAsArrayBuffer.byteOffset + plaintextAsArrayBuffer.byteLength)) as Uint8Array<ArrayBuffer>;
-	const ct = await crypto.subtle.encrypt({ name: ALGO, iv }, key, plaintextCopy);
+	const ct = await crypto.subtle.encrypt(
+		{ name: ALGO, iv: asArrayBuffer(iv) },
+		key,
+		asArrayBuffer(plaintext)
+	);
 	return { blob: new Uint8Array(ct), iv };
 }
 
 export async function decryptJSON<T>(blob: Uint8Array, iv: Uint8Array, key: CryptoKey): Promise<T> {
-	// Copy to ensure backing buffer is ArrayBuffer, not SharedArrayBuffer
-	const blobAsArrayBuffer = blob as unknown as Uint8Array<ArrayBuffer>;
-	const ivAsArrayBuffer = iv as unknown as Uint8Array<ArrayBuffer>;
 	const plain = await crypto.subtle.decrypt(
-		{ name: ALGO, iv: ivAsArrayBuffer },
+		{ name: ALGO, iv: asArrayBuffer(iv) },
 		key,
-		new Uint8Array((blobAsArrayBuffer as Uint8Array<ArrayBuffer>).buffer.slice((blobAsArrayBuffer as Uint8Array<ArrayBuffer>).byteOffset, (blobAsArrayBuffer as Uint8Array<ArrayBuffer>).byteOffset + (blobAsArrayBuffer as Uint8Array<ArrayBuffer>).byteLength)) as any,
+		asArrayBuffer(blob)
 	);
 	return JSON.parse(new TextDecoder().decode(plain)) as T;
 }
 
 export function base64UrlEncode(bytes: Uint8Array): string {
-	let s = btoa(String.fromCharCode(...bytes));
+	const s = btoa(String.fromCharCode(...bytes));
 	return s.replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
 }
 
diff --git a/web/src/lib/paste/events.test.ts b/web/src/lib/paste/events.test.ts
index 7600d5c..c0844ca 100644
--- a/web/src/lib/paste/events.test.ts
+++ b/web/src/lib/paste/events.test.ts
@@ -9,7 +9,7 @@ const c: CommentEvent = {
 	comment_type: 'comment',
 	body: 'looks good',
 	anchor: { line_start: 1, line_end: 1, quoted_text: 'x' },
-	created_at: '2026-04-29T00:00:00Z',
+	created_at: '2026-04-29T00:00:00Z'
 };
 const accept: ResolutionEvent = {
 	kind: 'resolution',
@@ -17,7 +17,7 @@ const accept: ResolutionEvent = {
 	comment_id: 'c1',
 	status: 'accepted',
 	author_name: 'Ben',
-	created_at: '2026-04-29T00:01:00Z',
+	created_at: '2026-04-29T00:01:00Z'
 };
 
 describe('replayEvents', () => {
@@ -41,7 +41,7 @@ describe('replayEvents', () => {
 			...accept,
 			id: 'r2',
 			status: 'rejected',
-			created_at: '2026-04-29T00:02:00Z',
+			created_at: '2026-04-29T00:02:00Z'
 		};
 		const states = replayEvents('Ben', [c, accept, reject]);
 		expect(states.get('c1')?.status).toBe('rejected');
diff --git a/web/src/lib/paste/events.ts b/web/src/lib/paste/events.ts
index 7b0db48..5eb76e1 100644
--- a/web/src/lib/paste/events.ts
+++ b/web/src/lib/paste/events.ts
@@ -9,7 +9,7 @@ export type CommentState = {
 
 export function replayEvents(
 	planAuthor: string | undefined,
-	events: EventPlaintext[],
+	events: EventPlaintext[]
 ): Map<string, CommentState> {
 	const sorted = [...events].sort((a, b) => {
 		const c = a.created_at.localeCompare(b.created_at);
diff --git a/web/src/lib/stores/filters.svelte.ts b/web/src/lib/stores/filters.svelte.ts
index 2e579bb..6f19bb8 100644
--- a/web/src/lib/stores/filters.svelte.ts
+++ b/web/src/lib/stores/filters.svelte.ts
@@ -63,9 +63,7 @@ function createFilterStore() {
 				statuses: statusValues.length > 0 ? (statusValues as Status[]) : undefined,
 				issueTypes: typeValues.length > 0 ? (typeValues as IssueType[]) : undefined,
 				priorities:
-					priorityValues.length > 0
-						? priorityValues.map((p) => parseInt(p, 10))
-						: undefined,
+					priorityValues.length > 0 ? priorityValues.map((p) => parseInt(p, 10)) : undefined,
 				q: params.get('q') || undefined
 			};
 		}
diff --git a/web/src/routes/+page.svelte b/web/src/routes/+page.svelte
index 339e52b..5782459 100644
--- a/web/src/routes/+page.svelte
+++ b/web/src/routes/+page.svelte
@@ -418,19 +418,21 @@
 					{#if $projects.length > selectedCount}
 						<button class="btn btn-primary btn-sm" onclick={handleMerge}>
 							<svg class="w-4 h-4" viewBox="0 0 24 24" fill="currentColor">
-								<path d="M17 20.41L18.41 19 15 15.59 13.59 17 17 20.41zM7.5 8H11v5.59L5.59 19 7 20.41l6-6V8h3.5L12 3.5 7.5 8z" />
+								<path
+									d="M17 20.41L18.41 19 15 15.59 13.59 17 17 20.41zM7.5 8H11v5.59L5.59 19 7 20.41l6-6V8h3.5L12 3.5 7.5 8z"
+								/>
 							</svg>
 							Merge into...
 						</button>
 					{/if}
-				<button class="btn btn-danger btn-sm" onclick={handleDeleteSelected}>
-					<svg class="w-4 h-4" viewBox="0 0 24 24" fill="currentColor">
-						<path
-							d="M6 19c0 1.1.9 2 2 2h8c1.1 0 2-.9 2-2V7H6v12zM8 9h8v10H8V9zm7.5-5l-1-1h-5l-1 1H5v2h14V4h-3.5z"
-						/>
-					</svg>
-					Delete {selectedCount === 1 ? 'project' : `${selectedCount} projects`}
-				</button>
+					<button class="btn btn-danger btn-sm" onclick={handleDeleteSelected}>
+						<svg class="w-4 h-4" viewBox="0 0 24 24" fill="currentColor">
+							<path
+								d="M6 19c0 1.1.9 2 2 2h8c1.1 0 2-.9 2-2V7H6v12zM8 9h8v10H8V9zm7.5-5l-1-1h-5l-1 1H5v2h14V4h-3.5z"
+							/>
+						</svg>
+						Delete {selectedCount === 1 ? 'project' : `${selectedCount} projects`}
+					</button>
 				</div>
 			{/if}
 		</div>
@@ -479,10 +481,20 @@
 					<button
 						type="button"
 						class="btn btn-ghost btn-sm gap-1.5"
-						onclick={() => { sortAsc = !sortAsc; }}
+						onclick={() => {
+							sortAsc = !sortAsc;
+						}}
 					>
-						<svg class="w-3.5 h-3.5" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
-							<path d="M11 5h10M11 9h7M11 13h4M3 17l3 3 3-3M6 18V4"/>
+						<svg
+							class="w-3.5 h-3.5"
+							viewBox="0 0 24 24"
+							fill="none"
+							stroke="currentColor"
+							stroke-width="2"
+							stroke-linecap="round"
+							stroke-linejoin="round"
+						>
+							<path d="M11 5h10M11 9h7M11 13h4M3 17l3 3 3-3M6 18V4" />
 						</svg>
 						{sortAsc ? 'A–Z' : 'Z–A'}
 					</button>
@@ -490,32 +502,60 @@
 				<div class="flex items-center gap-1">
 					<button
 						type="button"
-						class="btn btn-ghost btn-sm btn-icon {layoutMode === 'grid' ? '!border-primary-600/40 !text-primary-400' : ''}"
+						class="btn btn-ghost btn-sm btn-icon {layoutMode === 'grid'
+							? '!border-primary-600/40 !text-primary-400'
+							: ''}"
 						title="Grid view"
-						onclick={() => { layoutMode = 'grid'; }}
+						onclick={() => {
+							layoutMode = 'grid';
+						}}
 					>
-						<svg class="w-3.5 h-3.5" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
-							<rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/>
-							<rect x="3" y="14" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/>
+						<svg
+							class="w-3.5 h-3.5"
+							viewBox="0 0 24 24"
+							fill="none"
+							stroke="currentColor"
+							stroke-width="2"
+							stroke-linecap="round"
+							stroke-linejoin="round"
+						>
+							<rect x="3" y="3" width="7" height="7" /><rect x="14" y="3" width="7" height="7" />
+							<rect x="3" y="14" width="7" height="7" /><rect x="14" y="14" width="7" height="7" />
 						</svg>
 					</button>
 					<button
 						type="button"
-						class="btn btn-ghost btn-sm btn-icon {layoutMode === 'list' ? '!border-primary-600/40 !text-primary-400' : ''}"
+						class="btn btn-ghost btn-sm btn-icon {layoutMode === 'list'
+							? '!border-primary-600/40 !text-primary-400'
+							: ''}"
 						title="List view"
-						onclick={() => { layoutMode = 'list'; }}
+						onclick={() => {
+							layoutMode = 'list';
+						}}
 					>
-						<svg class="w-3.5 h-3.5" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
-							<line x1="8" y1="6" x2="21" y2="6"/><line x1="8" y1="12" x2="21" y2="12"/>
-							<line x1="8" y1="18" x2="21" y2="18"/><line x1="3" y1="6" x2="3.01" y2="6"/>
-							<line x1="3" y1="12" x2="3.01" y2="12"/><line x1="3" y1="18" x2="3.01" y2="18"/>
+						<svg
+							class="w-3.5 h-3.5"
+							viewBox="0 0 24 24"
+							fill="none"
+							stroke="currentColor"
+							stroke-width="2"
+							stroke-linecap="round"
+							stroke-linejoin="round"
+						>
+							<line x1="8" y1="6" x2="21" y2="6" /><line x1="8" y1="12" x2="21" y2="12" />
+							<line x1="8" y1="18" x2="21" y2="18" /><line x1="3" y1="6" x2="3.01" y2="6" />
+							<line x1="3" y1="12" x2="3.01" y2="12" /><line x1="3" y1="18" x2="3.01" y2="18" />
 						</svg>
 					</button>
 				</div>
 			</div>
 		{/if}
 
-		<div class={layoutMode === 'grid' || editMode ? 'grid gap-4 sm:grid-cols-2' : 'flex flex-col gap-2'}>
+		<div
+			class={layoutMode === 'grid' || editMode
+				? 'grid gap-4 sm:grid-cols-2'
+				: 'flex flex-col gap-2'}
+		>
 			{#each filteredProjects as project (project.id)}
 				{@const isSelected = selectedIds.has(project.id)}
 				{#if editMode}
@@ -599,7 +639,9 @@
 					<div class="flex items-center gap-3 mb-4">
 						<div class="w-8 h-8 bg-status-blocked/20 rounded-lg flex items-center justify-center">
 							<svg class="w-4 h-4 text-status-blocked" viewBox="0 0 24 24" fill="currentColor">
-								<path d="M12 2C6.48 2 2 6.48 2 12s4.48 10 10 10 10-4.48 10-10S17.52 2 12 2zm1 15h-2v-2h2v2zm0-4h-2V7h2v6z" />
+								<path
+									d="M12 2C6.48 2 2 6.48 2 12s4.48 10 10 10 10-4.48 10-10S17.52 2 12 2zm1 15h-2v-2h2v2zm0-4h-2V7h2v6z"
+								/>
 							</svg>
 						</div>
 						<h3 class="text-sm font-semibold text-text-primary">Orphaned Projects</h3>
@@ -623,7 +665,9 @@
 					<div class="flex items-center gap-3 mb-4">
 						<div class="w-8 h-8 bg-primary-600/20 rounded-lg flex items-center justify-center">
 							<svg class="w-4 h-4 text-primary-400" viewBox="0 0 24 24" fill="currentColor">
-								<path d="M13 3c-4.97 0-9 4.03-9 9H1l3.89 3.89.07.14L9 12H6c0-3.87 3.13-7 7-7s7 3.13 7 7-3.13 7-7 7c-1.93 0-3.68-.79-4.94-2.06l-1.42 1.42C8.27 19.99 10.51 21 13 21c4.97 0 9-4.03 9-9s-4.03-9-9-9zm-1 5v5l4.28 2.54.72-1.21-3.5-2.08V8H12z" />
+								<path
+									d="M13 3c-4.97 0-9 4.03-9 9H1l3.89 3.89.07.14L9 12H6c0-3.87 3.13-7 7-7s7 3.13 7 7-3.13 7-7 7c-1.93 0-3.68-.79-4.94-2.06l-1.42 1.42C8.27 19.99 10.51 21 13 21c4.97 0 9-4.03 9-9s-4.03-9-9-9zm-1 5v5l4.28 2.54.72-1.21-3.5-2.08V8H12z"
+								/>
 							</svg>
 						</div>
 						<h3 class="text-sm font-semibold text-text-primary">Most Active Paths</h3>
@@ -654,7 +698,9 @@
 					<div class="flex items-center gap-3 mb-4">
 						<div class="w-8 h-8 bg-green-600/20 rounded-lg flex items-center justify-center">
 							<svg class="w-4 h-4 text-green-400" viewBox="0 0 24 24" fill="currentColor">
-								<path d="M20 18c1.1 0 2-.9 2-2V6c0-1.1-.9-2-2-2H4c-1.1 0-2 .9-2 2v10c0 1.1.9 2 2 2H0v2h24v-2h-4zM4 6h16v10H4V6z" />
+								<path
+									d="M20 18c1.1 0 2-.9 2-2V6c0-1.1-.9-2-2-2H4c-1.1 0-2 .9-2 2v10c0 1.1.9 2 2 2H0v2h24v-2h-4zM4 6h16v10H4V6z"
+								/>
 							</svg>
 						</div>
 						<h3 class="text-sm font-semibold text-text-primary">Host Distribution</h3>
@@ -666,9 +712,14 @@
 						<ul class="space-y-2">
 							{#each hostDistribution as [host, count]}
 								<li class="flex items-center justify-between gap-2 min-w-0">
-									<span class="text-xs text-text-secondary truncate min-w-0 flex-1" title={host}>{host}</span>
+									<span class="text-xs text-text-secondary truncate min-w-0 flex-1" title={host}
+										>{host}</span
+									>
 									<div class="flex items-center gap-2 shrink-0">
-										<div class="h-2 bg-primary-600/30 rounded-full" style="width: {Math.max(Math.round((count / maxCount) * 60), 8)}px"></div>
+										<div
+											class="h-2 bg-primary-600/30 rounded-full"
+											style="width: {Math.max(Math.round((count / maxCount) * 60), 8)}px"
+										></div>
 										<span class="text-xs font-mono text-text-muted w-4 text-right">{count}</span>
 									</div>
 								</li>
@@ -709,14 +760,23 @@
 	<dialog
 		class="dialog-modal"
 		open
-		onclick={(e) => { if (e.target === e.currentTarget && !merging) cancelMerge(); }}
-		onkeydown={(e) => { if (e.key === 'Escape' && !merging) { e.preventDefault(); cancelMerge(); } }}
+		onclick={(e) => {
+			if (e.target === e.currentTarget && !merging) cancelMerge();
+		}}
+		onkeydown={(e) => {
+			if (e.key === 'Escape' && !merging) {
+				e.preventDefault();
+				cancelMerge();
+			}
+		}}
 	>
 		<div class="dialog-content animate-dialog-in">
 			{#if mergeResult}
 				<!-- Success state -->
 				<div class="flex items-start gap-4 mb-6">
-					<div class="shrink-0 w-11 h-11 rounded-lg flex items-center justify-center bg-status-open/20">
+					<div
+						class="shrink-0 w-11 h-11 rounded-lg flex items-center justify-center bg-status-open/20"
+					>
 						<svg class="w-5 h-5 text-status-open" viewBox="0 0 24 24" fill="currentColor">
 							<path d="M9 16.2L4.8 12l-1.4 1.4L9 19 21 7l-1.4-1.4L9 16.2z" />
 						</svg>
@@ -724,7 +784,10 @@
 					<div class="flex-1 min-w-0">
 						<h2 class="text-lg font-semibold text-text-primary">Merge complete</h2>
 						<p class="text-sm text-text-secondary mt-1">
-							Moved {mergeResult.issues_moved} {mergeResult.issues_moved === 1 ? 'issue' : 'issues'} and {mergeResult.plans_moved} {mergeResult.plans_moved === 1 ? 'plan' : 'plans'} into <strong>{mergeResult.target_project.name}</strong>.
+							Moved {mergeResult.issues_moved}
+							{mergeResult.issues_moved === 1 ? 'issue' : 'issues'} and {mergeResult.plans_moved}
+							{mergeResult.plans_moved === 1 ? 'plan' : 'plans'} into
+							<strong>{mergeResult.target_project.name}</strong>.
 						</p>
 					</div>
 				</div>
@@ -737,15 +800,20 @@
 			{:else}
 				<!-- Merge form -->
 				<div class="flex items-start gap-4 mb-6">
-					<div class="shrink-0 w-11 h-11 rounded-lg flex items-center justify-center bg-primary-600/20">
+					<div
+						class="shrink-0 w-11 h-11 rounded-lg flex items-center justify-center bg-primary-600/20"
+					>
 						<svg class="w-5 h-5 text-primary-400" viewBox="0 0 24 24" fill="currentColor">
-							<path d="M17 20.41L18.41 19 15 15.59 13.59 17 17 20.41zM7.5 8H11v5.59L5.59 19 7 20.41l6-6V8h3.5L12 3.5 7.5 8z" />
+							<path
+								d="M17 20.41L18.41 19 15 15.59 13.59 17 17 20.41zM7.5 8H11v5.59L5.59 19 7 20.41l6-6V8h3.5L12 3.5 7.5 8z"
+							/>
 						</svg>
 					</div>
 					<div class="flex-1 min-w-0">
 						<h2 class="text-lg font-semibold text-text-primary">Merge projects</h2>
 						<p class="text-sm text-text-secondary mt-1">
-							Move all issues and plans from the selected projects into a target project. The source projects will be deleted.
+							Move all issues and plans from the selected projects into a target project. The source
+							projects will be deleted.
 						</p>
 					</div>
 				</div>
@@ -753,11 +821,17 @@
 				<!-- Source projects list -->
 				<div class="mb-4">
 					<div class="text-xs font-medium text-text-muted uppercase tracking-wider mb-2">
-						{projectsToMerge.length === 1 ? 'Project to merge' : `${projectsToMerge.length} projects to merge`}
+						{projectsToMerge.length === 1
+							? 'Project to merge'
+							: `${projectsToMerge.length} projects to merge`}
 					</div>
-					<div class="bg-surface-900 border border-border-subtle rounded-md max-h-40 overflow-y-auto">
+					<div
+						class="bg-surface-900 border border-border-subtle rounded-md max-h-40 overflow-y-auto"
+					>
 						{#each projectsToMerge as ws (ws.id)}
-							<div class="px-3 py-2 text-sm font-mono text-text-primary border-b border-border-subtle last:border-b-0">
+							<div
+								class="px-3 py-2 text-sm font-mono text-text-primary border-b border-border-subtle last:border-b-0"
+							>
 								{ws.name}
 							</div>
 						{/each}
@@ -766,23 +840,34 @@
 
 				<!-- Target project select -->
 				<div class="mb-6">
-					<label class="block text-xs font-medium text-text-muted uppercase tracking-wider mb-2" for="merge-target">
+					<label
+						class="block text-xs font-medium text-text-muted uppercase tracking-wider mb-2"
+						for="merge-target"
+					>
 						Merge into
 					</label>
 					<Select
 						options={targetOptions}
 						value={mergeTargetId}
 						placeholder="Select target project..."
-						onchange={(v) => { mergeTargetId = v; }}
+						onchange={(v) => {
+							mergeTargetId = v;
+						}}
 					/>
 				</div>
 
 				<!-- Warning -->
-				<div class="flex items-center gap-2 p-3 bg-priority-high/10 border border-priority-high/20 rounded-md mb-6">
+				<div
+					class="flex items-center gap-2 p-3 bg-priority-high/10 border border-priority-high/20 rounded-md mb-6"
+				>
 					<svg class="w-4 h-4 text-priority-high shrink-0" viewBox="0 0 24 24" fill="currentColor">
-						<path d="M12 2C6.48 2 2 6.48 2 12s4.48 10 10 10 10-4.48 10-10S17.52 2 12 2zm1 15h-2v-2h2v2zm0-4h-2V7h2v6z" />
+						<path
+							d="M12 2C6.48 2 2 6.48 2 12s4.48 10 10 10 10-4.48 10-10S17.52 2 12 2zm1 15h-2v-2h2v2zm0-4h-2V7h2v6z"
+						/>
 					</svg>
-					<span class="text-xs text-priority-high">Source projects will be permanently deleted after merge</span>
+					<span class="text-xs text-priority-high"
+						>Source projects will be permanently deleted after merge</span
+					>
 				</div>
 
 				<!-- Actions -->
@@ -798,8 +883,19 @@
 					>
 						{#if merging}
 							<svg class="w-4 h-4 animate-spin" viewBox="0 0 24 24" fill="none">
-								<circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4"></circle>
-								<path class="opacity-75" fill="currentColor" d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"></path>
+								<circle
+									class="opacity-25"
+									cx="12"
+									cy="12"
+									r="10"
+									stroke="currentColor"
+									stroke-width="4"
+								></circle>
+								<path
+									class="opacity-75"
+									fill="currentColor"
+									d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"
+								></path>
 							</svg>
 							Merging...
 						{:else}
@@ -816,20 +912,35 @@
 	<!-- Header: NAME | ID + path count -->
 	<div class="flex items-center justify-between mb-2.5">
 		<div class="flex items-baseline min-w-0 overflow-hidden">
-			<h3 class="text-[1.3rem] font-bold text-primary-400 group-hover:text-primary-300 transition-colors whitespace-nowrap uppercase tracking-wide">
+			<h3
+				class="text-[1.3rem] font-bold text-primary-400 group-hover:text-primary-300 transition-colors whitespace-nowrap uppercase tracking-wide"
+			>
 				{project.name}
 			</h3>
 			<span class="w-px h-4 bg-surface-500/60 mx-2.5 shrink-0 self-center"></span>
-			<span class="font-mono text-[0.7rem] font-medium text-accent-400 whitespace-nowrap opacity-85">
+			<span
+				class="font-mono text-[0.7rem] font-medium text-accent-400 whitespace-nowrap opacity-85"
+			>
 				{project.id}
 			</span>
 		</div>
 		{#if pathCounts[project.id] !== undefined && pathCounts[project.id] > 0}
-			<span class="inline-flex items-center gap-1 px-2 py-0.5 rounded-full text-[0.65rem] font-semibold bg-surface-700 text-text-muted border border-border-subtle shrink-0 ml-2 group-hover:bg-surface-600 group-hover:text-text-secondary transition-colors">
-				<svg class="w-2.5 h-2.5 opacity-70" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round">
-					<path d="M22 19a2 2 0 01-2 2H4a2 2 0 01-2-2V5a2 2 0 012-2h5l2 3h9a2 2 0 012 2z"/>
+			<span
+				class="inline-flex items-center gap-1 px-2 py-0.5 rounded-full text-[0.65rem] font-semibold bg-surface-700 text-text-muted border border-border-subtle shrink-0 ml-2 group-hover:bg-surface-600 group-hover:text-text-secondary transition-colors"
+			>
+				<svg
+					class="w-2.5 h-2.5 opacity-70"
+					viewBox="0 0 24 24"
+					fill="none"
+					stroke="currentColor"
+					stroke-width="2.5"
+					stroke-linecap="round"
+					stroke-linejoin="round"
+				>
+					<path d="M22 19a2 2 0 01-2 2H4a2 2 0 01-2-2V5a2 2 0 012-2h5l2 3h9a2 2 0 012 2z" />
 				</svg>
-				{pathCounts[project.id]} {pathCounts[project.id] === 1 ? 'workspace' : 'workspaces'}
+				{pathCounts[project.id]}
+				{pathCounts[project.id] === 1 ? 'workspace' : 'workspaces'}
 			</span>
 		{/if}
 	</div>
@@ -876,8 +987,13 @@
 			{#if pathsLoading.has(project.id)}
 				<div class="flex items-center gap-2 text-xs text-text-muted py-2">
 					<svg class="w-3 h-3 animate-spin" viewBox="0 0 24 24" fill="none">
-						<circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4"></circle>
-						<path class="opacity-75" fill="currentColor" d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"></path>
+						<circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4"
+						></circle>
+						<path
+							class="opacity-75"
+							fill="currentColor"
+							d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"
+						></path>
 					</svg>
 					Loading paths...
 				</div>
@@ -897,7 +1013,10 @@
 						<tbody>
 							{#each workspacePaths[project.id] ?? [] as wp (wp.id)}
 								<tr class="border-t border-border-subtle hover:bg-surface-800/50">
-									<td class="px-2 py-1.5 font-mono text-text-primary truncate max-w-[200px]" title={wp.path}>{wp.path}</td>
+									<td
+										class="px-2 py-1.5 font-mono text-text-primary truncate max-w-[200px]"
+										title={wp.path}>{wp.path}</td
+									>
 									<td class="px-2 py-1.5 text-text-secondary">{wp.label ?? '-'}</td>
 									<td class="px-2 py-1.5 text-text-secondary">{wp.hostname ?? '-'}</td>
 									<td class="px-2 py-1.5 text-text-secondary">{formatDate(wp.last_accessed_at)}</td>
@@ -915,11 +1034,15 @@
 	<!-- List mode: two-line compact row -->
 	<div class="flex-1 min-w-0 flex flex-col gap-0.5">
 		<div class="flex items-baseline min-w-0">
-			<h3 class="text-sm font-bold text-primary-400 group-hover:text-primary-300 transition-colors truncate uppercase tracking-wide min-w-0">
+			<h3
+				class="text-sm font-bold text-primary-400 group-hover:text-primary-300 transition-colors truncate uppercase tracking-wide min-w-0"
+			>
 				{project.name}
 			</h3>
 			<span class="w-px h-3.5 bg-surface-500/60 mx-2 shrink-0 self-center"></span>
-			<span class="font-mono text-[0.65rem] font-medium text-accent-400 whitespace-nowrap shrink-0 opacity-85">
+			<span
+				class="font-mono text-[0.65rem] font-medium text-accent-400 whitespace-nowrap shrink-0 opacity-85"
+			>
 				{project.id}
 			</span>
 		</div>
@@ -930,8 +1053,16 @@
 	<div class="flex items-center gap-3 shrink-0">
 		{#if pathCounts[project.id] !== undefined && pathCounts[project.id] > 0}
 			<span class="inline-flex items-center gap-1 text-[0.65rem] font-medium text-text-muted">
-				<svg class="w-2.5 h-2.5 opacity-70" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round">
-					<path d="M22 19a2 2 0 01-2 2H4a2 2 0 01-2-2V5a2 2 0 012-2h5l2 3h9a2 2 0 012 2z"/>
+				<svg
+					class="w-2.5 h-2.5 opacity-70"
+					viewBox="0 0 24 24"
+					fill="none"
+					stroke="currentColor"
+					stroke-width="2.5"
+					stroke-linecap="round"
+					stroke-linejoin="round"
+				>
+					<path d="M22 19a2 2 0 01-2 2H4a2 2 0 01-2-2V5a2 2 0 012-2h5l2 3h9a2 2 0 012 2z" />
 				</svg>
 				{pathCounts[project.id]}
 			</span>
diff --git a/web/src/routes/[projectId]/+page.svelte b/web/src/routes/[projectId]/+page.svelte
index 391d3dd..47dc174 100644
--- a/web/src/routes/[projectId]/+page.svelte
+++ b/web/src/routes/[projectId]/+page.svelte
@@ -72,9 +72,7 @@
 		renameError = '';
 		try {
 			const updated = await updateProject(projectId!, { name: trimmed });
-			projects.update((list) =>
-				list.map((p) => (p.id === updated.id ? updated : p))
-			);
+			projects.update((list) => list.map((p) => (p.id === updated.id ? updated : p)));
 			renameEditing = false;
 		} catch (err) {
 			renameError = err instanceof Error ? err.message : 'Failed to rename project';
@@ -84,8 +82,14 @@
 	}
 
 	function handleRenameKeydown(e: KeyboardEvent) {
-		if (e.key === 'Enter') { e.preventDefault(); saveRename(); }
-		if (e.key === 'Escape') { e.preventDefault(); cancelRename(); }
+		if (e.key === 'Enter') {
+			e.preventDefault();
+			saveRename();
+		}
+		if (e.key === 'Escape') {
+			e.preventDefault();
+			cancelRename();
+		}
 	}
 
 	function handleRenameBlur(e: FocusEvent) {
@@ -118,9 +122,7 @@
 
 	// Merge source options: all projects except current
 	const mergeSourceOptions = $derived.by(() => {
-		return $projects
-			.filter((p) => p.id !== projectId)
-			.map((p) => ({ value: p.id, label: p.name }));
+		return $projects.filter((p) => p.id !== projectId).map((p) => ({ value: p.id, label: p.name }));
 	});
 
 	// Load stats when project changes
@@ -325,7 +327,7 @@
 </script>
 
 {#if project}
-	<Header project={project} actions={headerActions} onaction={handleHeaderAction} />
+	<Header {project} actions={headerActions} onaction={handleHeaderAction} />
 
 	<div class="flex-1 p-8 animate-fade-in">
 		<header class="mb-8">
@@ -369,10 +371,14 @@
 				<div class="flex items-center justify-between mb-3">
 					<div class="flex items-center gap-3">
 						<svg class="w-5 h-5 text-text-muted" viewBox="0 0 24 24" fill="currentColor">
-							<path d="M10 4H4c-1.1 0-1.99.9-1.99 2L2 18c0 1.1.9 2 2 2h16c1.1 0 2-.9 2-2V8c0-1.1-.9-2-2-2h-8l-2-2z" />
+							<path
+								d="M10 4H4c-1.1 0-1.99.9-1.99 2L2 18c0 1.1.9 2 2 2h16c1.1 0 2-.9 2-2V8c0-1.1-.9-2-2-2h-8l-2-2z"
+							/>
 						</svg>
 						<h2 class="text-lg font-semibold text-text-primary">Paths</h2>
-						<span class="inline-flex items-center px-2 py-0.5 rounded-full text-xs font-medium bg-surface-700 text-text-muted">
+						<span
+							class="inline-flex items-center px-2 py-0.5 rounded-full text-xs font-medium bg-surface-700 text-text-muted"
+						>
 							{paths.length}
 						</span>
 					</div>
@@ -381,20 +387,32 @@
 				{#if pathsLoading}
 					<div class="flex items-center gap-2 text-sm text-text-muted py-4">
 						<svg class="w-4 h-4 animate-spin" viewBox="0 0 24 24" fill="none">
-							<circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4"></circle>
-							<path class="opacity-75" fill="currentColor" d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"></path>
+							<circle
+								class="opacity-25"
+								cx="12"
+								cy="12"
+								r="10"
+								stroke="currentColor"
+								stroke-width="4"
+							></circle>
+							<path
+								class="opacity-75"
+								fill="currentColor"
+								d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"
+							></path>
 						</svg>
 						Loading paths...
 					</div>
 				{:else if paths.length === 0}
 					<div class="bg-surface-900 border border-border-subtle rounded-lg p-6 text-center">
-						<p class="text-sm text-text-muted font-mono">
-							No paths registered
-						</p>
+						<p class="text-sm text-text-muted font-mono">No paths registered</p>
 						<button
 							type="button"
 							class="mt-3 text-sm text-primary-400 hover:text-primary-300 transition-colors"
-							onclick={() => { managingPaths = true; addPathOpen = true; }}
+							onclick={() => {
+								managingPaths = true;
+								addPathOpen = true;
+							}}
 						>
 							+ Add a path
 						</button>
@@ -402,9 +420,21 @@
 				{:else}
 					<!-- Terminal-style table matching `arc paths` output -->
 					<div class="bg-surface-900 border border-border-subtle rounded-lg overflow-x-auto">
-						<pre class="font-mono text-xs leading-relaxed p-4 text-text-primary whitespace-pre"><span class="text-text-muted">{padRight('PATH', pathColumns.pathW)}  LABEL</span>
-<span class="text-text-muted/50">{makeSeparator(pathColumns.pathW)}  {makeSeparator(pathColumns.labelW)}</span>
-{#each groupedPaths as entry, i}{#if i > 0}{'\n'}{/if}{#if entry.isSymlink}<span class="text-text-muted">  {padRight('\u2192 ' + entry.path, pathColumns.pathW - 2)}  {entry.label}</span>{:else}{padRight(entry.path, pathColumns.pathW)}  <span class="text-text-secondary">{entry.label}</span>{/if}{/each}</pre>
+						<pre
+							class="font-mono text-xs leading-relaxed p-4 text-text-primary whitespace-pre"><span
+								class="text-text-muted">{padRight('PATH', pathColumns.pathW)}  LABEL</span
+							>
+<span class="text-text-muted/50"
+								>{makeSeparator(pathColumns.pathW)}  {makeSeparator(pathColumns.labelW)}</span
+							>
+{#each groupedPaths as entry, i}{#if i > 0}{'\n'}{/if}{#if entry.isSymlink}<span
+										class="text-text-muted">  {padRight(
+											'\u2192 ' + entry.path,
+											pathColumns.pathW - 2
+										)}  {entry.label}</span
+									>{:else}{padRight(entry.path, pathColumns.pathW)}  <span
+										class="text-text-secondary">{entry.label}</span
+									>{/if}{/each}</pre>
 					</div>
 				{/if}
 
@@ -413,7 +443,10 @@
 					<button
 						type="button"
 						class="flex items-center gap-2 text-sm text-text-muted hover:text-text-secondary transition-colors group"
-						onclick={() => { managingPaths = !managingPaths; if (!managingPaths) addPathOpen = false; }}
+						onclick={() => {
+							managingPaths = !managingPaths;
+							if (!managingPaths) addPathOpen = false;
+						}}
 					>
 						<svg
 							class="w-4 h-4 transition-transform {managingPaths ? 'rotate-90' : ''}"
@@ -423,7 +456,9 @@
 							<path d="M10 6L8.59 7.41 13.17 12l-4.58 4.59L10 18l6-6z" />
 						</svg>
 						<svg class="w-4 h-4" viewBox="0 0 24 24" fill="currentColor">
-							<path d="M3 17.25V21h3.75L17.81 9.94l-3.75-3.75L3 17.25zM20.71 7.04c.39-.39.39-1.02 0-1.41l-2.34-2.34c-.39-.39-1.02-.39-1.41 0l-1.83 1.83 3.75 3.75 1.83-1.83z" />
+							<path
+								d="M3 17.25V21h3.75L17.81 9.94l-3.75-3.75L3 17.25zM20.71 7.04c.39-.39.39-1.02 0-1.41l-2.34-2.34c-.39-.39-1.02-.39-1.41 0l-1.83 1.83 3.75 3.75 1.83-1.83z"
+							/>
 						</svg>
 						Manage paths
 					</button>
@@ -433,11 +468,27 @@
 							<div class="card p-5">
 								<!-- Editable path list with delete buttons — terminal-style -->
 								{#if paths.length > 0}
-									<div class="bg-surface-900 border border-border-subtle rounded-md overflow-x-auto mb-4">
+									<div
+										class="bg-surface-900 border border-border-subtle rounded-md overflow-x-auto mb-4"
+									>
 										<div class="flex">
-											<pre class="font-mono text-xs leading-relaxed p-4 text-text-primary whitespace-pre flex-1"><span class="text-text-muted">{padRight('PATH', pathColumns.pathW)}  LABEL</span>
-<span class="text-text-muted/50">{makeSeparator(pathColumns.pathW)}  {makeSeparator(pathColumns.labelW)}</span>
-{#each groupedPaths as entry, i}{#if i > 0}{'\n'}{/if}{#if entry.isSymlink}<span class="text-text-muted">  {padRight('\u2192 ' + entry.path, pathColumns.pathW - 2)}  {entry.label}</span>{:else}{padRight(entry.path, pathColumns.pathW)}  <span class="text-text-secondary">{entry.label}</span>{/if}{/each}</pre>
+											<pre
+												class="font-mono text-xs leading-relaxed p-4 text-text-primary whitespace-pre flex-1"><span
+													class="text-text-muted">{padRight('PATH', pathColumns.pathW)}  LABEL</span
+												>
+<span class="text-text-muted/50"
+													>{makeSeparator(pathColumns.pathW)}  {makeSeparator(
+														pathColumns.labelW
+													)}</span
+												>
+{#each groupedPaths as entry, i}{#if i > 0}{'\n'}{/if}{#if entry.isSymlink}<span
+															class="text-text-muted">  {padRight(
+																'\u2192 ' + entry.path,
+																pathColumns.pathW - 2
+															)}  {entry.label}</span
+														>{:else}{padRight(entry.path, pathColumns.pathW)}  <span
+															class="text-text-secondary">{entry.label}</span
+														>{/if}{/each}</pre>
 											<div class="flex flex-col pt-4 pr-3" style="padding-top: calc(1rem + 2lh);">
 												{#each groupedPaths as entry (entry.id)}
 													<div class="flex items-center justify-center" style="height: 1lh;">
@@ -448,7 +499,9 @@
 															onclick={() => confirmDeletePathAction(entry.id, entry.path)}
 														>
 															<svg class="w-3.5 h-3.5" viewBox="0 0 24 24" fill="currentColor">
-																<path d="M6 19c0 1.1.9 2 2 2h8c1.1 0 2-.9 2-2V7H6v12zM8 9h8v10H8V9zm7.5-5l-1-1h-5l-1 1H5v2h14V4h-3.5z" />
+																<path
+																	d="M6 19c0 1.1.9 2 2 2h8c1.1 0 2-.9 2-2V7H6v12zM8 9h8v10H8V9zm7.5-5l-1-1h-5l-1 1H5v2h14V4h-3.5z"
+																/>
 															</svg>
 														</button>
 													</div>
@@ -472,21 +525,31 @@
 									</button>
 								{:else}
 									<!-- Add path form -->
-									<div class="bg-surface-800 border border-border-subtle rounded-lg p-4 animate-fade-in">
-										<h4 class="text-xs font-medium text-text-muted uppercase tracking-wider mb-3">Add a directory path</h4>
+									<div
+										class="bg-surface-800 border border-border-subtle rounded-lg p-4 animate-fade-in"
+									>
+										<h4 class="text-xs font-medium text-text-muted uppercase tracking-wider mb-3">
+											Add a directory path
+										</h4>
 
 										<!-- Mode toggle -->
 										<div class="flex gap-1 mb-4 p-1 bg-surface-900 rounded-lg w-fit">
 											<button
 												type="button"
-												class="px-3 py-1.5 text-xs font-medium rounded-md transition-colors {addPathMode === 'browse' ? 'bg-surface-600 text-text-primary' : 'text-text-muted hover:text-text-secondary'}"
+												class="px-3 py-1.5 text-xs font-medium rounded-md transition-colors {addPathMode ===
+												'browse'
+													? 'bg-surface-600 text-text-primary'
+													: 'text-text-muted hover:text-text-secondary'}"
 												onclick={() => (addPathMode = 'browse')}
 											>
 												Browse
 											</button>
 											<button
 												type="button"
-												class="px-3 py-1.5 text-xs font-medium rounded-md transition-colors {addPathMode === 'manual' ? 'bg-surface-600 text-text-primary' : 'text-text-muted hover:text-text-secondary'}"
+												class="px-3 py-1.5 text-xs font-medium rounded-md transition-colors {addPathMode ===
+												'manual'
+													? 'bg-surface-600 text-text-primary'
+													: 'text-text-muted hover:text-text-secondary'}"
 												onclick={() => (addPathMode = 'manual')}
 											>
 												Manual
@@ -497,10 +560,16 @@
 											<FilesystemBrowser onSelect={handleBrowseSelect} />
 											{#if selectedPath}
 												<div class="mt-3 flex items-center gap-2 p-2 bg-surface-900 rounded-lg">
-													<svg class="w-4 h-4 text-primary-400 flex-shrink-0" viewBox="0 0 24 24" fill="currentColor">
+													<svg
+														class="w-4 h-4 text-primary-400 flex-shrink-0"
+														viewBox="0 0 24 24"
+														fill="currentColor"
+													>
 														<path d="M9 16.2L4.8 12l-1.4 1.4L9 19 21 7l-1.4-1.4L9 16.2z" />
 													</svg>
-													<span class="text-sm font-mono text-text-primary truncate">{selectedPath}</span>
+													<span class="text-sm font-mono text-text-primary truncate"
+														>{selectedPath}</span
+													>
 												</div>
 											{/if}
 										{:else}
@@ -540,8 +609,19 @@
 											>
 												{#if addingPath}
 													<svg class="w-3 h-3 animate-spin" viewBox="0 0 24 24" fill="none">
-														<circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4"></circle>
-														<path class="opacity-75" fill="currentColor" d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"></path>
+														<circle
+															class="opacity-25"
+															cx="12"
+															cy="12"
+															r="10"
+															stroke="currentColor"
+															stroke-width="4"
+														></circle>
+														<path
+															class="opacity-75"
+															fill="currentColor"
+															d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"
+														></path>
 													</svg>
 													Adding...
 												{:else}
@@ -672,14 +752,23 @@
 	<dialog
 		class="dialog-modal"
 		open
-		onclick={(e) => { if (e.target === e.currentTarget && !merging) cancelMerge(); }}
-		onkeydown={(e) => { if (e.key === 'Escape' && !merging) { e.preventDefault(); cancelMerge(); } }}
+		onclick={(e) => {
+			if (e.target === e.currentTarget && !merging) cancelMerge();
+		}}
+		onkeydown={(e) => {
+			if (e.key === 'Escape' && !merging) {
+				e.preventDefault();
+				cancelMerge();
+			}
+		}}
 	>
 		<div class="dialog-content animate-dialog-in">
 			{#if mergeResult}
 				<!-- Success state -->
 				<div class="flex items-start gap-4 mb-6">
-					<div class="shrink-0 w-11 h-11 rounded-lg flex items-center justify-center bg-status-open/20">
+					<div
+						class="shrink-0 w-11 h-11 rounded-lg flex items-center justify-center bg-status-open/20"
+					>
 						<svg class="w-5 h-5 text-status-open" viewBox="0 0 24 24" fill="currentColor">
 							<path d="M9 16.2L4.8 12l-1.4 1.4L9 19 21 7l-1.4-1.4L9 16.2z" />
 						</svg>
@@ -687,7 +776,10 @@
 					<div class="flex-1 min-w-0">
 						<h2 class="text-lg font-semibold text-text-primary">Merge complete</h2>
 						<p class="text-sm text-text-secondary mt-1">
-							Moved {mergeResult.issues_moved} {mergeResult.issues_moved === 1 ? 'issue' : 'issues'} and {mergeResult.plans_moved} {mergeResult.plans_moved === 1 ? 'plan' : 'plans'} into <strong>{project?.name}</strong>.
+							Moved {mergeResult.issues_moved}
+							{mergeResult.issues_moved === 1 ? 'issue' : 'issues'} and {mergeResult.plans_moved}
+							{mergeResult.plans_moved === 1 ? 'plan' : 'plans'} into
+							<strong>{project?.name}</strong>.
 						</p>
 					</div>
 				</div>
@@ -700,15 +792,20 @@
 			{:else}
 				<!-- Merge form -->
 				<div class="flex items-start gap-4 mb-6">
-					<div class="shrink-0 w-11 h-11 rounded-lg flex items-center justify-center bg-primary-600/20">
+					<div
+						class="shrink-0 w-11 h-11 rounded-lg flex items-center justify-center bg-primary-600/20"
+					>
 						<svg class="w-5 h-5 text-primary-400" viewBox="0 0 24 24" fill="currentColor">
-							<path d="M17 20.41L18.41 19 15 15.59 13.59 17 17 20.41zM7.5 8H11v5.59L5.59 19 7 20.41l6-6V8h3.5L12 3.5 7.5 8z" />
+							<path
+								d="M17 20.41L18.41 19 15 15.59 13.59 17 17 20.41zM7.5 8H11v5.59L5.59 19 7 20.41l6-6V8h3.5L12 3.5 7.5 8z"
+							/>
 						</svg>
 					</div>
 					<div class="flex-1 min-w-0">
 						<h2 class="text-lg font-semibold text-text-primary">Merge into {project?.name}</h2>
 						<p class="text-sm text-text-secondary mt-1">
-							Select projects to merge into this one. All issues and plans will be moved here. The source projects will be deleted.
+							Select projects to merge into this one. All issues and plans will be moved here. The
+							source projects will be deleted.
 						</p>
 					</div>
 				</div>
@@ -718,12 +815,16 @@
 					<div class="text-xs font-medium text-text-muted uppercase tracking-wider mb-2">
 						Select projects to merge
 					</div>
-					<div class="bg-surface-900 border border-border-subtle rounded-md max-h-60 overflow-y-auto">
+					<div
+						class="bg-surface-900 border border-border-subtle rounded-md max-h-60 overflow-y-auto"
+					>
 						{#each mergeSourceOptions as option (option.value)}
 							{@const isSelected = selectedMergeSources.includes(option.value)}
 							<button
 								type="button"
-								class="w-full flex items-center gap-3 px-3 py-2.5 text-sm text-left border-b border-border-subtle last:border-b-0 transition-colors {isSelected ? 'bg-primary-600/10 text-text-primary' : 'text-text-secondary hover:bg-surface-800'}"
+								class="w-full flex items-center gap-3 px-3 py-2.5 text-sm text-left border-b border-border-subtle last:border-b-0 transition-colors {isSelected
+									? 'bg-primary-600/10 text-text-primary'
+									: 'text-text-secondary hover:bg-surface-800'}"
 								onclick={() => toggleMergeSource(option.value)}
 							>
 								<input
@@ -738,17 +839,29 @@
 						{/each}
 					</div>
 					{#if selectedMergeSources.length > 0}
-						<p class="text-xs text-text-muted mt-2">{selectedMergeSources.length} project{selectedMergeSources.length === 1 ? '' : 's'} selected</p>
+						<p class="text-xs text-text-muted mt-2">
+							{selectedMergeSources.length} project{selectedMergeSources.length === 1 ? '' : 's'} selected
+						</p>
 					{/if}
 				</div>
 
 				<!-- Warning -->
 				{#if selectedMergeSources.length > 0}
-					<div class="flex items-center gap-2 p-3 bg-priority-high/10 border border-priority-high/20 rounded-md mb-6">
-						<svg class="w-4 h-4 text-priority-high shrink-0" viewBox="0 0 24 24" fill="currentColor">
-							<path d="M12 2C6.48 2 2 6.48 2 12s4.48 10 10 10 10-4.48 10-10S17.52 2 12 2zm1 15h-2v-2h2v2zm0-4h-2V7h2v6z" />
+					<div
+						class="flex items-center gap-2 p-3 bg-priority-high/10 border border-priority-high/20 rounded-md mb-6"
+					>
+						<svg
+							class="w-4 h-4 text-priority-high shrink-0"
+							viewBox="0 0 24 24"
+							fill="currentColor"
+						>
+							<path
+								d="M12 2C6.48 2 2 6.48 2 12s4.48 10 10 10 10-4.48 10-10S17.52 2 12 2zm1 15h-2v-2h2v2zm0-4h-2V7h2v6z"
+							/>
 						</svg>
-						<span class="text-xs text-priority-high">Selected projects will be permanently deleted after merge</span>
+						<span class="text-xs text-priority-high"
+							>Selected projects will be permanently deleted after merge</span
+						>
 					</div>
 				{/if}
 
@@ -765,12 +878,25 @@
 					>
 						{#if merging}
 							<svg class="w-4 h-4 animate-spin" viewBox="0 0 24 24" fill="none">
-								<circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4"></circle>
-								<path class="opacity-75" fill="currentColor" d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"></path>
+								<circle
+									class="opacity-25"
+									cx="12"
+									cy="12"
+									r="10"
+									stroke="currentColor"
+									stroke-width="4"
+								></circle>
+								<path
+									class="opacity-75"
+									fill="currentColor"
+									d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"
+								></path>
 							</svg>
 							Merging...
 						{:else}
-							Merge {selectedMergeSources.length} project{selectedMergeSources.length === 1 ? '' : 's'}
+							Merge {selectedMergeSources.length} project{selectedMergeSources.length === 1
+								? ''
+								: 's'}
 						{/if}
 					</button>
 				</div>
@@ -803,8 +929,19 @@
 						>
 							{#if renameSaving}
 								<svg class="w-3.5 h-3.5 animate-spin" viewBox="0 0 24 24" fill="none">
-									<circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4"></circle>
-									<path class="opacity-75" fill="currentColor" d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"></path>
+									<circle
+										class="opacity-25"
+										cx="12"
+										cy="12"
+										r="10"
+										stroke="currentColor"
+										stroke-width="4"
+									></circle>
+									<path
+										class="opacity-75"
+										fill="currentColor"
+										d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"
+									></path>
 								</svg>
 							{:else}
 								Save
@@ -838,7 +975,9 @@
 				onclick={startRename}
 			>
 				<svg class="w-4 h-4" viewBox="0 0 24 24" fill="currentColor">
-					<path d="M3 17.25V21h3.75L17.81 9.94l-3.75-3.75L3 17.25zM20.71 7.04c.39-.39.39-1.02 0-1.41l-2.34-2.34c-.39-.39-1.02-.39-1.41 0l-1.83 1.83 3.75 3.75 1.83-1.83z" />
+					<path
+						d="M3 17.25V21h3.75L17.81 9.94l-3.75-3.75L3 17.25zM20.71 7.04c.39-.39.39-1.02 0-1.41l-2.34-2.34c-.39-.39-1.02-.39-1.41 0l-1.83 1.83 3.75 3.75 1.83-1.83z"
+					/>
 				</svg>
 			</button>
 		{/if}
diff --git a/web/src/routes/[projectId]/ai/+page.svelte b/web/src/routes/[projectId]/ai/+page.svelte
index 8873dfa..282ba06 100644
--- a/web/src/routes/[projectId]/ai/+page.svelte
+++ b/web/src/routes/[projectId]/ai/+page.svelte
@@ -180,24 +180,14 @@
 					>
 						Cancel
 					</button>
-					<button
-						class="btn btn-sm btn-danger"
-						onclick={handleBatchDelete}
-						disabled={deleting}
-					>
+					<button class="btn btn-sm btn-danger" onclick={handleBatchDelete} disabled={deleting}>
 						{deleting ? 'Deleting...' : `Delete ${selected.size}`}
 					</button>
 				{:else}
-					<button
-						class="btn btn-sm btn-ghost"
-						onclick={() => (selected = new Set())}
-					>
+					<button class="btn btn-sm btn-ghost" onclick={() => (selected = new Set())}>
 						Clear
 					</button>
-					<button
-						class="btn btn-sm btn-danger"
-						onclick={() => (confirmBatchDelete = true)}
-					>
+					<button class="btn btn-sm btn-danger" onclick={() => (confirmBatchDelete = true)}>
 						Delete selected
 					</button>
 				{/if}
@@ -253,7 +243,9 @@
 					{#each sessions as session (session.id)}
 						{@const isSelected = selected.has(session.id)}
 						<tr
-							class="group border-b border-border last:border-0 transition-colors {isSelected ? 'bg-primary-600/10' : 'hover:bg-surface-700/50'}"
+							class="group border-b border-border last:border-0 transition-colors {isSelected
+								? 'bg-primary-600/10'
+								: 'hover:bg-surface-700/50'}"
 						>
 							<td class="px-4 py-3">
 								<input
@@ -273,7 +265,10 @@
 									{truncateId(session.id)}
 								</a>
 							</td>
-							<td class="px-4 py-3 text-sm text-text-secondary" title={formatDate(session.started_at)}>
+							<td
+								class="px-4 py-3 text-sm text-text-secondary"
+								title={formatDate(session.started_at)}
+							>
 								{timeAgo(session.started_at)}
 							</td>
 							<td
@@ -291,7 +286,13 @@
 											disabled={deleting}
 											title="Confirm delete"
 										>
-											<svg class="w-4 h-4" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+											<svg
+												class="w-4 h-4"
+												viewBox="0 0 24 24"
+												fill="none"
+												stroke="currentColor"
+												stroke-width="2"
+											>
 												<polyline points="20 6 9 17 4 12" />
 											</svg>
 										</button>
@@ -301,7 +302,13 @@
 											disabled={deleting}
 											title="Cancel"
 										>
-											<svg class="w-4 h-4" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+											<svg
+												class="w-4 h-4"
+												viewBox="0 0 24 24"
+												fill="none"
+												stroke="currentColor"
+												stroke-width="2"
+											>
 												<line x1="18" y1="6" x2="6" y2="18" />
 												<line x1="6" y1="6" x2="18" y2="18" />
 											</svg>
@@ -313,9 +320,17 @@
 										onclick={() => (confirmDeleteId = session.id)}
 										title="Delete session"
 									>
-										<svg class="w-4 h-4" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+										<svg
+											class="w-4 h-4"
+											viewBox="0 0 24 24"
+											fill="none"
+											stroke="currentColor"
+											stroke-width="2"
+										>
 											<polyline points="3 6 5 6 21 6" />
-											<path d="M19 6v14a2 2 0 0 1-2 2H7a2 2 0 0 1-2-2V6m3 0V4a2 2 0 0 1 2-2h4a2 2 0 0 1 2 2v2" />
+											<path
+												d="M19 6v14a2 2 0 0 1-2 2H7a2 2 0 0 1-2-2V6m3 0V4a2 2 0 0 1 2-2h4a2 2 0 0 1 2 2v2"
+											/>
 										</svg>
 									</button>
 								{/if}
@@ -328,11 +343,7 @@
 			<!-- Pagination footer -->
 			<div class="flex items-center justify-between px-4 py-3 border-t border-border">
 				<div class="flex items-center gap-3">
-					<Select
-						options={PAGE_SIZES}
-						value={pageSize}
-						onchange={handlePageSizeChange}
-					/>
+					<Select options={PAGE_SIZES} value={pageSize} onchange={handlePageSizeChange} />
 					<span class="text-sm text-text-muted">
 						{rangeStart}–{rangeEnd} of {total}
 					</span>
@@ -346,7 +357,13 @@
 							disabled={!hasPrevPage || loading}
 							aria-label="Previous page"
 						>
-							<svg class="w-4 h-4" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+							<svg
+								class="w-4 h-4"
+								viewBox="0 0 24 24"
+								fill="none"
+								stroke="currentColor"
+								stroke-width="2"
+							>
 								<polyline points="15 18 9 12 15 6" />
 							</svg>
 						</button>
@@ -359,7 +376,13 @@
 							disabled={!hasNextPage || loading}
 							aria-label="Next page"
 						>
-							<svg class="w-4 h-4" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+							<svg
+								class="w-4 h-4"
+								viewBox="0 0 24 24"
+								fill="none"
+								stroke="currentColor"
+								stroke-width="2"
+							>
 								<polyline points="9 6 15 12 9 18" />
 							</svg>
 						</button>
diff --git a/web/src/routes/[projectId]/ai/[sessionId]/+page.svelte b/web/src/routes/[projectId]/ai/[sessionId]/+page.svelte
index 6e423f5..8c39dbc 100644
--- a/web/src/routes/[projectId]/ai/[sessionId]/+page.svelte
+++ b/web/src/routes/[projectId]/ai/[sessionId]/+page.svelte
@@ -90,7 +90,10 @@
 		<!-- Header -->
 		<header class="mb-6">
 			<div class="flex items-center gap-2 mb-2">
-				<a href="/{projectId}/ai" class="text-text-muted hover:text-text-primary transition-colors text-sm">
+				<a
+					href="/{projectId}/ai"
+					class="text-text-muted hover:text-text-primary transition-colors text-sm"
+				>
 					AI Sessions
 				</a>
 				<span class="text-text-muted text-sm">/</span>
@@ -147,8 +150,13 @@
 						</thead>
 						<tbody>
 							{#each agents as agent (agent.id)}
-								<tr class="border-b border-border last:border-0 hover:bg-surface-700/50 transition-colors">
-									<td class="px-4 py-3 text-sm text-text-primary max-w-xs truncate" title={agent.description ?? ''}>
+								<tr
+									class="border-b border-border last:border-0 hover:bg-surface-700/50 transition-colors"
+								>
+									<td
+										class="px-4 py-3 text-sm text-text-primary max-w-xs truncate"
+										title={agent.description ?? ''}
+									>
 										<a
 											href="/{projectId}/ai/{session.id}/agents/{agent.id}"
 											class="hover:text-primary-400 transition-colors"
diff --git a/web/src/routes/[projectId]/ai/[sessionId]/agents/[agentId]/+page.svelte b/web/src/routes/[projectId]/ai/[sessionId]/agents/[agentId]/+page.svelte
index 897bcc7..2e3836a 100644
--- a/web/src/routes/[projectId]/ai/[sessionId]/agents/[agentId]/+page.svelte
+++ b/web/src/routes/[projectId]/ai/[sessionId]/agents/[agentId]/+page.svelte
@@ -1,10 +1,6 @@
 <script lang="ts">
 	import { page } from '$app/stores';
-	import {
-		getAIAgent,
-		getAgentTranscript,
-		type AIAgentResponse
-	} from '$lib/api/ai';
+	import { getAIAgent, getAgentTranscript, type AIAgentResponse } from '$lib/api/ai';
 	import TranscriptViewer from '$lib/components/TranscriptViewer.svelte';
 
 	const projectId = $derived($page.params.projectId);
@@ -104,7 +100,10 @@
 					AI Sessions
 				</a>
 				<span class="text-text-muted">/</span>
-				<a href="/{projectId}/ai/{sessionId}" class="text-text-muted hover:text-text-primary transition-colors font-mono">
+				<a
+					href="/{projectId}/ai/{sessionId}"
+					class="text-text-muted hover:text-text-primary transition-colors font-mono"
+				>
 					Session {sessionId?.substring(0, 8)}
 				</a>
 				<span class="text-text-muted">/</span>
@@ -152,7 +151,10 @@
 		<!-- Transcript -->
 		{#if transcriptNotFound}
 			<div class="card p-8 text-center">
-				<p class="text-text-muted">Transcript not found for this agent. The transcript file may not exist or may have been removed.</p>
+				<p class="text-text-muted">
+					Transcript not found for this agent. The transcript file may not exist or may have been
+					removed.
+				</p>
 			</div>
 		{:else}
 			<TranscriptViewer {transcript} />
diff --git a/web/src/routes/[projectId]/blocked/+page.svelte b/web/src/routes/[projectId]/blocked/+page.svelte
index b1b145f..f592dd0 100644
--- a/web/src/routes/[projectId]/blocked/+page.svelte
+++ b/web/src/routes/[projectId]/blocked/+page.svelte
@@ -33,7 +33,7 @@
 </script>
 
 {#if project}
-	<Header project={project} title="Blocked Issues" />
+	<Header {project} title="Blocked Issues" />
 
 	<div class="flex-1 p-6 animate-fade-in">
 		<header class="mb-6">
diff --git a/web/src/routes/[projectId]/issues/+page.svelte b/web/src/routes/[projectId]/issues/+page.svelte
index ff7a7e8..fdab2d4 100644
--- a/web/src/routes/[projectId]/issues/+page.svelte
+++ b/web/src/routes/[projectId]/issues/+page.svelte
@@ -136,7 +136,7 @@
 </script>
 
 {#if project}
-	<Header project={project} title="Issues" />
+	<Header {project} title="Issues" />
 
 	<div class="flex-1 p-6 animate-fade-in">
 		<!-- Filters -->
@@ -208,7 +208,12 @@
 		{:else}
 			<div class="space-y-3">
 				{#each issues as issue (issue.id)}
-					<IssueCard {issue} {labelMap} href="/{projectId}/issues/{issue.id}" onStatusChange={handleStatusChange} />
+					<IssueCard
+						{issue}
+						{labelMap}
+						href="/{projectId}/issues/{issue.id}"
+						onStatusChange={handleStatusChange}
+					/>
 				{/each}
 			</div>
 
diff --git a/web/src/routes/[projectId]/issues/[issueId]/+page.svelte b/web/src/routes/[projectId]/issues/[issueId]/+page.svelte
index 026754a..c4a54d7 100644
--- a/web/src/routes/[projectId]/issues/[issueId]/+page.svelte
+++ b/web/src/routes/[projectId]/issues/[issueId]/+page.svelte
@@ -1,5 +1,16 @@
 <script lang="ts">
-	import { Header, StatusBadge, PriorityBadge, TypeBadge, Markdown, InlineTextEdit, InlineSelect, InlineMarkdownEdit, CommentForm, LabelPicker } from '$lib/components';
+	import {
+		Header,
+		StatusBadge,
+		PriorityBadge,
+		TypeBadge,
+		Markdown,
+		InlineTextEdit,
+		InlineSelect,
+		InlineMarkdownEdit,
+		CommentForm,
+		LabelPicker
+	} from '$lib/components';
 	import CopyIdButton from '$lib/components/CopyIdButton.svelte';
 	import { formatDateTime, formatRelativeTime, dependencyTypeLabels } from '$lib/utils';
 	import { page } from '$app/stores';
@@ -96,12 +107,12 @@
 
 {#if project}
 	{#if loading}
-		<Header project={project} title="Loading..." />
+		<Header {project} title="Loading..." />
 		<div class="flex-1 flex items-center justify-center">
 			<div class="text-text-muted animate-pulse">Loading issue...</div>
 		</div>
 	{:else if error}
-		<Header project={project} title="Error" />
+		<Header {project} title="Error" />
 		<div class="flex-1 flex items-center justify-center p-8">
 			<div class="card p-8 text-center">
 				<p class="text-status-blocked mb-4">{error}</p>
@@ -109,7 +120,7 @@
 			</div>
 		</div>
 	{:else if issue}
-		<Header project={project} title={issue.id} />
+		<Header {project} title={issue.id} />
 
 		<div class="flex-1 p-6 animate-fade-in">
 			<div class="max-w-4xl mx-auto">
@@ -178,7 +189,9 @@
 					<div class="lg:col-span-2 space-y-6">
 						<!-- Description -->
 						<section class="card p-6">
-							<h2 class="text-sm font-medium text-text-muted uppercase tracking-wider mb-3">Description</h2>
+							<h2 class="text-sm font-medium text-text-muted uppercase tracking-wider mb-3">
+								Description
+							</h2>
 							<InlineMarkdownEdit
 								value={issue.description ?? ''}
 								onSave={(v) => handleUpdateField('description', v)}
@@ -274,7 +287,9 @@
 					<div class="space-y-6">
 						<!-- Labels -->
 						<section class="card p-4">
-							<h3 class="text-xs font-medium text-text-muted uppercase tracking-wider mb-3">Labels</h3>
+							<h3 class="text-xs font-medium text-text-muted uppercase tracking-wider mb-3">
+								Labels
+							</h3>
 							<LabelPicker
 								currentLabels={issue.labels ?? []}
 								{allLabels}
diff --git a/web/src/routes/[projectId]/issues/new/+page.svelte b/web/src/routes/[projectId]/issues/new/+page.svelte
index ffa6ac5..ab8d2bc 100644
--- a/web/src/routes/[projectId]/issues/new/+page.svelte
+++ b/web/src/routes/[projectId]/issues/new/+page.svelte
@@ -67,7 +67,7 @@
 </svelte:head>
 
 {#if project}
-	<Header project={project} title="New Issue" />
+	<Header {project} title="New Issue" />
 
 	<div class="flex-1 p-6 animate-fade-in">
 		<div class="max-w-2xl mx-auto">
diff --git a/web/src/routes/[projectId]/ready/+page.svelte b/web/src/routes/[projectId]/ready/+page.svelte
index b86545b..9bf52af 100644
--- a/web/src/routes/[projectId]/ready/+page.svelte
+++ b/web/src/routes/[projectId]/ready/+page.svelte
@@ -45,7 +45,7 @@
 </script>
 
 {#if project}
-	<Header project={project} title="Ready Work" />
+	<Header {project} title="Ready Work" />
 
 	<div class="flex-1 p-6 animate-fade-in">
 		<header class="mb-6">
diff --git a/web/src/routes/[projectId]/teams/+page.svelte b/web/src/routes/[projectId]/teams/+page.svelte
index 901a4f7..4835742 100644
--- a/web/src/routes/[projectId]/teams/+page.svelte
+++ b/web/src/routes/[projectId]/teams/+page.svelte
@@ -5,13 +5,7 @@
 	import { goto } from '$app/navigation';
 	import { getContext } from 'svelte';
 	import type { Writable } from 'svelte/store';
-	import {
-		getTeamContext,
-		listIssues,
-		type Project,
-		type Issue,
-		type TeamContext
-	} from '$lib/api';
+	import { getTeamContext, listIssues, type Project, type Issue, type TeamContext } from '$lib/api';
 
 	const projects = getContext<Writable<Project[]>>('projects');
 	const projectId = $derived($page.params.projectId ?? '');
@@ -25,7 +19,6 @@
 	let loading = $state(true);
 	let error = $state<string | null>(null);
 
-
 	// Role color palette
 	const roleColors: Record<string, string> = {
 		frontend: '#3b82f6',
@@ -97,9 +90,7 @@
 	}
 
 	const roles = $derived(teamContext ? Object.entries(teamContext.roles) : []);
-	const totalIssues = $derived(
-		roles.reduce((sum, [, role]) => sum + role.issues.length, 0)
-	);
+	const totalIssues = $derived(roles.reduce((sum, [, role]) => sum + role.issues.length, 0));
 	const epicOptions = $derived([
 		{ value: '', label: 'All teammate issues' },
 		...epics.map((e) => ({ value: e.id, label: `${e.id}: ${e.title}` }))
@@ -107,7 +98,7 @@
 </script>
 
 {#if project}
-	<Header project={project} title="Teams" showSearch={false} />
+	<Header {project} title="Teams" showSearch={false} />
 
 	<div class="flex-1 p-6 animate-fade-in">
 		<!-- Page header -->
@@ -135,7 +126,12 @@
 			<!-- Epic selector -->
 			<div class="flex items-center gap-3">
 				<span class="text-sm text-text-secondary">Scope:</span>
-				<Select options={epicOptions} value={epicId} placeholder="All teammate issues" onchange={selectEpic} />
+				<Select
+					options={epicOptions}
+					value={epicId}
+					placeholder="All teammate issues"
+					onchange={selectEpic}
+				/>
 			</div>
 		</header>
 
@@ -171,10 +167,9 @@
 			<!-- Role lanes -->
 			<div class="flex gap-4 overflow-x-auto pb-4">
 				{#each roles as [role, data] (role)}
-					<RoleLane {role} issues={data.issues} projectId={projectId} color={getRoleColor(role)} />
+					<RoleLane {role} issues={data.issues} {projectId} color={getRoleColor(role)} />
 				{/each}
-
-				</div>
+			</div>
 		{/if}
 	</div>
 {/if}
diff --git a/web/src/routes/planner/[planId]/+page.svelte b/web/src/routes/planner/[planId]/+page.svelte
index 7eb2ec3..00cb631 100644
--- a/web/src/routes/planner/[planId]/+page.svelte
+++ b/web/src/routes/planner/[planId]/+page.svelte
@@ -1,9 +1,6 @@
 <script lang="ts">
 	import { page } from '$app/stores';
-	import {
-		getPlan, updatePlanContent,
-		listPlanComments, createPlanComment
-	} from '$lib/api';
+	import { getPlan, updatePlanContent, listPlanComments, createPlanComment } from '$lib/api';
 	import type { PlanWithContent, PlanComment } from '$lib/api';
 	import Markdown from '$lib/components/Markdown.svelte';
 	import { formatRelativeTime } from '$lib/utils';
@@ -41,12 +38,16 @@
 
 	// Count of lines that have comments (for the review tab badge)
 	let lineCommentCount = $derived(
-		[...commentsByLine.entries()].filter(([k]) => k !== null).reduce((sum, [, v]) => sum + v.length, 0)
+		[...commentsByLine.entries()]
+			.filter(([k]) => k !== null)
+			.reduce((sum, [, v]) => sum + v.length, 0)
 	);
 
 	let overallComments = $derived(commentsByLine.get(null) ?? []);
 
-	$effect(() => { if (planId) loadData(); });
+	$effect(() => {
+		if (planId) loadData();
+	});
 
 	async function loadData() {
 		if (!planId) return;
@@ -99,11 +100,16 @@
 
 	function statusColor(status: string): string {
 		switch (status) {
-			case 'draft': return 'bg-surface-600 text-text-secondary';
-			case 'in_review': return 'bg-yellow-900/30 text-yellow-400 border border-yellow-800';
-			case 'approved': return 'bg-green-900/30 text-green-400 border border-green-800';
-			case 'rejected': return 'bg-red-900/30 text-red-400 border border-red-800';
-			default: return 'bg-surface-600 text-text-secondary';
+			case 'draft':
+				return 'bg-surface-600 text-text-secondary';
+			case 'in_review':
+				return 'bg-yellow-900/30 text-yellow-400 border border-yellow-800';
+			case 'approved':
+				return 'bg-green-900/30 text-green-400 border border-green-800';
+			case 'rejected':
+				return 'bg-red-900/30 text-red-400 border border-red-800';
+			default:
+				return 'bg-surface-600 text-text-secondary';
 		}
 	}
 </script>
@@ -134,18 +140,20 @@
 		<!-- View Mode Tabs -->
 		<div class="flex gap-1 border-b border-surface-600">
 			<button
-				onclick={() => viewMode = 'review'}
+				onclick={() => (viewMode = 'review')}
 				class="px-4 py-2 text-sm transition-colors flex items-center gap-1.5 {viewMode === 'review'
 					? 'text-text-primary border-b-2 border-primary-500 -mb-px'
 					: 'text-text-muted hover:text-text-secondary'}"
 			>
 				Review
 				{#if lineCommentCount > 0}
-					<span class="px-1.5 py-0.5 text-xs rounded-full bg-yellow-900/30 text-yellow-400">{lineCommentCount}</span>
+					<span class="px-1.5 py-0.5 text-xs rounded-full bg-yellow-900/30 text-yellow-400"
+						>{lineCommentCount}</span
+					>
 				{/if}
 			</button>
 			<button
-				onclick={() => viewMode = 'read'}
+				onclick={() => (viewMode = 'read')}
 				class="px-4 py-2 text-sm transition-colors {viewMode === 'read'
 					? 'text-text-primary border-b-2 border-primary-500 -mb-px'
 					: 'text-text-muted hover:text-text-secondary'}"
@@ -175,7 +183,8 @@
 						<div class="group">
 							<div class="flex hover:bg-surface-700/50">
 								<button
-									onclick={() => activeCommentLine = activeCommentLine === lineNum ? null : lineNum}
+									onclick={() =>
+										(activeCommentLine = activeCommentLine === lineNum ? null : lineNum)}
 									class="w-12 text-right pr-3 py-0.5 text-text-muted hover:text-primary-400 select-none shrink-0 cursor-pointer"
 								>
 									{lineNum}
@@ -191,7 +200,9 @@
 							</div>
 
 							{#if lineComments.length > 0}
-								<div class="ml-12 pl-3 border-l-2 border-yellow-800 bg-yellow-900/10 py-2 space-y-1">
+								<div
+									class="ml-12 pl-3 border-l-2 border-yellow-800 bg-yellow-900/10 py-2 space-y-1"
+								>
 									{#each lineComments as comment}
 										<div class="text-sm text-text-secondary">
 											{comment.content}
@@ -210,7 +221,9 @@
 										bind:value={commentText}
 										placeholder="Add a comment on line {lineNum}..."
 										class="flex-1 bg-surface-700 text-text-primary text-sm px-3 py-1.5 rounded border border-surface-500 focus:border-primary-500 focus:outline-none"
-										onkeydown={(e) => { if (e.key === 'Enter') handleAddComment(lineNum); }}
+										onkeydown={(e) => {
+											if (e.key === 'Enter') handleAddComment(lineNum);
+										}}
 									/>
 									<button
 										onclick={() => handleAddComment(lineNum)}
@@ -242,12 +255,16 @@
 					spellcheck="false"
 				></textarea>
 				<div class="flex gap-2 justify-end">
-					<button onclick={() => viewMode = 'read'}
-						class="px-3 py-1.5 text-sm text-text-secondary hover:text-text-primary">
+					<button
+						onclick={() => (viewMode = 'read')}
+						class="px-3 py-1.5 text-sm text-text-secondary hover:text-text-primary"
+					>
 						Cancel
 					</button>
-					<button onclick={handleSaveEdit}
-						class="px-3 py-1.5 text-sm bg-primary-600 text-white rounded hover:bg-primary-500">
+					<button
+						onclick={handleSaveEdit}
+						class="px-3 py-1.5 text-sm bg-primary-600 text-white rounded hover:bg-primary-500"
+					>
 						Save
 					</button>
 				</div>
@@ -260,7 +277,10 @@
 				<label for="overall-feedback" class="text-xs text-text-muted uppercase tracking-wide">
 					Overall Feedback
 					{#if overallComments.length > 0}
-						<span class="ml-1.5 px-1.5 py-0.5 rounded-full bg-yellow-900/30 text-yellow-400 normal-case">{overallComments.length}</span>
+						<span
+							class="ml-1.5 px-1.5 py-0.5 rounded-full bg-yellow-900/30 text-yellow-400 normal-case"
+							>{overallComments.length}</span
+						>
 					{/if}
 				</label>
 				{#if overallComments.length > 0}
@@ -282,7 +302,9 @@
 						placeholder="Overall feedback on this plan..."
 						rows="2"
 						class="flex-1 bg-surface-700 text-text-primary text-sm p-3 rounded border border-surface-500 focus:border-primary-500 focus:outline-none resize-y"
-						onkeydown={(e) => { if (e.key === 'Enter' && (e.metaKey || e.ctrlKey)) handleAddComment(null); }}
+						onkeydown={(e) => {
+							if (e.key === 'Enter' && (e.metaKey || e.ctrlKey)) handleAddComment(null);
+						}}
 					></textarea>
 					<button
 						onclick={() => handleAddComment(null)}
diff --git a/web/tests/e2e/comments-events.e2e.spec.ts b/web/tests/e2e/comments-events.e2e.spec.ts
index d974022..8e52edb 100644
--- a/web/tests/e2e/comments-events.e2e.spec.ts
+++ b/web/tests/e2e/comments-events.e2e.spec.ts
@@ -39,7 +39,9 @@ test.describe('Comments and Events Timeline', () => {
 
 		// Verify order: First should appear before Second, Second before Third
 		const commentsSection = page.locator('section', { has: page.getByText('Comments (3)') });
-		const commentTexts = await commentsSection.locator('.border-b, .last\\:border-0').allTextContents();
+		const commentTexts = await commentsSection
+			.locator('.border-b, .last\\:border-0')
+			.allTextContents();
 		const orderedTexts = commentTexts.join('|||');
 		expect(orderedTexts.indexOf('First')).toBeLessThan(orderedTexts.indexOf('Second'));
 		expect(orderedTexts.indexOf('Second')).toBeLessThan(orderedTexts.indexOf('Third'));
diff --git a/web/tests/e2e/dependencies.e2e.spec.ts b/web/tests/e2e/dependencies.e2e.spec.ts
index ea4fda0..bd115c0 100644
--- a/web/tests/e2e/dependencies.e2e.spec.ts
+++ b/web/tests/e2e/dependencies.e2e.spec.ts
@@ -61,9 +61,7 @@ test.describe('Dependencies on Issue Detail Page', () => {
 		await depLink.click();
 
 		// Verify navigation to issueB's detail page
-		await expect(page).toHaveURL(
-			new RegExp(`/${testWorkspace.id}/issues/${issueB.id}`),
-		);
+		await expect(page).toHaveURL(new RegExp(`/${testWorkspace.id}/issues/${issueB.id}`));
 		// Verify we're on issueB's page
 		await expect(page.getByText('Issue B')).toBeVisible();
 	});
diff --git a/web/tests/e2e/fixtures.ts b/web/tests/e2e/fixtures.ts
index 303fd45..2b671bb 100644
--- a/web/tests/e2e/fixtures.ts
+++ b/web/tests/e2e/fixtures.ts
@@ -10,11 +10,15 @@ export function uniqueName(prefix = 'test'): string {
 /** Create a project via the API. Returns the created project object. */
 export async function createTestWorkspace(
 	name?: string,
-	opts?: { path?: string; prefix?: string; description?: string },
+	opts?: { path?: string; prefix?: string; description?: string }
 ): Promise<{ id: string; name: string; prefix: string }> {
 	const wsName = name ?? uniqueName('ws');
 	// Generate a short unique prefix from the name (uppercase, max 4 chars)
-	const defaultPrefix = wsName.replace(/[^a-zA-Z]/g, '').slice(0, 4).toUpperCase() || 'TE';
+	const defaultPrefix =
+		wsName
+			.replace(/[^a-zA-Z]/g, '')
+			.slice(0, 4)
+			.toUpperCase() || 'TE';
 	const res = await fetch(`${API_BASE}/projects`, {
 		method: 'POST',
 		headers: { 'Content-Type': 'application/json' },
@@ -22,8 +26,8 @@ export async function createTestWorkspace(
 			name: wsName,
 			path: opts?.path ?? `/tmp/test-${wsName}`,
 			prefix: opts?.prefix ?? defaultPrefix,
-			description: opts?.description,
-		}),
+			description: opts?.description
+		})
 	});
 	if (!res.ok) {
 		throw new Error(`createTestWorkspace failed: ${res.status} ${await res.text()}`);
@@ -47,8 +51,14 @@ export async function createTestIssue(
 		issue_type?: string;
 		priority?: number;
 		description?: string;
-	},
-): Promise<{ id: string; title: string; status: string; priority: number; [key: string]: unknown }> {
+	}
+): Promise<{
+	id: string;
+	title: string;
+	status: string;
+	priority: number;
+	[key: string]: unknown;
+}> {
 	const res = await fetch(`${API_BASE}/projects/${wsId}/issues`, {
 		method: 'POST',
 		headers: { 'Content-Type': 'application/json' },
@@ -56,8 +66,8 @@ export async function createTestIssue(
 			title: opts?.title ?? uniqueName('issue'),
 			issue_type: opts?.issue_type,
 			priority: opts?.priority,
-			description: opts?.description,
-		}),
+			description: opts?.description
+		})
 	});
 	if (!res.ok) {
 		throw new Error(`createTestIssue failed: ${res.status} ${await res.text()}`);
@@ -69,12 +79,12 @@ export async function createTestIssue(
 export async function updateTestIssue(
 	wsId: string,
 	issueId: string,
-	fields: Record<string, unknown>,
+	fields: Record<string, unknown>
 ): Promise<{ id: string; [key: string]: unknown }> {
 	const res = await fetch(`${API_BASE}/projects/${wsId}/issues/${issueId}`, {
 		method: 'PUT',
 		headers: { 'Content-Type': 'application/json' },
-		body: JSON.stringify(fields),
+		body: JSON.stringify(fields)
 	});
 	if (!res.ok) {
 		throw new Error(`updateTestIssue failed: ${res.status} ${await res.text()}`);
@@ -85,7 +95,7 @@ export async function updateTestIssue(
 /** Create a label. Returns the created label object. */
 export async function createTestLabel(
 	name?: string,
-	opts?: { color?: string; description?: string },
+	opts?: { color?: string; description?: string }
 ): Promise<{ name: string; color?: string; description?: string }> {
 	const labelName = name ?? uniqueName('label');
 	const res = await fetch(`${API_BASE}/labels`, {
@@ -94,8 +104,8 @@ export async function createTestLabel(
 		body: JSON.stringify({
 			name: labelName,
 			color: opts?.color,
-			description: opts?.description,
-		}),
+			description: opts?.description
+		})
 	});
 	if (!res.ok) {
 		throw new Error(`createTestLabel failed: ${res.status} ${await res.text()}`);
@@ -106,7 +116,7 @@ export async function createTestLabel(
 /** Delete a label by name. */
 export async function deleteTestLabel(name: string): Promise<void> {
 	const res = await fetch(`${API_BASE}/labels/${encodeURIComponent(name)}`, {
-		method: 'DELETE',
+		method: 'DELETE'
 	});
 	if (!res.ok) {
 		throw new Error(`deleteTestLabel failed: ${res.status} ${await res.text()}`);
@@ -118,15 +128,15 @@ export async function addTestDependency(
 	wsId: string,
 	issueId: string,
 	dependsOnId: string,
-	type?: string,
+	type?: string
 ): Promise<{ issue_id: string; depends_on_id: string; [key: string]: unknown }> {
 	const res = await fetch(`${API_BASE}/projects/${wsId}/issues/${issueId}/deps`, {
 		method: 'POST',
 		headers: { 'Content-Type': 'application/json' },
 		body: JSON.stringify({
 			depends_on_id: dependsOnId,
-			type: type,
-		}),
+			type: type
+		})
 	});
 	if (!res.ok) {
 		throw new Error(`addTestDependency failed: ${res.status} ${await res.text()}`);
@@ -139,12 +149,12 @@ export async function addTestComment(
 	wsId: string,
 	issueId: string,
 	text: string,
-	author?: string,
+	author?: string
 ): Promise<{ id: number; text: string; [key: string]: unknown }> {
 	const res = await fetch(`${API_BASE}/projects/${wsId}/issues/${issueId}/comments`, {
 		method: 'POST',
 		headers: { 'Content-Type': 'application/json' },
-		body: JSON.stringify({ text, author }),
+		body: JSON.stringify({ text, author })
 	});
 	if (!res.ok) {
 		throw new Error(`addTestComment failed: ${res.status} ${await res.text()}`);
@@ -156,12 +166,12 @@ export async function addTestComment(
 export async function addLabelToIssue(
 	wsId: string,
 	issueId: string,
-	labelName: string,
+	labelName: string
 ): Promise<void> {
 	const res = await fetch(`${API_BASE}/projects/${wsId}/issues/${issueId}/labels`, {
 		method: 'POST',
 		headers: { 'Content-Type': 'application/json' },
-		body: JSON.stringify({ label: labelName }),
+		body: JSON.stringify({ label: labelName })
 	});
 	if (!res.ok) {
 		throw new Error(`addLabelToIssue failed: ${res.status} ${await res.text()}`);
@@ -180,7 +190,7 @@ export const test = base.extend<TestFixtures>({
 		const ws = await createTestWorkspace();
 		await use(ws);
 		await deleteTestWorkspace(ws.id);
-	},
+	}
 });
 
 export { expect };
diff --git a/web/tests/e2e/issue-lifecycle.e2e.spec.ts b/web/tests/e2e/issue-lifecycle.e2e.spec.ts
index 73f87f2..845f7f7 100644
--- a/web/tests/e2e/issue-lifecycle.e2e.spec.ts
+++ b/web/tests/e2e/issue-lifecycle.e2e.spec.ts
@@ -34,7 +34,7 @@ test.describe('Issue Lifecycle E2E', () => {
 			title: 'Fully loaded issue',
 			issue_type: 'bug',
 			priority: 1,
-			description: 'Detailed description here',
+			description: 'Detailed description here'
 		});
 
 		await page.goto(`/${ws.id}/issues/${issue.id}`);
@@ -47,11 +47,15 @@ test.describe('Issue Lifecycle E2E', () => {
 		await expect(typeBadge).toBeVisible();
 
 		// Status badge (open by default)
-		const statusBadge = page.locator('button[aria-haspopup="listbox"]').filter({ hasText: /open/i });
+		const statusBadge = page
+			.locator('button[aria-haspopup="listbox"]')
+			.filter({ hasText: /open/i });
 		await expect(statusBadge).toBeVisible();
 
 		// Priority badge (P1)
-		const priorityBadge = page.locator('button[aria-haspopup="listbox"]').filter({ hasText: /P1/i });
+		const priorityBadge = page
+			.locator('button[aria-haspopup="listbox"]')
+			.filter({ hasText: /P1/i });
 		await expect(priorityBadge).toBeVisible();
 
 		// Description
@@ -76,7 +80,9 @@ test.describe('Issue Lifecycle E2E', () => {
 		await titleInput.blur();
 
 		// Wait for the save to complete and the button text to update
-		await expect(page.getByRole('button', { name: 'Updated title' })).toBeVisible({ timeout: 15000 });
+		await expect(page.getByRole('button', { name: 'Updated title' })).toBeVisible({
+			timeout: 15000
+		});
 	});
 
 	test('update status inline', async ({ page, testWorkspace: ws }) => {
@@ -84,7 +90,9 @@ test.describe('Issue Lifecycle E2E', () => {
 		await page.goto(`/${ws.id}/issues/${issue.id}`);
 
 		// Click the status badge to open dropdown
-		const statusBadge = page.locator('button[aria-haspopup="listbox"]').filter({ hasText: /open/i });
+		const statusBadge = page
+			.locator('button[aria-haspopup="listbox"]')
+			.filter({ hasText: /open/i });
 		await statusBadge.click();
 
 		// Select "In Progress" from listbox
@@ -101,7 +109,9 @@ test.describe('Issue Lifecycle E2E', () => {
 		await page.goto(`/${ws.id}/issues/${issue.id}`);
 
 		// Click the priority badge
-		const priorityBadge = page.locator('button[aria-haspopup="listbox"]').filter({ hasText: /P2/i });
+		const priorityBadge = page
+			.locator('button[aria-haspopup="listbox"]')
+			.filter({ hasText: /P2/i });
 		await priorityBadge.click();
 
 		// Select Critical (P0)
@@ -133,7 +143,7 @@ test.describe('Issue Lifecycle E2E', () => {
 	test('update description inline', async ({ page, testWorkspace: ws }) => {
 		const issue = await createTestIssue(ws.id, {
 			title: 'Description test issue',
-			description: 'Old description',
+			description: 'Old description'
 		});
 		await page.goto(`/${ws.id}/issues/${issue.id}`);
 
@@ -159,7 +169,9 @@ test.describe('Issue Lifecycle E2E', () => {
 		await page.goto(`/${ws.id}/issues/${issue.id}`);
 
 		// Click the status badge
-		const statusBadge = page.locator('button[aria-haspopup="listbox"]').filter({ hasText: /open/i });
+		const statusBadge = page
+			.locator('button[aria-haspopup="listbox"]')
+			.filter({ hasText: /open/i });
 		await statusBadge.click();
 
 		// Select "Closed"
@@ -177,20 +189,22 @@ test.describe('Issue Lifecycle E2E', () => {
 			{ value: 'feature', label: 'Feature' },
 			{ value: 'task', label: 'Task' },
 			{ value: 'epic', label: 'Epic' },
-			{ value: 'chore', label: 'Chore' },
+			{ value: 'chore', label: 'Chore' }
 		];
 
 		for (const issueType of issueTypes) {
 			await page.goto(`/${ws.id}/issues/new`);
 
-			await page.getByPlaceholder('Brief description of the issue').fill(`Test ${issueType.label} issue`);
+			await page
+				.getByPlaceholder('Brief description of the issue')
+				.fill(`Test ${issueType.label} issue`);
 			await page.locator('#type').selectOption(issueType.value);
 			await page.getByRole('button', { name: 'Create Issue' }).click();
 
 			// Verify redirect to detail and correct type badge is shown
 			await expect(page).not.toHaveURL(/\/issues\/new$/);
 			const typeBadge = page.locator('button[aria-haspopup="listbox"]').filter({
-				hasText: new RegExp(issueType.label, 'i'),
+				hasText: new RegExp(issueType.label, 'i')
 			});
 			await expect(typeBadge).toBeVisible();
 		}
diff --git a/web/tests/e2e/team-context.e2e.spec.ts b/web/tests/e2e/team-context.e2e.spec.ts
index b78e028..98112a2 100644
--- a/web/tests/e2e/team-context.e2e.spec.ts
+++ b/web/tests/e2e/team-context.e2e.spec.ts
@@ -6,7 +6,7 @@ import {
 	deleteTestLabel,
 	addLabelToIssue,
 	uniqueName,
-	addTestDependency,
+	addTestDependency
 } from './fixtures';
 
 test.describe('Team Context Page', () => {
@@ -37,11 +37,11 @@ test.describe('Team Context Page', () => {
 			// Create issues with teammate labels
 			const feIssue = await createTestIssue(wsId, {
 				title: 'FE task for alice',
-				issue_type: 'task',
+				issue_type: 'task'
 			});
 			const beIssue = await createTestIssue(wsId, {
 				title: 'BE task for bob',
-				issue_type: 'task',
+				issue_type: 'task'
 			});
 
 			// Add teammate labels to issues
@@ -82,13 +82,13 @@ test.describe('Team Context Page', () => {
 			// Create an epic
 			const epic = await createTestIssue(wsId, {
 				title: 'Test Epic for filtering',
-				issue_type: 'epic',
+				issue_type: 'epic'
 			});
 
 			// Create a child task with teammate label
 			const childTask = await createTestIssue(wsId, {
 				title: 'Child task under epic',
-				issue_type: 'task',
+				issue_type: 'task'
 			});
 
 			// Set parent-child dependency (child depends on parent)
@@ -104,7 +104,9 @@ test.describe('Team Context Page', () => {
 			await expect(page.getByText('Scope:')).toBeVisible();
 
 			// Open the custom Select dropdown by clicking the trigger button
-			const selectTrigger = page.locator('button[aria-haspopup="listbox"]').filter({ hasText: 'All teammate issues' });
+			const selectTrigger = page
+				.locator('button[aria-haspopup="listbox"]')
+				.filter({ hasText: 'All teammate issues' });
 			await selectTrigger.click();
 
 			// Click the epic option in the dropdown
@@ -133,7 +135,7 @@ test.describe('Team Context Page', () => {
 			// Create issue with teammate label
 			const issue = await createTestIssue(wsId, {
 				title: 'Clickable team issue',
-				issue_type: 'task',
+				issue_type: 'task'
 			});
 			const issueId = issue.id as string;
 			await addLabelToIssue(wsId, issueId, labelName);
diff --git a/web/tests/e2e/workspace-crud.e2e.spec.ts b/web/tests/e2e/workspace-crud.e2e.spec.ts
index 69e178e..9a883e2 100644
--- a/web/tests/e2e/workspace-crud.e2e.spec.ts
+++ b/web/tests/e2e/workspace-crud.e2e.spec.ts
@@ -5,7 +5,7 @@ import {
 	deleteTestWorkspace,
 	createTestIssue,
 	updateTestIssue,
-	uniqueName,
+	uniqueName
 } from './fixtures';
 
 test.describe('Workspace CRUD', () => {
@@ -38,7 +38,9 @@ test.describe('Workspace CRUD', () => {
 		await expect(totalCard.locator('.text-2xl')).toHaveText('2');
 
 		// Verify Open shows 1
-		const openCard = statsGrid.locator('.card').filter({ has: page.getByText('Open', { exact: true }) });
+		const openCard = statsGrid
+			.locator('.card')
+			.filter({ has: page.getByText('Open', { exact: true }) });
 		await expect(openCard.locator('.text-2xl')).toHaveText('1');
 
 		// Verify Closed shows 1
@@ -55,9 +57,7 @@ test.describe('Workspace CRUD', () => {
 			const main = page.locator('main');
 
 			// Wait for the workspace card to appear (h3 inside cards)
-			await expect(
-				main.locator('h3').filter({ hasText: extraWs.name }),
-			).toBeVisible();
+			await expect(main.locator('h3').filter({ hasText: extraWs.name })).toBeVisible();
 
 			// Enter edit mode
 			await main.getByRole('button', { name: 'Edit' }).click();
@@ -78,9 +78,7 @@ test.describe('Workspace CRUD', () => {
 			await dialog.getByRole('button', { name: /Delete/ }).click();
 
 			// Verify workspace is gone
-			await expect(
-				main.locator('h3').filter({ hasText: extraWs.name }),
-			).not.toBeVisible();
+			await expect(main.locator('h3').filter({ hasText: extraWs.name })).not.toBeVisible();
 		} catch (err) {
 			// Cleanup on failure
 			await deleteTestWorkspace(extraWs.id).catch(() => {});
@@ -96,9 +94,7 @@ test.describe('Workspace CRUD', () => {
 		try {
 			await page.goto('/');
 			const main = page.locator('main');
-			await expect(
-				main.locator('h3').filter({ hasText: ws2.name }),
-			).toBeVisible();
+			await expect(main.locator('h3').filter({ hasText: ws2.name })).toBeVisible();
 
 			// Enter edit mode
 			await main.getByRole('button', { name: 'Edit' }).click();
@@ -131,9 +127,7 @@ test.describe('Workspace CRUD', () => {
 			await dialog.getByRole('button', { name: 'Done' }).click();
 
 			// ws2 should be gone from the list
-			await expect(
-				main.locator('h3').filter({ hasText: ws2.name }),
-			).not.toBeVisible();
+			await expect(main.locator('h3').filter({ hasText: ws2.name })).not.toBeVisible();
 		} catch (err) {
 			await deleteTestWorkspace(ws2.id).catch(() => {});
 			throw err;
@@ -147,33 +141,21 @@ test.describe('Workspace CRUD', () => {
 		try {
 			await page.goto('/');
 			const main = page.locator('main');
-			await expect(
-				main.locator('h3').filter({ hasText: testWorkspace.name }),
-			).toBeVisible();
-			await expect(
-				main.locator('h3').filter({ hasText: otherWs.name }),
-			).toBeVisible();
+			await expect(main.locator('h3').filter({ hasText: testWorkspace.name })).toBeVisible();
+			await expect(main.locator('h3').filter({ hasText: otherWs.name })).toBeVisible();
 
 			// Type the test workspace name in search (scope to main to avoid sidebar search)
 			const searchInput = main.getByPlaceholder('Search projects...');
 			await searchInput.fill(testWorkspace.name);
 
 			// testWorkspace should be visible, other should not
-			await expect(
-				main.locator('h3').filter({ hasText: testWorkspace.name }),
-			).toBeVisible();
-			await expect(
-				main.locator('h3').filter({ hasText: otherWs.name }),
-			).not.toBeVisible();
+			await expect(main.locator('h3').filter({ hasText: testWorkspace.name })).toBeVisible();
+			await expect(main.locator('h3').filter({ hasText: otherWs.name })).not.toBeVisible();
 
 			// Clear and search for other
 			await searchInput.fill(otherWs.name);
-			await expect(
-				main.locator('h3').filter({ hasText: otherWs.name }),
-			).toBeVisible();
-			await expect(
-				main.locator('h3').filter({ hasText: testWorkspace.name }),
-			).not.toBeVisible();
+			await expect(main.locator('h3').filter({ hasText: otherWs.name })).toBeVisible();
+			await expect(main.locator('h3').filter({ hasText: testWorkspace.name })).not.toBeVisible();
 		} finally {
 			await deleteTestWorkspace(otherWs.id).catch(() => {});
 		}
@@ -206,8 +188,8 @@ test.describe('Workspace CRUD', () => {
 		// Navigate fresh so the SPA fetches the empty list
 		await page.goto('/');
 		const main = page.locator('main');
-		await expect(
-			main.getByRole('heading', { name: 'No projects yet' }),
-		).toBeVisible({ timeout: 10000 });
+		await expect(main.getByRole('heading', { name: 'No projects yet' })).toBeVisible({
+			timeout: 10000
+		});
 	});
 });
diff --git a/web/tests/issue-detail-inline-edit.spec.ts b/web/tests/issue-detail-inline-edit.spec.ts
index d1dd1dc..2f907a5 100644
--- a/web/tests/issue-detail-inline-edit.spec.ts
+++ b/web/tests/issue-detail-inline-edit.spec.ts
@@ -118,7 +118,9 @@ test.describe('Issue Detail - Inline Editing', () => {
 		await expect(statusBadge).toBeVisible();
 
 		// PriorityBadge should be clickable
-		const priorityBadge = page.locator('button[aria-haspopup="listbox"]').filter({ hasText: /P2/i });
+		const priorityBadge = page
+			.locator('button[aria-haspopup="listbox"]')
+			.filter({ hasText: /P2/i });
 		await expect(priorityBadge).toBeVisible();
 	});
 
@@ -191,5 +193,4 @@ test.describe('Issue Detail - Inline Editing', () => {
 		await expect(page.getByRole('option', { name: 'Epic' })).toBeVisible();
 		await expect(page.getByRole('option', { name: 'Chore' })).toBeVisible();
 	});
-
 });
diff --git a/web/tests/workspace-deletion.spec.ts b/web/tests/workspace-deletion.spec.ts
index 272d59d..bbae5cd 100644
--- a/web/tests/workspace-deletion.spec.ts
+++ b/web/tests/workspace-deletion.spec.ts
@@ -216,9 +216,7 @@ test.describe('Project Deletion', () => {
 		await dialog.getByRole('button', { name: 'Delete Projects' }).click();
 
 		// Wait for dialog to close
-		await expect(
-			page.getByRole('heading', { name: 'Delete 2 projects?' })
-		).not.toBeVisible();
+		await expect(page.getByRole('heading', { name: 'Delete 2 projects?' })).not.toBeVisible();
 
 		// Deleted projects should be removed
 		await expect(page.locator('main').getByText('Test Project 1')).not.toBeVisible();
diff --git a/web/vitest.config.ts b/web/vitest.config.ts
index f5a2891..2d7798f 100644
--- a/web/vitest.config.ts
+++ b/web/vitest.config.ts
@@ -2,6 +2,11 @@ import { defineConfig } from 'vitest/config';
 
 export default defineConfig({
 	test: {
-		environment: 'node',
-	},
+		// Vitest scope is intentionally narrow: only the paste/share-review unit
+		// tests we added. The rest of the suite uses Bun's native runner
+		// (`import from 'bun:test'`) or Playwright (e2e) and isn't compatible
+		// with Vitest's runtime.
+		include: ['src/lib/paste/**/*.{test,spec}.{js,ts}'],
+		environment: 'node'
+	}
 });

From a240c86092ddb1e77d6010e2d163f52641761992 Mon Sep 17 00:00:00 2001
From: Ben Firestone <ben.firestone@krypticlabs.com>
Date: Wed, 29 Apr 2026 16:57:02 -0700
Subject: [PATCH 13/20] fix(make): pass -tags webui to build-paste so the SPA
 is embedded

Without the webui build tag, arc-paste's embedded SPA assets are zero bytes
and GET /share/<id> returns a JSON 404 from the API fallback instead of
serving the SvelteKit app shell. Mirrors the flag the main `build` target
already passes.
---
 Makefile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Makefile b/Makefile
index c168639..c678f33 100644
--- a/Makefile
+++ b/Makefile
@@ -105,9 +105,9 @@ build-quick: ## Build CLI-only binary (no embedded web UI)
 	$(BUILD_SCRIPT)
 
 .PHONY: build-paste
-build-paste: web-build ## Build arc-paste standalone binary
+build-paste: web-build ## Build arc-paste standalone binary (with embedded SPA)
 	@echo "==> Building arc-paste binary..."
-	$(GO) build -o $(BIN_DIR)/arc-paste ./arc-paste
+	$(GO) build -tags webui -o $(BIN_DIR)/arc-paste ./arc-paste
 
 .PHONY: release
 release: ## Build release with goreleaser (requires git tag)

From a9beb46a8500acab31d59fe42bdd329d57181ac9 Mon Sep 17 00:00:00 2001
From: Ben Firestone <ben.firestone@krypticlabs.com>
Date: Wed, 29 Apr 2026 16:57:09 -0700
Subject: [PATCH 14/20] docs: add paste-server manual test runbook

Step-by-step manual verification flow for the share/[id] surface, covering
local mode (arc share create --local) and the deferred public arc-paste
deploy. Codifies what was previously tribal knowledge from manual SSH-tunnel
testing.
---
 docs/runbooks/paste-server.md | 189 ++++++++++++++++++++++++++++++++++
 1 file changed, 189 insertions(+)
 create mode 100644 docs/runbooks/paste-server.md

diff --git a/docs/runbooks/paste-server.md b/docs/runbooks/paste-server.md
new file mode 100644
index 0000000..663f568
--- /dev/null
+++ b/docs/runbooks/paste-server.md
@@ -0,0 +1,189 @@
+# Manual test runbook — paste server (local + shared review)
+
+This runbook walks through end-to-end manual testing of the encrypted paste service that backs `arc share` and the `/share/[id]` SvelteKit UI. Use it after rebuilding the binaries or before cutting a release.
+
+For background on the architecture, see [`docs/plans/2026-04-29-shared-review.md`](../plans/2026-04-29-shared-review.md).
+
+## Prerequisites
+
+- `bun` and `go` installed
+- A clean checkout on `feat/add-shared-review` (or whatever branch contains `internal/paste/`, `arc-paste/`, and `cmd/arc/share.go`)
+
+## 1. Build everything
+
+arc uses Go build tags to gate the embedded SPA. Files in `web/` have `//go:build webui` (real embed) vs `//go:build !webui` (stub no-op `RegisterSPA`). Without the `webui` tag, **both binaries will return JSON 404 for `/share/<id>`** — they have the API but no SPA.
+
+```bash
+# From the worktree root
+
+# arc-server WITH embedded SPA (this is the one you want for manual testing)
+make build           # depends on `web-build` + `build-bin --webui`
+
+# arc-paste with embedded SPA
+make build-paste     # builds web/ then `go build -tags webui ./arc-paste`
+
+ls -la bin/          # expect: arc, arc-paste  (the unified `arc` binary serves the API; `arc server start` boots the daemon)
+```
+
+> **Do NOT use `make build-quick`** for manual UI testing — that target produces a CLI-only binary with the stub `RegisterSPA` (no-op), and `/share/<id>` will 404 with `{"message":"Not Found"}`. `build-quick` is fine for CLI-only flows like `arc share comments` but won't render the UI.
+
+If you skip the SPA build step, `/share/[id]` will return 404 even with the right tag because the embedded filesystem will be empty.
+
+## 2. Local review
+
+Local mode hosts the paste API and SPA on the same `arc-server` binary that already serves arc's issues/projects. The encryption key is auto-generated, persisted to `~/.arc/shares.json`, and embedded into the URL fragment so the browser can decrypt.
+
+### Start the server
+
+```bash
+# Terminal 1
+./bin/arc server start --foreground
+# listens on :7432; paste handlers mounted at /api/paste/*
+# (drop --foreground to run as a daemon; use `arc server logs` to tail it)
+```
+
+### Create a test plan and share it
+
+```bash
+# Terminal 2
+cat > /tmp/test-plan.md <<'EOF'
+# Test Plan
+
+## Goal
+Validate the shared review feature.
+
+## Approach
+- Selection-based annotation
+- Conventional labels
+- Resolve / accept / reject
+EOF
+
+./bin/arc share create /tmp/test-plan.md --local
+# → Share URL:  http://localhost:7432/share/<id>#k=<key>
+# → Edit token: <token> (saved in ~/.arc/shares.json)
+
+./bin/arc share list                # see all known shares
+ls -la ~/.arc/shares.json           # verify file mode 0600
+```
+
+### Exercise the UI
+
+Open the printed URL in Chrome/Firefox.
+
+1. **Name prompt** appears on first comment — type "Author"
+2. **Highlight a paragraph** in the rendered plan → floating annotation toolbar appears
+3. **Pick a label** (`praise` / `issue` / `suggestion` / `question` / `nit`)
+4. **Type a comment**, optionally toggle "Suggest replacement text"
+5. **Post** — the comment appears in the sidebar
+6. As the author (your localStorage name matches `plan.author_name`), you'll see **Accept / Resolve / Reject** controls. Try Accept on one comment, Reject (with reply) on another, and Resolve on a third
+
+### Pull comments back to the CLI
+
+```bash
+./bin/arc share comments <id>             # all comments + statuses
+./bin/arc share pull <id>                 # accepted-only (the brainstorm-flow form)
+./bin/arc share comments <id> --json      # machine-readable
+```
+
+### Simulate a second reviewer
+
+Without spinning up another machine, open the same URL in an **incognito window** (or a different browser entirely). Incognito gets a fresh `localStorage`, so:
+
+1. The name prompt fires again — type "Reviewer-2"
+2. Post a few comments
+3. Refresh the author's window → new comments replay in via `replayEvents()`
+
+The author's resolution events still apply (their `author_name` matches the plan's). Reviewer-2's comments cannot be marked as `accepted` by Reviewer-2 itself, even if they tried — the client filters out resolution events whose `author_name` doesn't match `plan.author_name`.
+
+## 3. Shared / remote review
+
+Remote mode runs the standalone `arc-paste` binary (a thin wrapper around the same `internal/paste/` package). It owns its own SQLite, has CORS enabled, and can be deployed anywhere reachable.
+
+### Start arc-paste on a separate port
+
+```bash
+# Terminal 1
+ARC_PASTE_ADDR=:7433 ARC_PASTE_DB=/tmp/arc-paste.db ./bin/arc-paste
+```
+
+### Create a shared paste pointed at the standalone server
+
+```bash
+# Terminal 2
+./bin/arc share create /tmp/test-plan.md --share --server http://localhost:7433
+# → Share URL:  http://localhost:7433/share/<id>#k=<key>
+```
+
+That URL is what you'd send to a real reviewer (Slack, email, etc.). It contains everything they need: the share id and the decryption key in the fragment.
+
+### Pull the comments back
+
+```bash
+./bin/arc share pull <id> --accepted-only
+```
+
+The CLI looks up the share id in `~/.arc/shares.json` to find the server URL and decryption key — no need to paste the full URL again.
+
+### Simulate a public deploy
+
+To exercise the actual "remote" code paths (cross-origin, no shared filesystem), run `arc-paste` on a different host or behind a tunnel:
+
+```bash
+# On a VPS, or via cloudflared/ngrok:
+./bin/arc-paste
+
+# From your laptop:
+./bin/arc share create plan.md --share --server https://share.example.com
+```
+
+Or set `ARC_SHARE_SERVER=https://share.example.com` once and just use `--share`.
+
+## 4. End-to-end via the brainstorm skill
+
+In a new Claude Code session, the agent-nexus brainstorm skill update can be exercised directly:
+
+```
+/arc:brainstorm let's design a small feature
+```
+
+When the skill reaches step 6, it should now offer three options via `AskUserQuestion`:
+
+- **Local review** → invokes `arc share create --local`
+- **Shared review** → invokes `arc share create --share`
+- **Save for later** → no server registration
+
+Step 7 (review loop) uses `arc share approve` and `arc share pull` instead of the legacy `arc plan *` commands.
+
+## 5. Gotchas
+
+| Symptom | Cause | Fix |
+|---|---|---|
+| `/share/<id>` returns `{"message":"Not Found"}` (Echo's default 404 JSON) | Binary built without the `webui` build tag — `web.RegisterSPA` is the no-op stub | Rebuild with `make build` (not `make build-quick`); for arc-paste use `go build -tags webui -o ./bin/arc-paste ./arc-paste` |
+| `/share/<id>` returns blank HTML / cannot find static assets | `web/build/` not present at compile time, even with the `webui` tag | Re-run `bun run build` in `web/`, then rebuild the binary |
+| SPA console says `missing #k=<key> in URL` | URL was pasted without its fragment | Use the full URL printed by `arc share create` — fragments are dropped by some chat apps; copy carefully |
+| `arc share comments <id>` errors with "unknown share id" | Looking up an id you didn't create on this machine | Use the full URL: `arc share comments 'http://host/share/<id>#k=<key>'` |
+| Comments from another reviewer don't appear after refresh | Browser is caching `GET /api/paste/:id` | Hard reload (Cmd-Shift-R / Ctrl-Shift-R); the `arc-paste` server doesn't currently set Cache-Control headers |
+| Lost `~/.arc/shares.json` | The only copy of edit_tokens + keys lives there | There is no recovery — same trade-off plannotator makes. Back up `~/.arc/` before destructive testing |
+| CORS error in browser console (shared mode) | Talking to an arc-paste instance without `middleware.CORS()` | Verify you're running the binary built from this branch (`./bin/arc-paste --help` should exist; if not, rebuild via `make build-paste`) |
+
+## 6. Quick reset
+
+To wipe local state and start fresh:
+
+```bash
+# Stop the servers first (Ctrl-C)
+rm ~/.arc/shares.json                 # clears CLI registry
+rm /tmp/arc-paste.db                  # arc-paste's blob DB (if used in step 3)
+
+# arc-server's paste tables live in arc.db alongside issues — to clear just paste state:
+sqlite3 ~/.arc/arc.db 'DELETE FROM paste_events; DELETE FROM paste_shares;'
+```
+
+## See also
+
+- [`docs/plans/2026-04-29-shared-review.md`](../plans/2026-04-29-shared-review.md) — design doc with full architecture, data model, and phasing
+- `internal/paste/` — Go package shared by `arc-server` and `arc-paste`
+- `arc-paste/` — standalone binary
+- `web/src/routes/share/[id]/` — SvelteKit UI
+- `cmd/arc/share.go` — CLI subcommands
+- `internal/sharesconfig/` — `~/.arc/shares.json` registry

From 649d47eee3df0dc52301f9cd6136a94780947159 Mon Sep 17 00:00:00 2001
From: Ben Firestone <ben.firestone@krypticlabs.com>
Date: Wed, 29 Apr 2026 19:35:35 -0700
Subject: [PATCH 15/20] feat(share): annotation editing, layout polish, config
 precedence
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

CLI
- Capture author identity at create time via new resolveAuthor helper:
  --author flag > share_author in cli-config.json > $ARC_SHARE_AUTHOR >
  `git config user.name`. Without an author, plan.author_name stays empty
  and the share UI's Accept/Resolve/Reject controls never appear — warn
  loudly when this happens.
- New share_server config field with the same precedence (flag > config >
  env > built-in default). Default URL is now arcplanner.sentiolabs.io.
- Wire up `--title` flag with filename-stem fallback so the SPA header
  shows a real title instead of "Untitled plan".
- printComments now applies edit events, mirroring the SPA's replay so
  `arc share comments` / `arc share pull` see refined wording, not stale.

Web
- Replace asymmetric-inset doc layout with mx-auto centering: equal gaps
  between the viewport edge → doc and doc → rail seam at any width.
- Add reviewer self-edit: new kind="edit" event references a comment by
  id and merges body / suggested_text / comment_type at replay time.
  Author gate (edit.author_name === comment.author_name) lives in the
  replay layer since the encrypted server can't enforce it. Inline edit
  UI in AnnotationCard appears only on the reviewer's own open comments;
  ⌘/Ctrl-⏎ saves, esc cancels. Card shows "edited Nm" indicator.
- Clamp floating overlays (CommentPopover, QuickLabelPicker,
  FloatingToolbar) to viewport bounds so they don't clip off-screen
  when the selection is near a margin.
- Detect macOS via userAgentData.platform → navigator.platform fallback;
  show ⌘ on Mac, Ctrl elsewhere in keyboard hints.

Tests
- 7 new replay-event tests (edit application, forged-edit rejection,
  multiple edits, keep-vs-clear semantics, orphan handling).
- 6 positioning-clamp tests, 8 platform-detection tests.
- TestResolveAuthor and TestResolveServer lock the precedence chains.
- TestRunShareCommentsAppliesEdits verifies CLI parity with SPA replay
  including a Mallory-forges-Steve's-edit case.

Docs
- New docs/review_howto.md explaining Accept/Resolve/Reject semantics
  for plan authors, oriented around the LLM-consumer workflow.
- Runbook updated with the new author/server config precedence and
  the reviewer self-edit step.
---
 cmd/arc/main.go                               |  19 ++
 cmd/arc/share.go                              | 194 ++++++++++++--
 cmd/arc/share_test.go                         | 236 +++++++++++++++++-
 docs/review_howto.md                          | 108 ++++++++
 docs/runbooks/paste-server.md                 |  39 ++-
 web/src/app.css                               |  29 +++
 web/src/lib/paste/events.test.ts              |  87 ++++++-
 web/src/lib/paste/events.ts                   |  23 ++
 web/src/lib/paste/types.ts                    |  30 ++-
 web/src/routes/share/[id]/+page.svelte        |  72 ++++--
 .../[id]/components/AnnotationCard.svelte     | 156 +++++++++++-
 .../[id]/components/AnnotationsPanel.svelte   |   5 +-
 .../[id]/components/CommentPopover.svelte     |  16 +-
 .../[id]/components/FloatingToolbar.svelte    |  22 +-
 .../[id]/components/QuickLabelPicker.svelte   |   6 +-
 .../share/[id]/components/platform.test.ts    |  91 +++++++
 .../routes/share/[id]/components/platform.ts  |  34 +++
 .../share/[id]/components/positioning.test.ts |  38 +++
 .../share/[id]/components/positioning.ts      |  33 +++
 web/vitest.config.ts                          |   5 +-
 20 files changed, 1184 insertions(+), 59 deletions(-)
 create mode 100644 docs/review_howto.md
 create mode 100644 web/src/routes/share/[id]/components/platform.test.ts
 create mode 100644 web/src/routes/share/[id]/components/platform.ts
 create mode 100644 web/src/routes/share/[id]/components/positioning.test.ts
 create mode 100644 web/src/routes/share/[id]/components/positioning.ts

diff --git a/cmd/arc/main.go b/cmd/arc/main.go
index 58fac14..be66ab3 100644
--- a/cmd/arc/main.go
+++ b/cmd/arc/main.go
@@ -79,6 +79,25 @@ func main() {
 type Config struct {
 	ServerURL string `json:"server_url"`
 	Channel   string `json:"channel,omitempty"`
+	// ShareAuthor is the default author name embedded in `arc share create`
+	// plans. It's the canonical reviewer identity used by the share UI to
+	// gate Accept / Resolve / Reject controls — only visitors who type this
+	// exact name in the SPA's prompt are recognized as the plan owner.
+	// Resolution precedence in `arc share create`:
+	//   1. --author flag (highest)
+	//   2. this config field
+	//   3. $ARC_SHARE_AUTHOR
+	//   4. `git config user.name`
+	ShareAuthor string `json:"share_author,omitempty"`
+	// ShareServer is the default URL for the remote paste server used by
+	// `arc share create --share`. Lets users persistently target a private
+	// arc-paste deployment instead of the public default.
+	// Resolution precedence in `arc share create --share`:
+	//   1. --server flag (highest)
+	//   2. this config field
+	//   3. $ARC_SHARE_SERVER
+	//   4. https://arcplanner.sentiolabs.io (built-in default)
+	ShareServer string `json:"share_server,omitempty"`
 }
 
 // ProjectSource indicates how the project was resolved
diff --git a/cmd/arc/share.go b/cmd/arc/share.go
index e224242..4782ade 100644
--- a/cmd/arc/share.go
+++ b/cmd/arc/share.go
@@ -10,6 +10,9 @@ import (
 	"net/http"
 	"net/url"
 	"os"
+	"os/exec"
+	"path/filepath"
+	"sort"
 	"strings"
 	"time"
 
@@ -59,6 +62,25 @@ type approvalEvent struct {
 	CreatedAt  string `json:"created_at"`
 }
 
+// editEvent is a reviewer revising their own annotation. Replay merges the
+// supplied fields onto the target comment in chronological order, gated on
+// the edit's author_name matching the original comment's. See the
+// EditEvent docstring in web/src/lib/paste/types.ts for the field semantics.
+//
+// Only `body`, `suggested_text`, and `comment_type` are editable. Pointer
+// fields distinguish "field omitted (keep)" from "field set to empty
+// (clear)" — Go zero values would conflate the two.
+type editEvent struct {
+	Kind        string  `json:"kind"` // always "edit"
+	ID          string  `json:"id"`
+	CommentID   string  `json:"comment_id"`
+	AuthorName  string  `json:"author_name"`
+	Body        *string `json:"body,omitempty"`
+	SuggestedText *string `json:"suggested_text,omitempty"`
+	CommentType *string `json:"comment_type,omitempty"`
+	CreatedAt   string  `json:"created_at"`
+}
+
 // --- commands ---
 
 var shareCmd = &cobra.Command{
@@ -125,6 +147,8 @@ var (
 	shareCreateLocal      bool
 	shareCreateRemote     bool
 	shareCreateServer     string
+	shareCreateAuthor     string
+	shareCreateTitle      string
 	shareCommentsAccepted bool
 	shareCommentsJSON     bool
 )
@@ -132,7 +156,9 @@ var (
 func init() {
 	shareCreateCmd.Flags().BoolVar(&shareCreateLocal, "local", false, "Use the local arc-server")
 	shareCreateCmd.Flags().BoolVar(&shareCreateRemote, "share", false, "Use the configured remote share server")
-	shareCreateCmd.Flags().StringVar(&shareCreateServer, "server", "", "Override server URL")
+	shareCreateCmd.Flags().StringVar(&shareCreateServer, "server", "", "Server URL override. With --share, resolution is: --server flag → share_server in ~/.arc/cli-config.json → $ARC_SHARE_SERVER → https://arcplanner.sentiolabs.io.")
+	shareCreateCmd.Flags().StringVar(&shareCreateAuthor, "author", "", "Author name embedded in the plan. Resolution: --author flag → share_author in ~/.arc/cli-config.json → $ARC_SHARE_AUTHOR → `git config user.name`. Reviewers who enter this exact name in the share UI gain Accept/Resolve/Reject controls.")
+	shareCreateCmd.Flags().StringVar(&shareCreateTitle, "title", "", "Optional plan title shown in the share UI header (defaults to the filename)")
 	shareCommentsCmd.Flags().BoolVar(&shareCommentsAccepted, "accepted-only", false, "Only print accepted comments")
 	shareCommentsCmd.Flags().BoolVar(&shareCommentsJSON, "json", false, "Output as JSON")
 
@@ -154,10 +180,24 @@ func runShareCreate(cmd *cobra.Command, args []string) error {
 	if err != nil {
 		return err
 	}
+	author := resolveAuthor(shareCreateAuthor)
+	if author == "" {
+		fmt.Fprintln(os.Stderr, "warning: no author name resolved.")
+		fmt.Fprintln(os.Stderr, "         Set one via --author, share_author in ~/.arc/cli-config.json,")
+		fmt.Fprintln(os.Stderr, "         $ARC_SHARE_AUTHOR, or `git config user.name`.")
+		fmt.Fprintln(os.Stderr, "         Without an author, Accept/Resolve/Reject controls in the share UI")
+		fmt.Fprintln(os.Stderr, "         stay hidden for every reviewer.")
+	}
+	title := shareCreateTitle
+	if title == "" {
+		title = strings.TrimSuffix(filepath.Base(planFile), ".md")
+	}
 	plain := planPlaintext{
-		Version:   1,
-		Markdown:  string(md),
-		CreatedAt: time.Now().UTC().Format(time.RFC3339),
+		Version:    1,
+		Markdown:   string(md),
+		Title:      title,
+		AuthorName: author,
+		CreatedAt:  time.Now().UTC().Format(time.RFC3339),
 	}
 	blob, iv, err := paste.EncryptJSON(plain, key)
 	if err != nil {
@@ -293,21 +333,72 @@ func runShareDelete(cmd *cobra.Command, args []string) error {
 
 // --- helpers ---
 
-// resolveServer returns the server URL and kind ("local" or "shared") based on
-// the provided flags.
-func resolveServer(local, share bool, override string) (string, string) {
-	if override != "" {
-		return override, "shared"
+// resolveAuthor returns the author name to embed in the plan plaintext.
+// Resolution order (highest priority first):
+//  1. explicit --author flag
+//  2. share_author in ~/.arc/cli-config.json
+//  3. $ARC_SHARE_AUTHOR
+//  4. `git config user.name`
+//
+// Returns "" if none of these produce a value.
+//
+// The author name is the only thing that lets the share UI distinguish the
+// plan owner from reviewers — when a visitor enters this exact name in the
+// SPA's name prompt, they get Accept/Resolve/Reject controls. Without it,
+// nobody is recognized as the author and the controls stay hidden for all.
+func resolveAuthor(flag string) string {
+	if s := strings.TrimSpace(flag); s != "" {
+		return s
+	}
+	if cfg, err := loadConfig(); err == nil {
+		if s := strings.TrimSpace(cfg.ShareAuthor); s != "" {
+			return s
+		}
+	}
+	if s := strings.TrimSpace(os.Getenv("ARC_SHARE_AUTHOR")); s != "" {
+		return s
+	}
+	out, err := exec.Command("git", "config", "user.name").Output()
+	if err != nil {
+		return ""
+	}
+	return strings.TrimSpace(string(out))
+}
+
+// resolveServer returns the server URL and kind ("local" or "shared") based
+// on the provided flags. For shared (remote) mode, the URL is resolved with
+// precedence:
+//
+//	--server flag > share_server in ~/.arc/cli-config.json > $ARC_SHARE_SERVER > https://arcplanner.sentiolabs.io
+//
+// For local mode, the server URL comes from `server_url` in the CLI config
+// (defaulting to http://localhost:7432). The `--server` flag still wins over
+// everything in either mode.
+func resolveServer(_ bool, share bool, override string) (string, string) {
+	if s := strings.TrimSpace(override); s != "" {
+		return s, "shared"
 	}
 	if share {
-		if env := os.Getenv("ARC_SHARE_SERVER"); env != "" {
-			return env, "shared"
-		}
-		return "https://share.arc.tools", "shared"
+		return resolveShareServer(), "shared"
 	}
 	return cliConfigServerURL(), "local"
 }
 
+// resolveShareServer returns the URL of the remote paste server, resolving in
+// precedence order: config > env > built-in default. (The flag is checked one
+// level up in resolveServer.)
+func resolveShareServer() string {
+	if cfg, err := loadConfig(); err == nil {
+		if s := strings.TrimSpace(cfg.ShareServer); s != "" {
+			return s
+		}
+	}
+	if s := strings.TrimSpace(os.Getenv("ARC_SHARE_SERVER")); s != "" {
+		return s
+	}
+	return "https://arcplanner.sentiolabs.io"
+}
+
 // cliConfigServerURL returns the server URL from the CLI config, falling back
 // to the default local URL.
 func cliConfigServerURL() string {
@@ -415,35 +506,96 @@ func fetchAndDecrypt(server, id string, key []byte) (*planPlaintext, []paste.Pas
 // printComments fetches all events, decrypts them, and prints comments to
 // stdout. When acceptedOnly is true only accepted comments are printed. When
 // asJSON is true each comment is printed as a JSON object.
+//
+// Replay logic mirrors web/src/lib/paste/events.ts:
+//   - 'comment' events seed the state map.
+//   - 'resolution' events set the status, gated on author_name matching the
+//     plan's author (so reviewers can't self-accept).
+//   - 'edit' events merge body/suggested_text/comment_type onto the target
+//     comment, gated on author_name matching the comment's original author.
+//
+// Events are ordered by created_at (then by id as a deterministic tiebreaker)
+// so the latest edit wins.
 func printComments(server, id string, key []byte, acceptedOnly, asJSON bool) error {
 	plan, events, err := fetchAndDecrypt(server, id, key)
 	if err != nil {
 		return err
 	}
-	comments := map[string]commentEvent{}
-	resolutions := map[string]resolutionEvent{}
+	type decoded struct {
+		kind string
+		raw  json.RawMessage
+		ts   string
+		eid  string
+	}
+	decodedEvents := make([]decoded, 0, len(events))
 	for _, e := range events {
 		var raw json.RawMessage
 		if err := paste.DecryptJSON(e.Blob, e.IV, key, &raw); err != nil {
 			continue
 		}
 		var generic struct {
-			Kind string `json:"kind"`
+			Kind      string `json:"kind"`
+			ID        string `json:"id"`
+			CreatedAt string `json:"created_at"`
+		}
+		if err := json.Unmarshal(raw, &generic); err != nil {
+			continue
+		}
+		decodedEvents = append(decodedEvents, decoded{
+			kind: generic.Kind,
+			raw:  raw,
+			ts:   generic.CreatedAt,
+			eid:  generic.ID,
+		})
+	}
+	// Stable chronological order for deterministic edit application.
+	sort.SliceStable(decodedEvents, func(i, j int) bool {
+		if decodedEvents[i].ts != decodedEvents[j].ts {
+			return decodedEvents[i].ts < decodedEvents[j].ts
 		}
-		_ = json.Unmarshal(raw, &generic)
-		switch generic.Kind {
+		return decodedEvents[i].eid < decodedEvents[j].eid
+	})
+
+	comments := map[string]commentEvent{}
+	resolutions := map[string]resolutionEvent{}
+	for _, d := range decodedEvents {
+		switch d.kind {
 		case "comment":
 			var c commentEvent
-			if err := json.Unmarshal(raw, &c); err == nil {
+			if err := json.Unmarshal(d.raw, &c); err == nil {
 				comments[c.ID] = c
 			}
 		case "resolution":
 			var r resolutionEvent
-			if err := json.Unmarshal(raw, &r); err == nil {
+			if err := json.Unmarshal(d.raw, &r); err == nil {
 				if plan.AuthorName == "" || r.AuthorName == plan.AuthorName {
 					resolutions[r.CommentID] = r
 				}
 			}
+		case "edit":
+			var ed editEvent
+			if err := json.Unmarshal(d.raw, &ed); err != nil {
+				continue
+			}
+			c, ok := comments[ed.CommentID]
+			if !ok {
+				continue
+			}
+			// Replay-time auth: only the comment's original author can
+			// edit it. Forged events are silently dropped.
+			if ed.AuthorName != c.AuthorName {
+				continue
+			}
+			if ed.Body != nil {
+				c.Body = *ed.Body
+			}
+			if ed.SuggestedText != nil {
+				c.SuggestedText = *ed.SuggestedText
+			}
+			if ed.CommentType != nil {
+				c.CommentType = *ed.CommentType
+			}
+			comments[ed.CommentID] = c
 		}
 	}
 	for cid, c := range comments {
@@ -470,7 +622,7 @@ func printComments(server, id string, key []byte, acceptedOnly, asJSON bool) err
 }
 
 // resolveShareRef parses a share reference which may be either a full share
-// URL (e.g. https://share.arc.tools/share/abc12345#k=KEY) or a bare share ID
+// URL (e.g. https://arcplanner.sentiolabs.io/share/abc12345#k=KEY) or a bare share ID
 // known to ~/.arc/shares.json.
 func resolveShareRef(ref string) (string, string, []byte, error) {
 	if strings.Contains(ref, "://") {
diff --git a/cmd/arc/share_test.go b/cmd/arc/share_test.go
index 06094ca..eff4741 100644
--- a/cmd/arc/share_test.go
+++ b/cmd/arc/share_test.go
@@ -64,11 +64,11 @@ func TestShareCreateRoundTrip(t *testing.T) {
 }
 
 func TestResolveShareRefFromURL(t *testing.T) {
-	id, server, key, err := resolveShareRef("https://share.arc.tools/share/abc12345#k=AAAA")
+	id, server, key, err := resolveShareRef("https://arcplanner.sentiolabs.io/share/abc12345#k=AAAA")
 	if err != nil {
 		t.Fatal(err)
 	}
-	if id != "abc12345" || server != "https://share.arc.tools" || len(key) == 0 {
+	if id != "abc12345" || server != "https://arcplanner.sentiolabs.io" || len(key) == 0 {
 		t.Errorf("bad parse: id=%s server=%s key=%v", id, server, key)
 	}
 }
@@ -108,6 +108,72 @@ func TestRunShareCommentsRoundTrip(t *testing.T) {
 	}
 }
 
+// TestRunShareCommentsAppliesEdits verifies that an `edit` event from the
+// comment's original author rewrites the body shown by `arc share comments`.
+// This locks in CLI parity with the SPA's replay logic.
+func TestRunShareCommentsAppliesEdits(t *testing.T) {
+	home := t.TempDir()
+	t.Setenv("HOME", home)
+	srv := startTestPasteServer(t)
+	defer srv.Close()
+
+	plan := filepath.Join(t.TempDir(), "p.md")
+	_ = os.WriteFile(plan, []byte("# P"), 0o644)
+	shareCreateServer = srv.URL
+	_ = runShareCreate(shareCreateCmd, []string{plan})
+
+	f, _ := sharesconfig.Load()
+	s := f.Shares[0]
+	keyBytes := mustDecodeKey(t, s.KeyB64Url)
+
+	postEv := func(t *testing.T, payload map[string]any) {
+		t.Helper()
+		blob, iv, err := paste.EncryptJSON(payload, keyBytes)
+		if err != nil {
+			t.Fatalf("encrypt: %v", err)
+		}
+		body, _ := json.Marshal(paste.AppendEventRequest{Blob: blob, IV: iv})
+		if err := postRaw(t, srv.URL+"/api/paste/"+s.ID+"/blobs", body); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	// 1) Steve posts a thin "expand this more" comment.
+	postEv(t, map[string]any{
+		"kind": "comment", "id": "c1", "author_name": "Steve", "comment_type": "comment",
+		"body":       "expand this more",
+		"anchor":     map[string]any{"line_start": 1, "line_end": 1, "quoted_text": "P"},
+		"created_at": "2026-04-29T00:00:00Z",
+	})
+
+	// 2) Steve revises it with a fully-formed thought.
+	postEv(t, map[string]any{
+		"kind": "edit", "id": "e1", "comment_id": "c1", "author_name": "Steve",
+		"body":       "the goal section should mention the success criteria for ‘validated’",
+		"created_at": "2026-04-29T00:05:00Z",
+	})
+
+	// 3) Mallory tries to forge an edit pretending to be Steve. (Wrong author_name
+	//    on the edit event; replay must drop it.)
+	postEv(t, map[string]any{
+		"kind": "edit", "id": "e2", "comment_id": "c1", "author_name": "Mallory",
+		"body":       "MALICIOUS REWRITE",
+		"created_at": "2026-04-29T00:06:00Z",
+	})
+
+	out := captureStdout(t, func() { _ = runShareComments(shareCommentsCmd, []string{s.ID}) })
+
+	if !strings.Contains(out, "success criteria") {
+		t.Errorf("expected edited body in output; got:\n%s", out)
+	}
+	if strings.Contains(out, "expand this more") {
+		t.Errorf("expected stale body to be replaced; got:\n%s", out)
+	}
+	if strings.Contains(out, "MALICIOUS REWRITE") {
+		t.Errorf("forged edit must be ignored at replay time; got:\n%s", out)
+	}
+}
+
 // mustDecodeKey decodes a base64url key or fatals the test.
 func mustDecodeKey(t *testing.T, b64 string) []byte {
 	t.Helper()
@@ -158,3 +224,169 @@ func captureStdout(t *testing.T, fn func()) string {
 func contains(s, substr string) bool {
 	return strings.Contains(s, substr)
 }
+
+// TestResolveAuthor locks in the resolution precedence:
+//
+//	flag > config file > env var > git config (lowest)
+//
+// We isolate from the user's real ~/.arc/cli-config.json by pointing the
+// global `configPath` at a temp file, and from the user's git identity by
+// running each subtest with $PATH cleared so `git` is unavailable (the
+// helper falls back silently to "" on git failure).
+func TestResolveAuthor(t *testing.T) {
+	// Save & restore globals touched by the helper.
+	origConfigPath := configPath
+	origEnv := os.Getenv("ARC_SHARE_AUTHOR")
+	origPath := os.Getenv("PATH")
+	t.Cleanup(func() {
+		configPath = origConfigPath
+		_ = os.Setenv("ARC_SHARE_AUTHOR", origEnv)
+		_ = os.Setenv("PATH", origPath)
+	})
+
+	// Strip git from PATH so the lowest tier resolves to "" deterministically.
+	_ = os.Setenv("PATH", "")
+
+	writeConfig := func(t *testing.T, author string) {
+		t.Helper()
+		dir := t.TempDir()
+		configPath = filepath.Join(dir, "cli-config.json")
+		body := `{"server_url":"http://localhost:7432"`
+		if author != "" {
+			body += `,"share_author":"` + author + `"`
+		}
+		body += `}`
+		if err := os.WriteFile(configPath, []byte(body), 0600); err != nil {
+			t.Fatalf("write config: %v", err)
+		}
+	}
+
+	t.Run("flag wins over everything", func(t *testing.T) {
+		writeConfig(t, "from-config")
+		_ = os.Setenv("ARC_SHARE_AUTHOR", "from-env")
+		if got := resolveAuthor("from-flag"); got != "from-flag" {
+			t.Errorf("flag should win; got %q", got)
+		}
+	})
+
+	t.Run("config wins over env when no flag", func(t *testing.T) {
+		writeConfig(t, "from-config")
+		_ = os.Setenv("ARC_SHARE_AUTHOR", "from-env")
+		if got := resolveAuthor(""); got != "from-config" {
+			t.Errorf("config should win over env; got %q", got)
+		}
+	})
+
+	t.Run("env wins when config empty", func(t *testing.T) {
+		writeConfig(t, "")
+		_ = os.Setenv("ARC_SHARE_AUTHOR", "from-env")
+		if got := resolveAuthor(""); got != "from-env" {
+			t.Errorf("env should win; got %q", got)
+		}
+	})
+
+	t.Run("flag whitespace is trimmed and treated as empty", func(t *testing.T) {
+		writeConfig(t, "from-config")
+		_ = os.Setenv("ARC_SHARE_AUTHOR", "")
+		if got := resolveAuthor("   "); got != "from-config" {
+			t.Errorf("whitespace flag should fall through; got %q", got)
+		}
+	})
+
+	t.Run("everything empty resolves to empty string", func(t *testing.T) {
+		writeConfig(t, "")
+		_ = os.Setenv("ARC_SHARE_AUTHOR", "")
+		if got := resolveAuthor(""); got != "" {
+			t.Errorf("expected empty; got %q", got)
+		}
+	})
+}
+
+// TestResolveServer locks in the share-server precedence:
+//
+//	--server flag > share_server in ~/.arc/cli-config.json > $ARC_SHARE_SERVER > built-in default
+//
+// We isolate from the user's real cli-config.json by pointing the global
+// `configPath` at a temp file. The `_, kind` return is asserted as
+// "shared" everywhere a flag/env/config resolution is expected, since
+// shared mode is the only branch that consults these sources.
+func TestResolveServer(t *testing.T) {
+	const builtinDefault = "https://arcplanner.sentiolabs.io"
+
+	origConfigPath := configPath
+	origEnv := os.Getenv("ARC_SHARE_SERVER")
+	t.Cleanup(func() {
+		configPath = origConfigPath
+		_ = os.Setenv("ARC_SHARE_SERVER", origEnv)
+	})
+
+	writeConfigShareServer := func(t *testing.T, server string) {
+		t.Helper()
+		dir := t.TempDir()
+		configPath = filepath.Join(dir, "cli-config.json")
+		body := `{"server_url":"http://localhost:7432"`
+		if server != "" {
+			body += `,"share_server":"` + server + `"`
+		}
+		body += `}`
+		if err := os.WriteFile(configPath, []byte(body), 0600); err != nil {
+			t.Fatalf("write config: %v", err)
+		}
+	}
+
+	t.Run("flag wins over everything", func(t *testing.T) {
+		writeConfigShareServer(t, "https://from-config.example")
+		_ = os.Setenv("ARC_SHARE_SERVER", "https://from-env.example")
+		got, kind := resolveServer(false, true, "https://from-flag.example")
+		if got != "https://from-flag.example" || kind != "shared" {
+			t.Errorf("flag should win; got (%q, %q)", got, kind)
+		}
+	})
+
+	t.Run("flag wins even without --share", func(t *testing.T) {
+		// The override flag is intentionally global — it forces shared mode
+		// regardless of which boolean flags are set, mirroring the previous
+		// behavior. Locked in here so it doesn't silently drift.
+		writeConfigShareServer(t, "https://from-config.example")
+		got, kind := resolveServer(true, false, "https://from-flag.example")
+		if got != "https://from-flag.example" || kind != "shared" {
+			t.Errorf("flag should win even without --share; got (%q, %q)", got, kind)
+		}
+	})
+
+	t.Run("config wins over env when no flag", func(t *testing.T) {
+		writeConfigShareServer(t, "https://from-config.example")
+		_ = os.Setenv("ARC_SHARE_SERVER", "https://from-env.example")
+		got, kind := resolveServer(false, true, "")
+		if got != "https://from-config.example" || kind != "shared" {
+			t.Errorf("config should win over env; got (%q, %q)", got, kind)
+		}
+	})
+
+	t.Run("env wins when config empty", func(t *testing.T) {
+		writeConfigShareServer(t, "")
+		_ = os.Setenv("ARC_SHARE_SERVER", "https://from-env.example")
+		got, kind := resolveServer(false, true, "")
+		if got != "https://from-env.example" || kind != "shared" {
+			t.Errorf("env should win; got (%q, %q)", got, kind)
+		}
+	})
+
+	t.Run("falls back to built-in default", func(t *testing.T) {
+		writeConfigShareServer(t, "")
+		_ = os.Setenv("ARC_SHARE_SERVER", "")
+		got, kind := resolveServer(false, true, "")
+		if got != builtinDefault || kind != "shared" {
+			t.Errorf("expected default; got (%q, %q)", got, kind)
+		}
+	})
+
+	t.Run("flag whitespace is trimmed and treated as empty", func(t *testing.T) {
+		writeConfigShareServer(t, "https://from-config.example")
+		_ = os.Setenv("ARC_SHARE_SERVER", "")
+		got, kind := resolveServer(false, true, "   ")
+		if got != "https://from-config.example" || kind != "shared" {
+			t.Errorf("whitespace flag should fall through; got (%q, %q)", got, kind)
+		}
+	})
+}
diff --git a/docs/review_howto.md b/docs/review_howto.md
new file mode 100644
index 0000000..f3879f3
--- /dev/null
+++ b/docs/review_howto.md
@@ -0,0 +1,108 @@
+# Reviewing a shared plan — how to use Accept / Resolve / Reject
+
+When someone shares a plan with you via `arc share create`, reviewers leave annotations and you (the plan author) close them out using one of three actions: **Accept**, **Resolve**, or **Reject**. This page explains what each one means, when to use each, and how they affect the downstream LLM consumer.
+
+## TL;DR
+
+| Action | Meaning | Flows to `arc share pull` (agent's queue)? |
+|---|---|---|
+| **Accept** | "I'll apply this to the plan." | ✅ Yes — `--accepted-only` is the default |
+| **Resolve** | "Acknowledged, but no plan change needed." | ❌ No — closes the thread without queueing |
+| **Reject** | "I disagree. Here's why (optional reply)." | ❌ No — reply preserved for the audit trail |
+| **Reopen** | "On second thought, this should be active again." | Resets to `open` |
+
+Mental shortcut:
+
+- **Accept** = "do this"
+- **Resolve** = "no-op, conversation done"
+- **Reject** = "no, and here's why"
+
+The discriminator is whether the comment should *cause an edit downstream*. Accept is the only path that does. Resolve and Reject both close the thread; the difference is whether the disagreement is worth recording — Reject preserves a reply, Resolve doesn't.
+
+## Concrete examples
+
+### Accept
+
+The comment proposes a real change you want made.
+
+> Steve: "The Goal section should mention success criteria for 'validated.'"
+
+→ Ben Accepts. → `arc share pull <id>` surfaces this. → Claude rewrites the Goal section.
+
+This is the path that produces actual plan edits. Treat Accept as a commitment to the change — once accepted, the comment locks (it stops being editable, since the meaning has been "consumed").
+
+### Resolve
+
+The comment is valid but no plan edit is needed.
+
+Cases:
+
+- **Clarifying question with a satisfying answer.** Steve: "Isn't 'validated' already defined in the previous brainstorm?" → It is. The comment helped clarify; no plan change needed. → Resolve.
+- **Already covered elsewhere.** Steve: "What about edge case X?" → You think about it, realize the existing design handles X via Y. The discussion is done; the plan doesn't need to change. → Resolve.
+- **Off-topic but harmless.** A comment that's interesting but not actionable in this plan.
+
+Resolve closes the thread without sending instructions downstream.
+
+### Reject
+
+The suggestion is wrong, out-of-scope, or contradicts a constraint, and you want the reasoning recorded.
+
+> Steve: "Add a section about caching."
+> Ben: caching is intentionally out of scope; we're tracking it in arc-1234.
+
+→ Reject with reply *"Caching is intentionally out of scope; tracked in arc-1234."*
+
+The reply is encrypted in the event log alongside the rejection. Two things happen:
+
+1. If Steve refreshes the share, he sees the rationale.
+2. The agent never tries to apply the change, but the reasoning is preserved if anyone (including Claude) re-reads the share later.
+
+Use Reject — not Resolve — whenever you'd want a future reader to know *why* you didn't act. It's the audit-trail action.
+
+## Why three states instead of two
+
+You could collapse Resolve and Reject into a single "Decline" — GitHub roughly does (it's just "Resolve conversation"). This UI keeps them separate because:
+
+- The consumer is often an **LLM agent** that may re-read the share later. A `resolved` comment is "we discussed this and moved on"; a `rejected` comment with a reply is "the author considered this and explicitly disagreed because X."
+- If you later ask Claude "why didn't we do the caching thing?", the rejected comment + reply gives it the exact answer. A resolved one leaves the question dangling.
+
+If in practice you find yourself never using one of these states, that's a signal we should simplify the UI. The current design errs on the side of preserving rationale, since "feedback that's helpful for an LLM" is the project's product goal.
+
+## Reviewers can refine their own comments
+
+A reviewer who left a thin comment ("expand this more") can revise it themselves before the author has acted on it. Look for the **✎ Edit** button on your own annotation cards — it's only visible while the comment is `open` or `reopened`.
+
+Once a comment is Accepted, Rejected, or Resolved, the edit button disappears. The reasoning: the author has already decided based on the wording at that moment, and changing it after the fact would be misleading.
+
+## What flows where
+
+```
+Reviewer posts annotation
+        │
+        ▼
+Comment status = open
+        │
+        ├── Author: Accept   ──► status=accepted ──► arc share pull picks it up ──► agent applies edit
+        ├── Author: Resolve  ──► status=resolved   (closed, no downstream effect)
+        ├── Author: Reject   ──► status=rejected   (closed, with reply for audit)
+        └── Author: Reopen   ──► status=open       (back in queue)
+```
+
+The CLI commands:
+
+```bash
+# Show all comments + statuses (for a human reading the discussion):
+arc share comments <id>
+
+# Show only accepted comments — the agent's actionable queue:
+arc share pull <id>          # alias for --accepted-only
+arc share comments <id> --accepted-only
+
+# Machine-readable form, used by the brainstorm skill:
+arc share comments <id> --json
+```
+
+## Related
+
+- [`docs/runbooks/paste-server.md`](runbooks/paste-server.md) — manual test runbook (covers the full flow including reviewer self-edits)
+- [`docs/plans/2026-04-29-shared-review.md`](plans/2026-04-29-shared-review.md) — full design doc with event schema, replay logic, and CRDT semantics
diff --git a/docs/runbooks/paste-server.md b/docs/runbooks/paste-server.md
index 663f568..b308e24 100644
--- a/docs/runbooks/paste-server.md
+++ b/docs/runbooks/paste-server.md
@@ -66,16 +66,36 @@ EOF
 ls -la ~/.arc/shares.json           # verify file mode 0600
 ```
 
+The author identity embedded in the plan is resolved in this order (highest to lowest priority):
+
+1. `--author "Name"` flag on `arc share create`
+2. `share_author` field in `~/.arc/cli-config.json` (set once, applies to every share you create)
+3. `$ARC_SHARE_AUTHOR` env var
+4. `git config user.name`
+
+**Note the name that gets used** — you'll need to type it back in the UI to claim the author role. If none of these produce a value, `arc share create` prints a warning and Accept/Resolve/Reject controls won't appear for anyone.
+
+To set a persistent default once:
+
+```bash
+# Edit ~/.arc/cli-config.json and add:
+#   "share_author": "Ben Firestone"
+# or, if you prefer:
+echo '{"share_author":"Ben Firestone"}' | jq -s '.[0] * .[1]' ~/.arc/cli-config.json - \
+  > ~/.arc/cli-config.json.tmp && mv ~/.arc/cli-config.json.tmp ~/.arc/cli-config.json
+```
+
 ### Exercise the UI
 
 Open the printed URL in Chrome/Firefox.
 
-1. **Name prompt** appears on first comment — type "Author"
+1. **Name prompt** appears on first comment — type the **same name** that was embedded as the author at create time (i.e. your `git config user.name` output, or whatever you passed to `--author`). The reviewer-name chip in the header will read `<name> · author` once the names match.
 2. **Highlight a paragraph** in the rendered plan → floating annotation toolbar appears
 3. **Pick a label** (`praise` / `issue` / `suggestion` / `question` / `nit`)
 4. **Type a comment**, optionally toggle "Suggest replacement text"
 5. **Post** — the comment appears in the sidebar
-6. As the author (your localStorage name matches `plan.author_name`), you'll see **Accept / Resolve / Reject** controls. Try Accept on one comment, Reject (with reply) on another, and Resolve on a third
+6. As the author (your localStorage name matches `plan.author_name`), you'll see **Accept / Resolve / Reject** controls. Try Accept on one comment, Reject (with reply) on another, and Resolve on a third. If the controls don't appear, double-check that the name in the header chip matches the value in `git config user.name` (or whatever you passed to `--author`) — the comparison is case- and whitespace-sensitive.
+7. As a reviewer (your localStorage name does NOT match the plan's author), find your own annotation in the sidebar. You should see an **✎ Edit** button on it. Click it; the body becomes a textarea pre-filled with your existing comment. Refine the wording — e.g. expand "expand this more" into a fully-formed suggestion — and **⌘/Ctrl-⏎** (or click Save). The card re-renders with `· edited Nm` next to the timestamp. Confirm `arc share comments <id>` prints the new body, not the original.
 
 ### Pull comments back to the CLI
 
@@ -89,7 +109,7 @@ Open the printed URL in Chrome/Firefox.
 
 Without spinning up another machine, open the same URL in an **incognito window** (or a different browser entirely). Incognito gets a fresh `localStorage`, so:
 
-1. The name prompt fires again — type "Reviewer-2"
+1. The name prompt fires again — type any name **other than** the embedded author name (e.g. "Reviewer-2"). The chip in the header should NOT show `· author`.
 2. Post a few comments
 3. Refresh the author's window → new comments replay in via `replayEvents()`
 
@@ -136,7 +156,17 @@ To exercise the actual "remote" code paths (cross-origin, no shared filesystem),
 ./bin/arc share create plan.md --share --server https://share.example.com
 ```
 
-Or set `ARC_SHARE_SERVER=https://share.example.com` once and just use `--share`.
+For a persistent default, set `share_server` in `~/.arc/cli-config.json`:
+
+```json
+{
+  "server_url": "http://localhost:7432",
+  "share_author": "Ben Firestone",
+  "share_server": "https://share.example.com"
+}
+```
+
+Then `arc share create plan.md --share` will pick it up without any flag or env var. The full precedence is `--server flag → share_server in cli-config.json → $ARC_SHARE_SERVER → https://arcplanner.sentiolabs.io`.
 
 ## 4. End-to-end via the brainstorm skill
 
@@ -158,6 +188,7 @@ Step 7 (review loop) uses `arc share approve` and `arc share pull` instead of th
 
 | Symptom | Cause | Fix |
 |---|---|---|
+| Accept / Resolve / Reject controls never appear, even when typing the "right" name | Plan was created without an author name (`arc share create` was run pre-fix, or `git config user.name` was empty and no `--author` flag passed). `plan.author_name` is empty, so `isAuthor` is `false` for every reviewer | Recreate the share with `--author "Your Name"` (or set `git config user.name` first), then enter that exact name in the SPA prompt |
 | `/share/<id>` returns `{"message":"Not Found"}` (Echo's default 404 JSON) | Binary built without the `webui` build tag — `web.RegisterSPA` is the no-op stub | Rebuild with `make build` (not `make build-quick`); for arc-paste use `go build -tags webui -o ./bin/arc-paste ./arc-paste` |
 | `/share/<id>` returns blank HTML / cannot find static assets | `web/build/` not present at compile time, even with the `webui` tag | Re-run `bun run build` in `web/`, then rebuild the binary |
 | SPA console says `missing #k=<key> in URL` | URL was pasted without its fragment | Use the full URL printed by `arc share create` — fragments are dropped by some chat apps; copy carefully |
diff --git a/web/src/app.css b/web/src/app.css
index 8c317de..7d76efa 100644
--- a/web/src/app.css
+++ b/web/src/app.css
@@ -688,6 +688,35 @@
    keeps its Refined Terminal aesthetic.
    ========================================================================== */
 
+/*
+ * Editorial spread layout — centered-doc composition.
+ *
+ * Two-column grid: [doc 1fr | rail 360]. The rail stays a fixed
+ * 360px notebook margin on the right. The doc-area fills the rest
+ * and centers its inner content (max-width 760px), so the gap on
+ * the left of the doc always equals the gap between the doc's right
+ * edge and the rail's left edge.
+ *
+ * Behavior across viewport widths:
+ *   - ultrawide (1920px viewport): doc-area is 1560px, doc is 760px,
+ *     gap is 400px on each side — visually centered between the
+ *     viewport edge and the rail.
+ *   - typical (1200px viewport): doc-area is 840px, doc is 760px,
+ *     gap is 40px on each side — close to flush but not pinned.
+ *   - narrow (≤1000px viewport): the doc fills its column, gaps
+ *     collapse to zero.
+ *
+ * `padding-inline` on the inner div keeps the prose from running into
+ * the column edges at any width, while `mx-auto` does the centering.
+ */
+.share-page {
+	grid-template-columns: minmax(0, 1fr) 360px;
+}
+.share-page .doc-inner {
+	margin-left: auto;
+	margin-right: auto;
+}
+
 .share-page {
 	--ink-paper: oklch(0.16 0.02 260);
 	--ink-paper-raised: oklch(0.2 0.015 260);
diff --git a/web/src/lib/paste/events.test.ts b/web/src/lib/paste/events.test.ts
index c0844ca..959e763 100644
--- a/web/src/lib/paste/events.test.ts
+++ b/web/src/lib/paste/events.test.ts
@@ -1,6 +1,6 @@
 import { describe, it, expect } from 'vitest';
 import { replayEvents, acceptedOnly } from './events';
-import type { CommentEvent, ResolutionEvent } from './types';
+import type { CommentEvent, EditEvent, ResolutionEvent } from './types';
 
 const c: CommentEvent = {
 	kind: 'comment',
@@ -46,4 +46,89 @@ describe('replayEvents', () => {
 		const states = replayEvents('Ben', [c, accept, reject]);
 		expect(states.get('c1')?.status).toBe('rejected');
 	});
+
+	describe('edit events', () => {
+		const baseEdit: EditEvent = {
+			kind: 'edit',
+			id: 'e1',
+			comment_id: 'c1',
+			author_name: 'Alice',
+			body: 'expanded reasoning: the issue is X because Y',
+			created_at: '2026-04-29T00:05:00Z'
+		};
+
+		it("applies edits to the original author's comment", () => {
+			const states = replayEvents('Ben', [c, baseEdit]);
+			const s = states.get('c1');
+			expect(s?.event.body).toBe('expanded reasoning: the issue is X because Y');
+			expect(s?.editedAt).toBe('2026-04-29T00:05:00Z');
+		});
+
+		it('discards edits forged by someone else', () => {
+			const forged: EditEvent = { ...baseEdit, author_name: 'Mallory' };
+			const states = replayEvents('Ben', [c, forged]);
+			const s = states.get('c1');
+			expect(s?.event.body).toBe('looks good'); // unchanged
+			expect(s?.editedAt).toBeUndefined();
+		});
+
+		it('applies multiple edits in chronological order', () => {
+			const second: EditEvent = {
+				...baseEdit,
+				id: 'e2',
+				body: 'final wording',
+				created_at: '2026-04-29T00:10:00Z'
+			};
+			// Pass them out of order to confirm sorting is what matters.
+			const states = replayEvents('Ben', [c, second, baseEdit]);
+			expect(states.get('c1')?.event.body).toBe('final wording');
+			expect(states.get('c1')?.editedAt).toBe('2026-04-29T00:10:00Z');
+		});
+
+		it('only updates fields explicitly present in the edit', () => {
+			const withSuggestion: CommentEvent = {
+				...c,
+				suggested_text: 'original replacement'
+			};
+			// Edit changes body but not suggested_text — original suggestion must persist.
+			const bodyOnly: EditEvent = {
+				...baseEdit,
+				body: 'new body',
+				suggested_text: undefined
+			};
+			const states = replayEvents('Ben', [withSuggestion, bodyOnly]);
+			expect(states.get('c1')?.event.body).toBe('new body');
+			expect(states.get('c1')?.event.suggested_text).toBe('original replacement');
+		});
+
+		it('treats empty string as an explicit clear', () => {
+			const withSuggestion: CommentEvent = {
+				...c,
+				suggested_text: 'replacement'
+			};
+			const clearSuggestion: EditEvent = {
+				...baseEdit,
+				body: undefined,
+				suggested_text: ''
+			};
+			const states = replayEvents('Ben', [withSuggestion, clearSuggestion]);
+			expect(states.get('c1')?.event.suggested_text).toBe('');
+		});
+
+		it('drops edits for nonexistent comments without throwing', () => {
+			const orphan: EditEvent = { ...baseEdit, comment_id: 'does-not-exist' };
+			const states = replayEvents('Ben', [c, orphan]);
+			expect(states.size).toBe(1); // c1 still present, orphan ignored
+		});
+
+		it('preserves resolution + edit interleaving', () => {
+			// Comment → accepted → edited. Status must remain 'accepted' but
+			// the body must reflect the edit (the author refining their note
+			// after acceptance).
+			const states = replayEvents('Ben', [c, accept, baseEdit]);
+			const s = states.get('c1');
+			expect(s?.status).toBe('accepted');
+			expect(s?.event.body).toBe('expanded reasoning: the issue is X because Y');
+		});
+	});
 });
diff --git a/web/src/lib/paste/events.ts b/web/src/lib/paste/events.ts
index 5eb76e1..4a21154 100644
--- a/web/src/lib/paste/events.ts
+++ b/web/src/lib/paste/events.ts
@@ -5,6 +5,12 @@ export type CommentState = {
 	status: 'open' | ResolutionStatus;
 	reply?: string;
 	replyAt?: string;
+	/**
+	 * Timestamp of the most recent successfully-applied EditEvent for this
+	 * comment. Undefined if the comment has never been edited. The UI uses
+	 * this to render an "edited" indicator.
+	 */
+	editedAt?: string;
 };
 
 export function replayEvents(
@@ -26,6 +32,23 @@ export function replayEvents(
 			target.status = e.status;
 			target.reply = e.reply;
 			target.replyAt = e.created_at;
+		} else if (e.kind === 'edit') {
+			const target = states.get(e.comment_id);
+			if (!target) continue;
+			// Only the original author of the comment can edit it. The server
+			// can't enforce this (events are encrypted) so the gate lives here.
+			if (e.author_name !== target.event.author_name) continue;
+			// Build a new event object with the supplied fields applied. We
+			// replace `target.event` rather than mutate so consumers that hold
+			// a stale reference don't see partial state during the merge.
+			target.event = {
+				...target.event,
+				body: e.body !== undefined ? e.body : target.event.body,
+				suggested_text:
+					e.suggested_text !== undefined ? e.suggested_text : target.event.suggested_text,
+				comment_type: e.comment_type !== undefined ? e.comment_type : target.event.comment_type
+			};
+			target.editedAt = e.created_at;
 		}
 	}
 	return states;
diff --git a/web/src/lib/paste/types.ts b/web/src/lib/paste/types.ts
index acfdbbe..2ebc9a6 100644
--- a/web/src/lib/paste/types.ts
+++ b/web/src/lib/paste/types.ts
@@ -86,6 +86,34 @@ export type ResolutionEvent = {
 	created_at: string;
 };
 
+/**
+ * A reviewer revising their own annotation. Append-only: rather than mutating
+ * the original CommentEvent blob, we emit a new EditEvent that references the
+ * target comment by id and supplies new field values. Replay merges these in
+ * chronological order, gated on `author_name === target.author_name` so only
+ * the original author's edits take effect.
+ *
+ * Only `body`, `suggested_text`, and `comment_type` can be edited. Changing
+ * `action` (comment vs delete) or `anchor` would change the meaning of the
+ * annotation — the reviewer should delete and re-create instead.
+ *
+ * Field semantics:
+ *   - `body` undefined  → keep current body
+ *   - `body` ""         → clear body (rare but valid)
+ *   - `body` non-empty  → replace body
+ * Same rules for `suggested_text` and `comment_type`.
+ */
+export type EditEvent = {
+	kind: 'edit';
+	id: string;
+	comment_id: string;
+	author_name: string;
+	body?: string;
+	suggested_text?: string;
+	comment_type?: CommentType;
+	created_at: string;
+};
+
 export type PlanEditEvent = {
 	kind: 'plan_edit';
 	id: string;
@@ -93,4 +121,4 @@ export type PlanEditEvent = {
 	created_at: string;
 };
 
-export type EventPlaintext = CommentEvent | ResolutionEvent | PlanEditEvent;
+export type EventPlaintext = CommentEvent | ResolutionEvent | EditEvent | PlanEditEvent;
diff --git a/web/src/routes/share/[id]/+page.svelte b/web/src/routes/share/[id]/+page.svelte
index f90987b..80a2bde 100644
--- a/web/src/routes/share/[id]/+page.svelte
+++ b/web/src/routes/share/[id]/+page.svelte
@@ -9,6 +9,7 @@
 		EventPlaintext,
 		CommentEvent,
 		CommentType,
+		EditEvent,
 		ResolutionEvent,
 		ResolutionStatus,
 		Anchor
@@ -257,6 +258,42 @@
 		}
 	}
 
+	async function handleEdit(
+		commentId: string,
+		body: string,
+		suggestedText: string | undefined
+	) {
+		if (!reviewerName) return;
+		const target = comments.get(commentId);
+		// The replay layer will reject mismatched authors anyway, but failing
+		// fast here avoids posting a useless event to the server.
+		if (!target || target.event.author_name !== reviewerName) return;
+
+		const event: EditEvent = {
+			kind: 'edit',
+			id: `e-${crypto.randomUUID()}`,
+			comment_id: commentId,
+			author_name: reviewerName,
+			body,
+			suggested_text: suggestedText,
+			created_at: new Date().toISOString()
+		};
+		await postEvent(event);
+
+		// Apply locally so the card updates without a round-trip refetch.
+		const next = new Map(comments);
+		next.set(commentId, {
+			...target,
+			event: {
+				...target.event,
+				body,
+				suggested_text: suggestedText !== undefined ? suggestedText : target.event.suggested_text
+			},
+			editedAt: event.created_at
+		});
+		comments = next;
+	}
+
 	async function handleResolve(commentId: string, status: ResolutionStatus, reply?: string) {
 		if (!reviewerName) return;
 		const event: ResolutionEvent = {
@@ -303,10 +340,12 @@
 	<title>{plan?.title ?? 'Plan review'} · arc</title>
 </svelte:head>
 
-<div class="share-page grid h-screen grid-cols-[1fr_360px]">
-	<!-- Document area: dark paper with subtle grain background -->
+<div class="share-page grid h-screen">
+	<!-- Document area: paper-grain sheet, viewport-centered between
+		 the phantom desk column on the left and the rail on the right.
+		 See `.share-page` rules in app.css for the grid geometry. -->
 	<main class="doc-area overflow-y-auto">
-		<div class="mx-auto flex max-w-[760px] flex-col px-10 py-12">
+		<div class="doc-inner flex max-w-[760px] flex-col px-10 py-12">
 			<header
 				class="mb-10 flex items-baseline justify-between border-b border-[var(--ink-rule)] pb-6"
 			>
@@ -356,17 +395,22 @@
 		</div>
 	</main>
 
-	<!-- Right rail: annotations panel -->
-	<div class="border-l border-[var(--ink-rule)] bg-[var(--ink-paper-raised)]">
-		<AnnotationsPanel
-			states={orderedStates}
-			{isAuthor}
-			{reviewerName}
-			activeId={activeMarkId}
-			onCardClick={handleCardClick}
-			onResolve={handleResolve}
-		/>
-	</div>
+	<!-- Right rail: annotations panel — sits in col 3 of the editorial spread. -->
+	<aside
+		class="rail-area overflow-y-auto border-l border-[var(--ink-rule)] bg-[var(--ink-paper-raised)]"
+	>
+		<div class="rail-inner mr-auto max-w-[360px]">
+			<AnnotationsPanel
+				states={orderedStates}
+				{isAuthor}
+				{reviewerName}
+				activeId={activeMarkId}
+				onCardClick={handleCardClick}
+				onResolve={handleResolve}
+				onEdit={handleEdit}
+			/>
+		</div>
+	</aside>
 
 	<!--
 		Floating overlays must live inside `.share-page` so they inherit the
diff --git a/web/src/routes/share/[id]/components/AnnotationCard.svelte b/web/src/routes/share/[id]/components/AnnotationCard.svelte
index 7aac5f8..dfc65e7 100644
--- a/web/src/routes/share/[id]/components/AnnotationCard.svelte
+++ b/web/src/routes/share/[id]/components/AnnotationCard.svelte
@@ -1,6 +1,8 @@
 <script lang="ts">
 	import type { CommentState } from '$lib/paste/events';
 	import type { ResolutionStatus } from '$lib/paste/types';
+	import { tick } from 'svelte';
+	import { modifierGlyph } from './platform.ts';
 
 	const {
 		entry,
@@ -8,7 +10,8 @@
 		reviewerName,
 		isActive = false,
 		onClick,
-		onResolve
+		onResolve,
+		onEdit
 	}: {
 		entry: CommentState;
 		isAuthor: boolean;
@@ -16,8 +19,11 @@
 		isActive?: boolean;
 		onClick: () => void;
 		onResolve: (status: ResolutionStatus, reply?: string) => Promise<void>;
+		onEdit: (body: string, suggestedText: string | undefined) => Promise<void>;
 	} = $props();
 
+	const modKey = modifierGlyph();
+
 	const e = $derived(entry.event);
 	const isMine = $derived(reviewerName !== null && e.author_name === reviewerName);
 	const isDelete = $derived(e.action === 'delete');
@@ -68,6 +74,67 @@
 
 	let showRejectReply = $state(false);
 	let rejectReply = $state('');
+
+	// Inline edit mode for the comment's author. The reviewer can refine their
+	// own annotation (e.g. expand "expand this more" into a fully-formed
+	// suggestion). Only `body` and `suggested_text` are editable here — the
+	// anchor and action stay frozen.
+	let isEditing = $state(false);
+	let editBody = $state('');
+	let editSuggested = $state('');
+	let editTextarea: HTMLTextAreaElement | undefined = $state();
+	let saving = $state(false);
+
+	// Edits are only meaningful while the comment is still under discussion.
+	// Once it's accepted/rejected/resolved the meaning has been "consumed" by
+	// the plan author — editing the body would be misleading.
+	const canEdit = $derived(
+		reviewerName !== null &&
+			e.author_name === reviewerName &&
+			(entry.status === 'open' || entry.status === 'reopened')
+	);
+
+	async function startEdit() {
+		editBody = e.body ?? '';
+		editSuggested = e.suggested_text ?? '';
+		isEditing = true;
+		await tick();
+		editTextarea?.focus();
+	}
+
+	function cancelEdit() {
+		isEditing = false;
+		editBody = '';
+		editSuggested = '';
+	}
+
+	async function saveEdit() {
+		if (saving) return;
+		const body = editBody.trim();
+		const suggested = e.suggested_text !== undefined ? editSuggested : undefined;
+		// Don't save if nothing actually changed — avoids polluting the event log.
+		if (body === (e.body ?? '') && suggested === (e.suggested_text ?? undefined)) {
+			cancelEdit();
+			return;
+		}
+		saving = true;
+		try {
+			await onEdit(body, suggested);
+			isEditing = false;
+		} finally {
+			saving = false;
+		}
+	}
+
+	function handleEditKey(ev: KeyboardEvent) {
+		if (ev.key === 'Escape') {
+			ev.preventDefault();
+			cancelEdit();
+		} else if (ev.key === 'Enter' && (ev.metaKey || ev.ctrlKey)) {
+			ev.preventDefault();
+			void saveEdit();
+		}
+	}
 </script>
 
 <div
@@ -104,7 +171,9 @@
 			{/if}
 		</div>
 		<span class="ui-mono text-[10px] text-[var(--ink-text-faint)]">
-			{timeLabel(e.created_at)}
+			{timeLabel(e.created_at)}{#if entry.editedAt}
+				<span title="Edited {entry.editedAt}"> · edited {timeLabel(entry.editedAt)}</span>
+			{/if}
 		</span>
 	</header>
 
@@ -127,8 +196,69 @@
 		"{e.anchor.quoted_text}"
 	</div>
 
-	<!-- Body / suggestion -->
-	{#if e.suggested_text}
+	<!-- Body / suggestion. In edit mode this becomes inline textareas for
+		 the comment's author to refine their own annotation. -->
+	{#if isEditing}
+		<div
+			class="mb-2 space-y-2"
+			onclick={(ev) => ev.stopPropagation()}
+			onkeydown={(ev) => ev.stopPropagation()}
+			role="presentation"
+		>
+			{#if e.suggested_text !== undefined}
+				<label class="block">
+					<span class="mb-1 block text-[10px] uppercase tracking-[0.08em] text-[var(--ink-text-faint)]">
+						Replacement
+					</span>
+					<textarea
+						bind:value={editSuggested}
+						rows="3"
+						placeholder="Replacement text…"
+						class="w-full rounded-md border border-[var(--ink-rule)] bg-[var(--ink-paper)] p-2 text-[13px] text-[var(--ink-text)] focus:border-[var(--ink-comment-edge)] focus:outline-none"
+						onkeydown={handleEditKey}
+					></textarea>
+				</label>
+			{/if}
+			<label class="block">
+				{#if e.suggested_text !== undefined}
+					<span class="mb-1 block text-[10px] uppercase tracking-[0.08em] text-[var(--ink-text-faint)]">
+						Reason (optional)
+					</span>
+				{/if}
+				<textarea
+					bind:this={editTextarea}
+					bind:value={editBody}
+					rows={e.suggested_text !== undefined ? 2 : 3}
+					placeholder={e.suggested_text !== undefined ? 'Why this change?' : 'Comment…'}
+					class="w-full rounded-md border border-[var(--ink-rule)] bg-[var(--ink-paper)] p-2 text-[13px] text-[var(--ink-text)] focus:border-[var(--ink-comment-edge)] focus:outline-none"
+					onkeydown={handleEditKey}
+				></textarea>
+			</label>
+			<div class="flex items-center justify-between">
+				<div class="text-[10px] text-[var(--ink-text-faint)]">
+					<kbd class="ui-mono rounded border border-[var(--ink-rule)] bg-[var(--ink-paper)] px-1 py-0.5">{modKey} ⏎</kbd>
+					to save · <kbd class="ui-mono rounded border border-[var(--ink-rule)] bg-[var(--ink-paper)] px-1 py-0.5">esc</kbd> to cancel
+				</div>
+				<div class="flex gap-2">
+					<button
+						type="button"
+						class="rounded-md px-2 py-1 text-[11px] text-[var(--ink-text-muted)] hover:bg-[var(--ink-paper)]"
+						onclick={cancelEdit}
+					>
+						Cancel
+					</button>
+					<button
+						type="button"
+						disabled={saving}
+						class="rounded-md border border-[var(--ink-comment-edge)] bg-[var(--ink-comment-bg)] px-2 py-1 text-[11px] font-medium text-[var(--ink-comment)] disabled:opacity-50"
+						onclick={saveEdit}
+					>
+						{saving ? 'Saving…' : 'Save'}
+					</button>
+				</div>
+			</div>
+		</div>
+	{:else if e.suggested_text}
 		<div class="mb-2 space-y-1">
 			<div class="text-[10px] uppercase tracking-[0.08em] text-[var(--ink-text-faint)]">
 				Replacement
@@ -152,7 +282,23 @@
 		</div>
 	{/if}
 
-	{#if isAuthor && !showRejectReply}
+	{#if canEdit && !isEditing && !showRejectReply}
+		<div class="mt-3 flex flex-wrap gap-1.5 border-t border-[var(--ink-rule)] pt-2">
+			<button
+				type="button"
+				class="rounded-md px-2 py-1 text-[11px] text-[var(--ink-text-muted)] hover:bg-[var(--ink-paper)]"
+				onclick={(ev) => {
+					ev.stopPropagation();
+					void startEdit();
+				}}
+				title="Edit your annotation"
+			>
+				✎ Edit
+			</button>
+		</div>
+	{/if}
+
+	{#if isAuthor && !showRejectReply && !isEditing}
 		<div class="mt-3 flex flex-wrap gap-1.5 border-t border-[var(--ink-rule)] pt-2">
 			{#if entry.status !== 'accepted'}
 				<button
diff --git a/web/src/routes/share/[id]/components/AnnotationsPanel.svelte b/web/src/routes/share/[id]/components/AnnotationsPanel.svelte
index 1c450d5..f31d282 100644
--- a/web/src/routes/share/[id]/components/AnnotationsPanel.svelte
+++ b/web/src/routes/share/[id]/components/AnnotationsPanel.svelte
@@ -8,7 +8,8 @@
 		reviewerName,
 		activeId,
 		onCardClick,
-		onResolve
+		onResolve,
+		onEdit
 	}: {
 		states: CommentState[];
 		isAuthor: boolean;
@@ -20,6 +21,7 @@
 			status: 'accepted' | 'rejected' | 'resolved' | 'reopened',
 			reply?: string
 		) => Promise<void>;
+		onEdit: (commentId: string, body: string, suggestedText: string | undefined) => Promise<void>;
 	} = $props();
 
 	const visibleStates = $derived(states); // could filter by status later
@@ -69,6 +71,7 @@
 							isActive={activeId === entry.event.id}
 							onClick={() => onCardClick(entry.event.id)}
 							onResolve={(status, reply) => onResolve(entry.event.id, status, reply)}
+							onEdit={(body, suggestedText) => onEdit(entry.event.id, body, suggestedText)}
 						/>
 					</li>
 				{/each}
diff --git a/web/src/routes/share/[id]/components/CommentPopover.svelte b/web/src/routes/share/[id]/components/CommentPopover.svelte
index 44b7071..f2ff294 100644
--- a/web/src/routes/share/[id]/components/CommentPopover.svelte
+++ b/web/src/routes/share/[id]/components/CommentPopover.svelte
@@ -1,8 +1,14 @@
 <script lang="ts">
 	import { onMount, onDestroy, tick } from 'svelte';
+	import { clampedAnchorLeft } from './positioning.ts';
+	import { modifierGlyph } from './platform.ts';
 
 	export type PopoverMode = 'comment' | 'suggest';
 
+	const POPOVER_WIDTH = 360; // must match `w-[360px]` on the popover element
+
+	const modKey = modifierGlyph();
+
 	const {
 		anchorRect,
 		mode,
@@ -29,11 +35,15 @@
 	});
 
 	function computePosition(rect: DOMRect, m: PopoverMode): { top: number; left: number } {
-		// Same anchoring as toolbar: above the selection.
+		// Same anchoring as toolbar: above the selection. `left` is the
+		// horizontal center the caller will pair with `translateX(-50%)`,
+		// so we clamp to the viewport so the popover doesn't clip off-screen
+		// when the selection is near the doc's left or right edge.
 		const POPOVER_HEIGHT = m === 'suggest' ? 200 : 120;
 		const GAP = 12;
 		const top = rect.top + window.scrollY - POPOVER_HEIGHT - GAP;
-		const left = rect.left + window.scrollX + rect.width / 2;
+		const rawLeft = rect.left + window.scrollX + rect.width / 2;
+		const left = clampedAnchorLeft(rawLeft, POPOVER_WIDTH, window.innerWidth);
 		return { top: Math.max(8 + window.scrollY, top), left };
 	}
 
@@ -119,7 +129,7 @@
 	<div class="mt-3 flex items-center justify-between gap-2">
 		<div class="text-[10px] text-[var(--ink-text-faint)]">
 			<kbd class="ui-mono rounded border border-[var(--ink-rule)] bg-[var(--ink-paper)] px-1 py-0.5"
-				>⌘ ⏎</kbd
+				>{modKey} ⏎</kbd
 			>
 			to save ·
 			<kbd class="ui-mono rounded border border-[var(--ink-rule)] bg-[var(--ink-paper)] px-1 py-0.5"
diff --git a/web/src/routes/share/[id]/components/FloatingToolbar.svelte b/web/src/routes/share/[id]/components/FloatingToolbar.svelte
index 0fb6e15..f136502 100644
--- a/web/src/routes/share/[id]/components/FloatingToolbar.svelte
+++ b/web/src/routes/share/[id]/components/FloatingToolbar.svelte
@@ -1,5 +1,6 @@
 <script lang="ts">
-	import { onMount, onDestroy } from 'svelte';
+	import { onMount, onDestroy, tick } from 'svelte';
+	import { clampedAnchorLeft } from './positioning.ts';
 
 	export type ToolbarAction = 'praise' | 'comment' | 'delete' | 'suggest' | 'quick-label';
 
@@ -14,16 +15,22 @@
 	} = $props();
 
 	let toolbar: HTMLDivElement | undefined = $state();
+	// Measured after the toolbar mounts (its width is content-driven, so we
+	// can't know it ahead of time). We seed with a conservative upper bound
+	// (220px) so the first paint is already clamped sensibly; the measured
+	// value then refines it on the next tick.
+	let measuredWidth = $state(220);
 
-	function computePosition(rect: DOMRect): { top: number; left: number } {
+	function computePosition(rect: DOMRect, width: number): { top: number; left: number } {
 		const TOOLBAR_HEIGHT = 44;
 		const GAP = 12;
 		const top = rect.top + window.scrollY - TOOLBAR_HEIGHT - GAP;
-		const left = rect.left + window.scrollX + rect.width / 2;
+		const rawLeft = rect.left + window.scrollX + rect.width / 2;
+		const left = clampedAnchorLeft(rawLeft, width, window.innerWidth);
 		return { top: Math.max(8 + window.scrollY, top), left };
 	}
 
-	const position = $derived(computePosition(anchorRect));
+	const position = $derived(computePosition(anchorRect, measuredWidth));
 
 	function handleKeydown(e: KeyboardEvent) {
 		if (e.key === 'Escape') {
@@ -40,9 +47,14 @@
 		onDismiss();
 	}
 
-	onMount(() => {
+	onMount(async () => {
 		document.addEventListener('keydown', handleKeydown);
 		document.addEventListener('mousedown', handleDocumentClick);
+		// Wait one tick so the toolbar has rendered, then measure it. This
+		// refines `measuredWidth` from the seed (220) to the true rendered
+		// width — typically ~200px depending on the icon set.
+		await tick();
+		if (toolbar) measuredWidth = toolbar.offsetWidth;
 	});
 
 	onDestroy(() => {
diff --git a/web/src/routes/share/[id]/components/QuickLabelPicker.svelte b/web/src/routes/share/[id]/components/QuickLabelPicker.svelte
index 155f9f0..d045350 100644
--- a/web/src/routes/share/[id]/components/QuickLabelPicker.svelte
+++ b/web/src/routes/share/[id]/components/QuickLabelPicker.svelte
@@ -1,6 +1,9 @@
 <script lang="ts">
 	import { onMount, onDestroy } from 'svelte';
 	import type { CommentType } from '$lib/paste/types';
+	import { clampedAnchorLeft } from './positioning.ts';
+
+	const PICKER_WIDTH = 220; // must match `w-[220px]` on the picker element
 
 	const {
 		anchorRect,
@@ -26,7 +29,8 @@
 		const HEIGHT = 220;
 		const GAP = 12;
 		const top = rect.top + window.scrollY - HEIGHT - GAP;
-		const left = rect.left + window.scrollX + rect.width / 2;
+		const rawLeft = rect.left + window.scrollX + rect.width / 2;
+		const left = clampedAnchorLeft(rawLeft, PICKER_WIDTH, window.innerWidth);
 		return { top: Math.max(8 + window.scrollY, top), left };
 	}
 
diff --git a/web/src/routes/share/[id]/components/platform.test.ts b/web/src/routes/share/[id]/components/platform.test.ts
new file mode 100644
index 0000000..3eb17f6
--- /dev/null
+++ b/web/src/routes/share/[id]/components/platform.test.ts
@@ -0,0 +1,91 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { isMacLike, modifierGlyph } from './platform';
+
+// Snapshot the original navigator so each test starts from a clean baseline.
+// We replace it wholesale (rather than mutate) because `navigator.platform`
+// is read-only in some environments.
+const originalNavigator = globalThis.navigator;
+
+// `Navigator.platform` is typed as a narrow literal union by TypeScript's
+// DOM lib, but the runtime value is a free-form string and our helper does a
+// case-insensitive substring check. Use a loose record so tests can stub
+// arbitrary platform strings (e.g. "macppc", "Linux x86_64") without
+// fighting the type system.
+function setNavigator(stub: { platform?: string; userAgentData?: { platform?: string } }) {
+	Object.defineProperty(globalThis, 'navigator', {
+		value: stub,
+		writable: true,
+		configurable: true
+	});
+}
+
+describe('isMacLike', () => {
+	beforeEach(() => {
+		// Default: an empty navigator so individual tests opt into a platform.
+		setNavigator({ platform: '' });
+	});
+
+	afterEach(() => {
+		Object.defineProperty(globalThis, 'navigator', {
+			value: originalNavigator,
+			writable: true,
+			configurable: true
+		});
+	});
+
+	it('returns true when userAgentData.platform is "macOS"', () => {
+		setNavigator({ platform: 'unused', userAgentData: { platform: 'macOS' } });
+		expect(isMacLike()).toBe(true);
+	});
+
+	it('returns false when userAgentData.platform is non-macOS', () => {
+		setNavigator({ platform: 'MacIntel', userAgentData: { platform: 'Linux' } });
+		// Modern UA-Client-Hints take priority — even if the deprecated
+		// `platform` string lies, we trust the new API first.
+		expect(isMacLike()).toBe(false);
+	});
+
+	it('falls back to navigator.platform when userAgentData is absent', () => {
+		setNavigator({ platform: 'MacIntel' });
+		expect(isMacLike()).toBe(true);
+	});
+
+	it('matches case-insensitively in the legacy fallback', () => {
+		setNavigator({ platform: 'macppc' });
+		expect(isMacLike()).toBe(true);
+	});
+
+	it('returns false for Linux', () => {
+		setNavigator({ platform: 'Linux x86_64' });
+		expect(isMacLike()).toBe(false);
+	});
+
+	it('returns false for Windows', () => {
+		setNavigator({ platform: 'Win32' });
+		expect(isMacLike()).toBe(false);
+	});
+});
+
+describe('modifierGlyph', () => {
+	beforeEach(() => {
+		setNavigator({ platform: '' });
+	});
+
+	afterEach(() => {
+		Object.defineProperty(globalThis, 'navigator', {
+			value: originalNavigator,
+			writable: true,
+			configurable: true
+		});
+	});
+
+	it('returns ⌘ on macOS', () => {
+		setNavigator({ platform: 'MacIntel' });
+		expect(modifierGlyph()).toBe('⌘');
+	});
+
+	it('returns Ctrl elsewhere', () => {
+		setNavigator({ platform: 'Linux' });
+		expect(modifierGlyph()).toBe('Ctrl');
+	});
+});
diff --git a/web/src/routes/share/[id]/components/platform.ts b/web/src/routes/share/[id]/components/platform.ts
new file mode 100644
index 0000000..e94e1b5
--- /dev/null
+++ b/web/src/routes/share/[id]/components/platform.ts
@@ -0,0 +1,34 @@
+/**
+ * Platform detection for displaying the right keyboard-shortcut glyph.
+ *
+ * Mac users expect ⌘ ⏎; everyone else expects Ctrl ⏎. The keyboard
+ * handlers already accept both `metaKey` and `ctrlKey`, so this only
+ * affects the on-screen hint.
+ *
+ * Detection strategy:
+ *   1. `navigator.userAgentData.platform` — modern, available in Chromium.
+ *   2. `navigator.platform` — deprecated but still populated by every
+ *      browser. We use `.toLowerCase().includes('mac')` to also catch
+ *      the older "MacIntel" / "MacPPC" values.
+ *   3. SSR fallback — return false. The first client paint will correct
+ *      itself; SvelteKit's `+page.svelte` renders client-side after the
+ *      paste blob decrypts anyway, so we never actually hit SSR for the
+ *      share UI.
+ */
+export function isMacLike(): boolean {
+	if (typeof navigator === 'undefined') return false;
+	type UAData = { platform?: string };
+	const uaData = (navigator as Navigator & { userAgentData?: UAData }).userAgentData;
+	if (uaData?.platform) {
+		return uaData.platform === 'macOS';
+	}
+	return navigator.platform.toLowerCase().includes('mac');
+}
+
+/**
+ * Glyph shown for the modifier in `<modifier> ⏎` keyboard hints.
+ * `⌘` on macOS, `Ctrl` everywhere else.
+ */
+export function modifierGlyph(): string {
+	return isMacLike() ? '⌘' : 'Ctrl';
+}
diff --git a/web/src/routes/share/[id]/components/positioning.test.ts b/web/src/routes/share/[id]/components/positioning.test.ts
new file mode 100644
index 0000000..80a6da2
--- /dev/null
+++ b/web/src/routes/share/[id]/components/positioning.test.ts
@@ -0,0 +1,38 @@
+import { describe, it, expect } from 'vitest';
+import { clampedAnchorLeft } from './positioning';
+
+describe('clampedAnchorLeft', () => {
+	it('returns the raw center when the overlay fits without clipping', () => {
+		// 360px overlay at center 600 in a 1200px viewport: extends 420..780,
+		// clear of both 8px margins.
+		expect(clampedAnchorLeft(600, 360, 1200)).toBe(600);
+	});
+
+	it('pushes overlay rightward when selection is too close to the left edge', () => {
+		// 360px overlay anchored at center 50 would extend -130..230, clipping
+		// past the left edge. Clamp must push the center to 8 + 180 = 188.
+		expect(clampedAnchorLeft(50, 360, 1200)).toBe(188);
+	});
+
+	it('pushes overlay leftward when selection is too close to the right edge', () => {
+		// 360px overlay anchored at center 1180 would extend 1000..1360,
+		// clipping past the right edge. Clamp must pull center to 1200 - 8 - 180 = 1012.
+		expect(clampedAnchorLeft(1180, 360, 1200)).toBe(1012);
+	});
+
+	it('respects a custom margin', () => {
+		// With a 20px margin, the left clamp is 20 + 180 = 200.
+		expect(clampedAnchorLeft(50, 360, 1200, 20)).toBe(200);
+	});
+
+	it('falls back to pinning when overlay is wider than viewport', () => {
+		// 800px overlay in a 600px viewport can never satisfy both bounds.
+		// Behavior: pin to left margin (start of controls visible).
+		expect(clampedAnchorLeft(300, 800, 600)).toBe(8 + 400);
+	});
+
+	it('handles selection exactly at the left clamp threshold', () => {
+		// 360px overlay, viewport 1200, margin 8 → minLeft = 188. At 188 no clamp needed.
+		expect(clampedAnchorLeft(188, 360, 1200)).toBe(188);
+	});
+});
diff --git a/web/src/routes/share/[id]/components/positioning.ts b/web/src/routes/share/[id]/components/positioning.ts
new file mode 100644
index 0000000..ff615b9
--- /dev/null
+++ b/web/src/routes/share/[id]/components/positioning.ts
@@ -0,0 +1,33 @@
+/**
+ * Positioning helpers for the floating overlays (toolbar, popover, picker).
+ *
+ * Each overlay anchors above the user's selection. The naive computation —
+ * `rect.left + rect.width/2` paired with `transform: translateX(-50%)` —
+ * works in isolation but clips the overlay off-screen when the selection
+ * is near the viewport's left or right edge. With the share page's
+ * asymmetric inset (doc sits ~72px from the left), a comment popover
+ * (360px wide) anchored to a selection at the start of the prose column
+ * extends ~108px past the left edge of the viewport.
+ *
+ * `clampedAnchorLeft` returns the `left` value to plug into the overlay's
+ * inline style. The caller still applies `translateX(-50%)`. After clamping,
+ * the overlay's edges are guaranteed to sit within `[margin, viewportWidth -
+ * margin]`. If the overlay is wider than the viewport, we fall back to
+ * pinning it to the left margin (degenerate but never broken).
+ */
+export function clampedAnchorLeft(
+	selectionCenter: number,
+	overlayWidth: number,
+	viewportWidth: number,
+	margin = 8
+): number {
+	const half = overlayWidth / 2;
+	const minLeft = margin + half;
+	const maxLeft = viewportWidth - margin - half;
+	if (minLeft > maxLeft) {
+		// Overlay wider than viewport — pin to the left margin so the user
+		// at least sees the start of the controls. They can scroll if needed.
+		return margin + half;
+	}
+	return Math.min(Math.max(selectionCenter, minLeft), maxLeft);
+}
diff --git a/web/vitest.config.ts b/web/vitest.config.ts
index 2d7798f..d1c3ef3 100644
--- a/web/vitest.config.ts
+++ b/web/vitest.config.ts
@@ -6,7 +6,10 @@ export default defineConfig({
 		// tests we added. The rest of the suite uses Bun's native runner
 		// (`import from 'bun:test'`) or Playwright (e2e) and isn't compatible
 		// with Vitest's runtime.
-		include: ['src/lib/paste/**/*.{test,spec}.{js,ts}'],
+		include: [
+			'src/lib/paste/**/*.{test,spec}.{js,ts}',
+			'src/routes/share/**/*.{test,spec}.{js,ts}'
+		],
 		environment: 'node'
 	}
 });

From 9039fa6747b87b015807d6c2be5dbd5a470947a0 Mon Sep 17 00:00:00 2001
From: Ben Firestone <ben.firestone@krypticlabs.com>
Date: Wed, 29 Apr 2026 19:43:14 -0700
Subject: [PATCH 16/20] build(arc-paste): scratch image with Go 1.26, compose
 deployment
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Dockerfile rewritten as a 3-stage build:
  - Stage 1: bun:1-alpine builds the SvelteKit SPA (matches local toolchain).
  - Stage 2: golang:1.26-alpine compiles a static binary with `-tags webui`,
    `-trimpath`, and `-ldflags='-s -w'` for a smaller, reproducible artifact.
    The previous Dockerfile was missing `-tags webui`, which would have
    produced a binary where /share/<id> returned Echo's default JSON 404
    because web.RegisterSPA was the no-op stub.
  - Stage 3: scratch — just the binary, ~10 MB final image.

arc-paste/main.go now MkdirAll's the SQLite parent dir on startup, so
fresh volumes / nested DB paths work without an init step. This matters
on scratch where the binary can't rely on a base image creating /data,
and helps any deploy that points ARC_PASTE_DB at a path the host hasn't
pre-created.

arc-paste/compose.yaml ships alongside, with a named volume for SQLite
persistence, port 7433, restart: unless-stopped, and a comment explaining
why no in-container healthcheck (scratch has no shell). Build with:
  docker compose -f arc-paste/compose.yaml up -d --build

Runbook updated with the Docker option in the remote-review section.
---
 arc-paste/Dockerfile          | 57 +++++++++++++++++++++++++++++------
 arc-paste/compose.yaml        | 40 ++++++++++++++++++++++++
 arc-paste/main.go             | 10 ++++++
 docs/runbooks/paste-server.md |  9 ++++++
 4 files changed, 106 insertions(+), 10 deletions(-)
 create mode 100644 arc-paste/compose.yaml

diff --git a/arc-paste/Dockerfile b/arc-paste/Dockerfile
index be1f5f5..ec4aa64 100644
--- a/arc-paste/Dockerfile
+++ b/arc-paste/Dockerfile
@@ -1,22 +1,59 @@
-# Stage 1: Build the web UI
-FROM node:20-alpine AS web
+# syntax=docker/dockerfile:1.7
+#
+# Three-stage build for arc-paste:
+#   1. `web` builds the SvelteKit SPA with bun (matches local toolchain)
+#   2. `go-build` compiles a fully-static Go binary with the embedded SPA.
+#      `-tags webui` is REQUIRED — without it `web.RegisterSPA` is a no-op
+#      stub and `/share/<id>` returns Echo's default JSON 404.
+#   3. Final image is `scratch` — no shell, no libc, just the binary.
+#
+# Build from the repo root, not arc-paste/, since stage 2 needs the Go module.
+#   docker build -f arc-paste/Dockerfile -t arc-paste:latest .
+
+# ─── Stage 1: SvelteKit SPA build ────────────────────────────────────────────
+FROM oven/bun:1-alpine AS web
 WORKDIR /web
+
+# Install deps in their own layer so source-only changes don't bust the cache.
 COPY web/package.json web/bun.lock* ./
-RUN npm install
-COPY web .
-RUN npm run build
+RUN bun install --frozen-lockfile
+
+COPY web/ ./
+RUN bun run build
 
-# Stage 2: Build the Go binary
-FROM golang:1.23-alpine AS go-build
+# ─── Stage 2: static Go binary ───────────────────────────────────────────────
+FROM golang:1.26-alpine AS go-build
 WORKDIR /build
+
+# Module download is its own cache layer too.
 COPY go.mod go.sum ./
 RUN go mod download
+
+# Bring in source + the SPA bundle the build tag will embed.
 COPY . .
 COPY --from=web /web/build ./web/build
-RUN CGO_ENABLED=0 go build -o /out/arc-paste ./arc-paste
 
-# Stage 3: Runtime container
-FROM gcr.io/distroless/static-debian12
+# CGO_ENABLED=0 → fully static, no glibc dependency, runs on scratch.
+# -tags webui   → embed the SPA (without it, the SPA returns 404).
+# -trimpath     → strip absolute paths from the binary (smaller + reproducible).
+# -ldflags '-s -w' → drop DWARF + symbol tables (~20% smaller binary).
+RUN CGO_ENABLED=0 GOOS=linux go build \
+    -tags webui \
+    -trimpath \
+    -ldflags='-s -w' \
+    -o /out/arc-paste \
+    ./arc-paste
+
+# ─── Stage 3: minimal runtime ────────────────────────────────────────────────
+FROM scratch
+
 COPY --from=go-build /out/arc-paste /arc-paste
+
+# Default DB lives under /data; mount a volume here to persist across restarts.
+# arc-paste creates the directory itself, so this works even without a volume.
+ENV ARC_PASTE_DB=/data/arc-paste.db
+ENV ARC_PASTE_ADDR=:7433
+
 EXPOSE 7433
+
 ENTRYPOINT ["/arc-paste"]
diff --git a/arc-paste/compose.yaml b/arc-paste/compose.yaml
new file mode 100644
index 0000000..1ed5118
--- /dev/null
+++ b/arc-paste/compose.yaml
@@ -0,0 +1,40 @@
+# arc-paste compose — standalone deployment of the encrypted paste service.
+#
+# Build the image and start the service:
+#   docker compose -f arc-paste/compose.yaml up -d --build
+# Tail logs:
+#   docker compose -f arc-paste/compose.yaml logs -f
+# Stop:
+#   docker compose -f arc-paste/compose.yaml down
+#
+# The Dockerfile lives in arc-paste/ but builds from the repo root because it
+# needs the parent Go module — that's what `context: ..` below selects.
+
+services:
+  arc-paste:
+    build:
+      context: ..
+      dockerfile: arc-paste/Dockerfile
+    image: arc-paste:latest
+    container_name: arc-paste
+    ports:
+      - "7433:7433"
+    volumes:
+      # Named volume keeps the SQLite db across container rebuilds.
+      # arc-paste creates the directory itself on startup, so a fresh
+      # volume works without any init step.
+      - arc-paste-data:/data
+    environment:
+      - TZ=UTC
+      # Defaults set in the Dockerfile; uncomment to override per deployment:
+      # - ARC_PASTE_ADDR=:7433
+      # - ARC_PASTE_DB=/data/arc-paste.db
+    restart: unless-stopped
+    # No healthcheck: the runtime image is `scratch`, which has no shell,
+    # wget, curl, or anything else compose's `healthcheck.test` could exec.
+    # For production monitoring, run an external probe (Cloudflare health
+    # check, Uptime Kuma, etc.) against the host port instead.
+
+volumes:
+  arc-paste-data:
+    name: arc-paste-data
diff --git a/arc-paste/main.go b/arc-paste/main.go
index 4b27047..03f4b4d 100644
--- a/arc-paste/main.go
+++ b/arc-paste/main.go
@@ -8,6 +8,7 @@ import (
 	"database/sql"
 	"log"
 	"os"
+	"path/filepath"
 
 	"github.com/labstack/echo/v4"
 	"github.com/labstack/echo/v4/middleware"
@@ -22,6 +23,15 @@ func main() {
 	addr := envOr("ARC_PASTE_ADDR", ":7433")
 	dbPath := envOr("ARC_PASTE_DB", "./arc-paste.db")
 
+	// Ensure the parent directory exists. SQLite will create the db file but
+	// not the directory, which matters when running under scratch / distroless
+	// images that mount a fresh volume at a path the binary has never seen.
+	if dir := filepath.Dir(dbPath); dir != "." && dir != "/" {
+		if err := os.MkdirAll(dir, 0o755); err != nil {
+			log.Fatalf("create db dir %q: %v", dir, err)
+		}
+	}
+
 	db, err := sql.Open("sqlite", dbPath)
 	if err != nil {
 		log.Fatalf("open db: %v", err)
diff --git a/docs/runbooks/paste-server.md b/docs/runbooks/paste-server.md
index b308e24..4502a7e 100644
--- a/docs/runbooks/paste-server.md
+++ b/docs/runbooks/paste-server.md
@@ -126,6 +126,15 @@ Remote mode runs the standalone `arc-paste` binary (a thin wrapper around the sa
 ARC_PASTE_ADDR=:7433 ARC_PASTE_DB=/tmp/arc-paste.db ./bin/arc-paste
 ```
 
+Or via Docker (uses the `arc-paste/Dockerfile` scratch image and a named volume):
+
+```bash
+docker compose -f arc-paste/compose.yaml up -d --build
+docker compose -f arc-paste/compose.yaml logs -f
+```
+
+The compose file binds host port 7433, persists SQLite to the `arc-paste-data` named volume, and sets `restart: unless-stopped`. Note: the runtime image is `scratch`, so there's no in-container healthcheck — pair with an external probe (Cloudflare health check, Uptime Kuma, etc.) for production.
+
 ### Create a shared paste pointed at the standalone server
 
 ```bash

From ed425b6cf4b750f6f8185255e1d0c8daa05baebf Mon Sep 17 00:00:00 2001
From: Ben Firestone <ben.firestone@krypticlabs.com>
Date: Wed, 29 Apr 2026 20:21:24 -0700
Subject: [PATCH 17/20] feat(share): JSON bundle for agents + author can edit
 reviewer comments
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two related improvements to the reviewer→LLM pipeline:

1. arc share comments --json now emits a single JSON object designed
   for direct LLM consumption:

   {
     "plan": { id, title, author_name,
               file (when local) | markdown_b64 (when not) },
     "comments": [{ comment, status, reply,
                    resolved_anchor: { status, line_start, line_end,
                                       snippet } }]
   }

   - The `file` ⊕ `markdown_b64` split avoids dragging the plan content
     through every CLI call when the agent already has it on disk.
     Base64 sidesteps JSON's escape penalty (every \n and \" doubles
     the byte count and destroys readability) when content IS shipped.
   - `comment.action` is now preserved on the Go side so delete
     annotations round-trip correctly (was silently dropped before).
   - `resolved_anchor` runs the SPA's 4-step anchor fallback (exact →
     heading → fuzzy → orphaned) against the live plan content, so
     line numbers are ground-truth for what the agent will edit.
   - New internal/paste/anchor.go ports anchor.ts to Go; 9 tests cover
     every fallback path plus a TS-compatibility check on Slugify.

2. Plan author can now edit any reviewer's annotation, not just their
   own. The displayed comment.author_name doesn't change — only the
   body/suggested_text/comment_type — so attribution is preserved and
   the audit trail (in the underlying edit event) records who actually
   edited. This lets the author sharpen thin "expand this more"
   feedback into something LLM-actionable without round-trips.

   Replay-time auth gate updated in both events.ts and share.go:
   accepts edits where author_name matches the comment's original
   author OR the plan's author (with non-empty planAuthor guard so
   empty-string-matches-empty-string doesn't grant rights).

Tests
- TestRunShareCommentsJSONBundle: bundle shape, action round-trip,
  resolved_anchor against the on-disk file, snippet content.
- TestRunShareCommentsJSONBundle_NoLocalFile: simulates a cross-machine
  agent (wipes shares.json mid-test) and verifies markdown_b64 round-
  trips with newlines + quotes preserved.
- TestRunShareCommentsAppliesPlanAuthorEdits: Steve's body becomes
  Ben's wording; Mallory's forged edit dropped; Steve still attributed.
- 4 new sub-tests in events.test.ts mirror the auth corners (plan-
  author edit, third-party rejection, empty-author trap, chronological
  ordering across both roles).
- 9 anchor_test.go tests including out-of-range fall-through and
  TS-compatible slugify.

Docs
- review_howto.md: full JSON bundle schema with the two cases (local
  / remote) and field-by-field guide for agent consumers. New
  "Editing annotations" section explains the two-role edit model.
- runbooks/paste-server.md: step 8 added — manual test of author
  editing a reviewer's comment.
---
 cmd/arc/share.go                              | 188 +++++++++++-
 cmd/arc/share_test.go                         | 286 ++++++++++++++++++
 docs/review_howto.md                          |  76 ++++-
 docs/runbooks/paste-server.md                 |   1 +
 internal/paste/anchor.go                      | 153 ++++++++++
 internal/paste/anchor_test.go                 | 141 +++++++++
 web/src/lib/paste/events.test.ts              |  61 ++++
 web/src/lib/paste/events.ts                   |  15 +-
 web/src/routes/share/[id]/+page.svelte        |  10 +-
 .../[id]/components/AnnotationCard.svelte     |   9 +-
 10 files changed, 915 insertions(+), 25 deletions(-)
 create mode 100644 internal/paste/anchor.go
 create mode 100644 internal/paste/anchor_test.go

diff --git a/cmd/arc/share.go b/cmd/arc/share.go
index 4782ade..bbe3ce8 100644
--- a/cmd/arc/share.go
+++ b/cmd/arc/share.go
@@ -33,10 +33,17 @@ type planPlaintext struct {
 }
 
 type commentEvent struct {
-	Kind          string `json:"kind"`
-	ID            string `json:"id"`
-	AuthorName    string `json:"author_name"`
-	CommentType   string `json:"comment_type"`
+	Kind        string `json:"kind"`
+	ID          string `json:"id"`
+	AuthorName  string `json:"author_name"`
+	CommentType string `json:"comment_type"`
+	// Action is the reviewer's primary intent: "comment" (default) or
+	// "delete" (strikethrough — body may be empty since the strikethrough
+	// IS the action). Preserved on round-trip so consumers like
+	// `arc share comments --json` can distinguish deletion requests from
+	// regular comments. Mirrors the AnnotationAction type in the SPA
+	// (web/src/lib/paste/types.ts).
+	Action        string `json:"action,omitempty"`
 	Severity      string `json:"severity,omitempty"`
 	Body          string `json:"body"`
 	SuggestedText string `json:"suggested_text,omitempty"`
@@ -62,6 +69,15 @@ type approvalEvent struct {
 	CreatedAt  string `json:"created_at"`
 }
 
+// commentEntry is the in-flight aggregation of a comment + its resolution
+// status, used internally by printComments / emitBundle. Lives at package
+// scope so both functions can refer to the same type.
+type commentEntry struct {
+	comment commentEvent
+	status  string
+	reply   string
+}
+
 // editEvent is a reviewer revising their own annotation. Replay merges the
 // supplied fields onto the target comment in chronological order, gated on
 // the edit's author_name matching the original comment's. See the
@@ -581,9 +597,19 @@ func printComments(server, id string, key []byte, acceptedOnly, asJSON bool) err
 			if !ok {
 				continue
 			}
-			// Replay-time auth: only the comment's original author can
-			// edit it. Forged events are silently dropped.
-			if ed.AuthorName != c.AuthorName {
+			// Replay-time auth: edits are accepted from either the comment's
+			// original author OR the plan author (so the author can sharpen
+			// thin reviewer feedback like "expand this more"). The displayed
+			// comment.author_name is unchanged either way — only the edit
+			// event itself records who actually edited. Forged events from
+			// third parties are silently dropped.
+			//
+			// `plan.AuthorName` must be non-empty before granting plan-owner
+			// edit rights; otherwise empty strings on both sides would all
+			// match and accidentally authorize anonymous edits.
+			isOriginal := ed.AuthorName == c.AuthorName
+			isPlanAuthor := plan.AuthorName != "" && ed.AuthorName == plan.AuthorName
+			if !isOriginal && !isPlanAuthor {
 				continue
 			}
 			if ed.Body != nil {
@@ -598,26 +624,158 @@ func printComments(server, id string, key []byte, acceptedOnly, asJSON bool) err
 			comments[ed.CommentID] = c
 		}
 	}
+	// Build a deterministic-order list of comment entries so multiple runs
+	// produce identical output (Go map iteration is randomized).
+	entries := make([]commentEntry, 0, len(comments))
 	for cid, c := range comments {
 		res, ok := resolutions[cid]
 		status := "open"
+		reply := ""
 		if ok {
 			status = res.Status
+			reply = res.Reply
 		}
 		if acceptedOnly && status != "accepted" {
 			continue
 		}
-		if asJSON {
-			payload := map[string]any{"comment": c, "status": status}
-			if ok && res.Reply != "" {
-				payload["reply"] = res.Reply
+		entries = append(entries, commentEntry{comment: c, status: status, reply: reply})
+	}
+	sort.SliceStable(entries, func(i, j int) bool {
+		return entries[i].comment.CreatedAt < entries[j].comment.CreatedAt
+	})
+
+	if asJSON {
+		return emitBundle(id, plan, entries)
+	}
+	for _, e := range entries {
+		// Mark deletes visually so they don't get mistaken for empty-body comments.
+		prefix := ""
+		if e.comment.Action == "delete" {
+			prefix = "[delete] "
+		}
+		fmt.Printf("[%s] %s%s (%s): %s\n", e.status, prefix, e.comment.AuthorName, e.comment.CommentType, e.comment.Body)
+	}
+	return nil
+}
+
+// shareBundle is the JSON shape emitted by `arc share comments --json`.
+//
+// Designed for LLM consumption: a single object with everything an agent
+// needs to apply review feedback.
+//
+// Plan content is exposed via exactly one of two fields:
+//   - `file` — absolute path on disk. Set when the share is registered in
+//     shares.json AND the file is readable. Agent reads it directly.
+//   - `markdown_b64` — base64-encoded markdown. Set when there's no local
+//     file (e.g. an agent consuming a shared URL it didn't create). Base64
+//     avoids JSON escape bloat (every \n and \" doubles the byte count and
+//     destroys readability) for markdown payloads that can hit tens of KB.
+//
+// resolved_anchor line numbers are always computed against whichever source
+// `file` or `markdown_b64` exposes, so they're ground-truth for the content
+// the agent will actually see.
+type shareBundle struct {
+	Plan     bundlePlan      `json:"plan"`
+	Comments []bundleComment `json:"comments"`
+}
+
+type bundlePlan struct {
+	ID         string `json:"id"`
+	Title      string `json:"title,omitempty"`
+	AuthorName string `json:"author_name,omitempty"`
+	// File is the absolute path the agent should Edit. Present iff the
+	// share is in shares.json and the file is readable.
+	File string `json:"file,omitempty"`
+	// MarkdownB64 is the plan content, base64-encoded. Present iff File
+	// is not set. Decode with standard base64 (RawStdEncoding-compatible).
+	MarkdownB64 string `json:"markdown_b64,omitempty"`
+}
+
+type bundleComment struct {
+	Comment        commentEvent           `json:"comment"`
+	Status         string                 `json:"status"`
+	Reply          string                 `json:"reply,omitempty"`
+	ResolvedAnchor *bundleResolvedAnchor  `json:"resolved_anchor,omitempty"`
+}
+
+type bundleResolvedAnchor struct {
+	Status    string `json:"status"` // "ok" | "drifted" | "orphaned"
+	LineStart int    `json:"line_start"`
+	LineEnd   int    `json:"line_end"`
+	Snippet   string `json:"snippet,omitempty"`
+}
+
+// emitBundle assembles and prints the JSON bundle for `--json` output.
+//
+// Plan content sourcing:
+//   - If the share is in shares.json AND the recorded file is readable,
+//     emit `file` (absolute path) and run anchor resolution against the
+//     file's current bytes. The agent reads the file directly.
+//   - Otherwise, emit `markdown_b64` containing the encrypted blob's
+//     markdown, base64-encoded to avoid JSON escape noise.
+func emitBundle(id string, plan *planPlaintext, entries []commentEntry) error {
+	// `markdown` is what we resolve anchors against — the same bytes the
+	// agent will operate on, whether that's the local file or the shared
+	// blob. We then expose either `file` or `markdown_b64` to the agent
+	// based on what they have access to.
+	markdown := plan.Markdown
+	planFile := ""
+	if s, _ := sharesconfig.Find(id); s != nil && s.PlanFile != "" {
+		if data, err := os.ReadFile(s.PlanFile); err == nil {
+			markdown = string(data)
+			abs, absErr := filepath.Abs(s.PlanFile)
+			if absErr == nil {
+				planFile = abs
+			} else {
+				planFile = s.PlanFile
+			}
+		}
+	}
+
+	bp := bundlePlan{
+		ID:         id,
+		Title:      plan.Title,
+		AuthorName: plan.AuthorName,
+	}
+	if planFile != "" {
+		bp.File = planFile
+	} else {
+		bp.MarkdownB64 = base64.StdEncoding.EncodeToString([]byte(markdown))
+	}
+
+	bundle := shareBundle{
+		Plan:     bp,
+		Comments: make([]bundleComment, 0, len(entries)),
+	}
+
+	for _, e := range entries {
+		bc := bundleComment{Comment: e.comment, Status: e.status, Reply: e.reply}
+
+		// Re-encode the anchor (which arrived as `any`) and decode into the
+		// typed struct, so we can run resolution. If the anchor is malformed
+		// we leave resolved_anchor unset rather than fail the whole output.
+		if e.comment.Anchor != nil {
+			if raw, err := json.Marshal(e.comment.Anchor); err == nil {
+				var anc paste.Anchor
+				if json.Unmarshal(raw, &anc) == nil {
+					r := paste.ResolveAnchor(markdown, anc)
+					bc.ResolvedAnchor = &bundleResolvedAnchor{
+						Status:    r.Status,
+						LineStart: r.LineStart,
+						LineEnd:   r.LineEnd,
+						Snippet:   paste.Snippet(markdown, r),
+					}
+				}
 			}
-			out, _ := json.Marshal(payload)
-			fmt.Println(string(out))
-		} else {
-			fmt.Printf("[%s] %s (%s): %s\n", status, c.AuthorName, c.CommentType, c.Body)
 		}
+		bundle.Comments = append(bundle.Comments, bc)
+	}
+
+	out, err := json.MarshalIndent(bundle, "", "  ")
+	if err != nil {
+		return err
 	}
+	fmt.Println(string(out))
 	return nil
 }
 
diff --git a/cmd/arc/share_test.go b/cmd/arc/share_test.go
index eff4741..f6c914e 100644
--- a/cmd/arc/share_test.go
+++ b/cmd/arc/share_test.go
@@ -174,6 +174,292 @@ func TestRunShareCommentsAppliesEdits(t *testing.T) {
 	}
 }
 
+// TestRunShareCommentsAppliesPlanAuthorEdits verifies that the plan author
+// can edit any reviewer's comment, mirroring the SPA's replay rule. This is
+// the "Ben sharpens Steve's 'expand this more' into something useful"
+// workflow — comment.author_name stays as the original reviewer.
+func TestRunShareCommentsAppliesPlanAuthorEdits(t *testing.T) {
+	home := t.TempDir()
+	t.Setenv("HOME", home)
+	srv := startTestPasteServer(t)
+	defer srv.Close()
+
+	plan := filepath.Join(t.TempDir(), "p.md")
+	_ = os.WriteFile(plan, []byte("# P"), 0o644)
+	shareCreateServer = srv.URL
+	// Pin the plan author via flag so the replay knows who has author rights.
+	shareCreateAuthor = "Ben"
+	t.Cleanup(func() { shareCreateAuthor = "" })
+	if err := runShareCreate(shareCreateCmd, []string{plan}); err != nil {
+		t.Fatal(err)
+	}
+	f, _ := sharesconfig.Load()
+	s := f.Shares[0]
+	keyBytes := mustDecodeKey(t, s.KeyB64Url)
+
+	postEv := func(t *testing.T, payload map[string]any) {
+		t.Helper()
+		blob, iv, err := paste.EncryptJSON(payload, keyBytes)
+		if err != nil {
+			t.Fatalf("encrypt: %v", err)
+		}
+		body, _ := json.Marshal(paste.AppendEventRequest{Blob: blob, IV: iv})
+		if err := postRaw(t, srv.URL+"/api/paste/"+s.ID+"/blobs", body); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	// Steve leaves a thin comment, then Ben (plan author) refines the body.
+	postEv(t, map[string]any{
+		"kind": "comment", "id": "c1", "author_name": "Steve", "comment_type": "comment",
+		"body":       "expand this more",
+		"anchor":     map[string]any{"line_start": 1, "line_end": 1, "quoted_text": "P"},
+		"created_at": "2026-04-29T00:00:00Z",
+	})
+	postEv(t, map[string]any{
+		"kind": "edit", "id": "e1", "comment_id": "c1", "author_name": "Ben",
+		"body":       "the goal section needs explicit success criteria for 'validated'",
+		"created_at": "2026-04-29T00:05:00Z",
+	})
+	// Mallory tries to edit too — must be ignored.
+	postEv(t, map[string]any{
+		"kind": "edit", "id": "e2", "comment_id": "c1", "author_name": "Mallory",
+		"body":       "MALICIOUS",
+		"created_at": "2026-04-29T00:06:00Z",
+	})
+
+	out := captureStdout(t, func() { _ = runShareComments(shareCommentsCmd, []string{s.ID}) })
+
+	if !strings.Contains(out, "explicit success criteria") {
+		t.Errorf("expected plan author's edited body in output; got:\n%s", out)
+	}
+	if strings.Contains(out, "expand this more") {
+		t.Errorf("expected stale body to be replaced; got:\n%s", out)
+	}
+	// Author attribution unchanged: the line should still be tagged with Steve.
+	if !strings.Contains(out, "Steve") {
+		t.Errorf("comment.author_name should still be Steve in the output; got:\n%s", out)
+	}
+	if strings.Contains(out, "MALICIOUS") {
+		t.Errorf("third-party edit must be ignored; got:\n%s", out)
+	}
+}
+
+// TestRunShareCommentsJSONBundle verifies the shape of `--json` output:
+// a single JSON object containing plan metadata + comments with action
+// preserved + resolved_anchor populated against the on-disk plan file.
+//
+// This is the contract that `arc share comments --json` exposes to the
+// brainstorm skill / LLM agents — locking it in here so changes that
+// would break agent consumption fail the test.
+func TestRunShareCommentsJSONBundle(t *testing.T) {
+	home := t.TempDir()
+	t.Setenv("HOME", home)
+	srv := startTestPasteServer(t)
+	defer srv.Close()
+
+	// A small but realistic plan with sections the SPA would slugify.
+	planText := "# Test Plan\n\n## Goal\n\nValidate the shared review feature.\n\n## Approach\n\n- Selection-based annotation\n- Conventional labels\n"
+	planFile := filepath.Join(t.TempDir(), "plan.md")
+	if err := os.WriteFile(planFile, []byte(planText), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	shareCreateServer = srv.URL
+	if err := runShareCreate(shareCreateCmd, []string{planFile}); err != nil {
+		t.Fatal(err)
+	}
+	f, _ := sharesconfig.Load()
+	s := f.Shares[0]
+	keyBytes := mustDecodeKey(t, s.KeyB64Url)
+
+	postEv := func(t *testing.T, payload map[string]any) {
+		t.Helper()
+		blob, iv, err := paste.EncryptJSON(payload, keyBytes)
+		if err != nil {
+			t.Fatalf("encrypt: %v", err)
+		}
+		body, _ := json.Marshal(paste.AppendEventRequest{Blob: blob, IV: iv})
+		if err := postRaw(t, srv.URL+"/api/paste/"+s.ID+"/blobs", body); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	// One regular comment + one delete annotation. The delete tests that
+	// `action` round-trips to the JSON output (was the bug — Go side used
+	// to silently drop it).
+	postEv(t, map[string]any{
+		"kind":         "comment",
+		"id":           "c1",
+		"author_name":  "Steve",
+		"comment_type": "issue",
+		"body":         "Goal section should mention success criteria",
+		"anchor": map[string]any{
+			"line_start":   5,
+			"line_end":     5,
+			"quoted_text":  "Validate the shared review feature.",
+			"heading_slug": "goal",
+		},
+		"created_at": "2026-04-29T00:00:00Z",
+	})
+	postEv(t, map[string]any{
+		"kind":         "comment",
+		"id":           "c2",
+		"author_name":  "Mike",
+		"comment_type": "comment",
+		"action":       "delete",
+		"body":         "",
+		"anchor": map[string]any{
+			"line_start":   9,
+			"line_end":     9,
+			"quoted_text":  "Conventional labels",
+			"heading_slug": "approach",
+		},
+		"created_at": "2026-04-29T00:01:00Z",
+	})
+
+	// Run with --json
+	shareCommentsJSON = true
+	t.Cleanup(func() { shareCommentsJSON = false })
+	out := captureStdout(t, func() { _ = runShareComments(shareCommentsCmd, []string{s.ID}) })
+
+	var bundle struct {
+		Plan struct {
+			ID          string `json:"id"`
+			Title       string `json:"title"`
+			File        string `json:"file"`
+			MarkdownB64 string `json:"markdown_b64"`
+		} `json:"plan"`
+		Comments []struct {
+			Comment struct {
+				ID         string `json:"id"`
+				Action     string `json:"action"`
+				AuthorName string `json:"author_name"`
+				Body       string `json:"body"`
+			} `json:"comment"`
+			Status         string `json:"status"`
+			ResolvedAnchor *struct {
+				Status    string `json:"status"`
+				LineStart int    `json:"line_start"`
+				LineEnd   int    `json:"line_end"`
+				Snippet   string `json:"snippet"`
+			} `json:"resolved_anchor"`
+		} `json:"comments"`
+	}
+	if err := json.Unmarshal([]byte(out), &bundle); err != nil {
+		t.Fatalf("output is not valid JSON bundle: %v\noutput:\n%s", err, out)
+	}
+
+	// --- Plan section ---
+	if bundle.Plan.ID != s.ID {
+		t.Errorf("plan.id = %q, want %q", bundle.Plan.ID, s.ID)
+	}
+	// File-readable case: `file` is set, `markdown_b64` MUST be omitted.
+	// The agent reads the file directly — no need to ship its bytes twice.
+	if !strings.HasSuffix(bundle.Plan.File, "plan.md") {
+		t.Errorf("plan.file should be absolute path ending in plan.md; got %q", bundle.Plan.File)
+	}
+	if !filepath.IsAbs(bundle.Plan.File) {
+		t.Errorf("plan.file should be absolute; got %q", bundle.Plan.File)
+	}
+	if bundle.Plan.MarkdownB64 != "" {
+		t.Errorf("plan.markdown_b64 must be empty when plan.file is set; got %d bytes", len(bundle.Plan.MarkdownB64))
+	}
+
+	// --- Comments section ---
+	if len(bundle.Comments) != 2 {
+		t.Fatalf("expected 2 comments, got %d", len(bundle.Comments))
+	}
+	// Sorted by created_at, so c1 comes before c2.
+	if bundle.Comments[0].Comment.ID != "c1" || bundle.Comments[1].Comment.ID != "c2" {
+		t.Errorf("comments not in chronological order: got %s, %s",
+			bundle.Comments[0].Comment.ID, bundle.Comments[1].Comment.ID)
+	}
+	if bundle.Comments[1].Comment.Action != "delete" {
+		t.Errorf("action field dropped on delete comment; got %q, want \"delete\"",
+			bundle.Comments[1].Comment.Action)
+	}
+
+	// --- Resolved anchor ---
+	r0 := bundle.Comments[0].ResolvedAnchor
+	if r0 == nil {
+		t.Fatal("resolved_anchor missing on c1")
+	}
+	if r0.Status != "ok" {
+		t.Errorf("c1 anchor status = %q, want ok (line numbers should match)", r0.Status)
+	}
+	if r0.Snippet == "" {
+		t.Errorf("expected snippet for resolved anchor; got empty")
+	}
+	if !strings.Contains(r0.Snippet, "Validate the shared review") {
+		t.Errorf("snippet should include the quoted text; got %q", r0.Snippet)
+	}
+}
+
+// TestRunShareCommentsJSONBundle_NoLocalFile covers the "agent on a
+// different machine" case: the share isn't in this machine's shares.json
+// (or the recorded file is unreadable), so the bundle must include the
+// markdown as base64 instead of a file path.
+func TestRunShareCommentsJSONBundle_NoLocalFile(t *testing.T) {
+	home := t.TempDir()
+	t.Setenv("HOME", home)
+	srv := startTestPasteServer(t)
+	defer srv.Close()
+
+	// Create a share, then DELETE the registry entry to simulate "this
+	// machine doesn't know about this share." The encrypted blob still
+	// has the plan content, so the CLI falls back to it.
+	planText := "# Test Plan\n\n## Goal\n\nA quick \"quoted\" test with newlines.\n"
+	planFile := filepath.Join(t.TempDir(), "plan.md")
+	if err := os.WriteFile(planFile, []byte(planText), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	shareCreateServer = srv.URL
+	if err := runShareCreate(shareCreateCmd, []string{planFile}); err != nil {
+		t.Fatal(err)
+	}
+	f, _ := sharesconfig.Load()
+	s := f.Shares[0]
+	keyBytes := mustDecodeKey(t, s.KeyB64Url)
+
+	// Wipe shares.json so the lookup fails — same effect as fetching a
+	// share you didn't create on this machine.
+	if err := sharesconfig.Remove(s.ID); err != nil {
+		t.Fatal(err)
+	}
+
+	// Also need to pass the full URL since the bare ID won't resolve now.
+	url := srv.URL + "/share/" + s.ID + "#k=" + s.KeyB64Url
+	_ = keyBytes
+
+	shareCommentsJSON = true
+	t.Cleanup(func() { shareCommentsJSON = false })
+	out := captureStdout(t, func() { _ = runShareComments(shareCommentsCmd, []string{url}) })
+
+	var bundle struct {
+		Plan struct {
+			File        string `json:"file"`
+			MarkdownB64 string `json:"markdown_b64"`
+		} `json:"plan"`
+	}
+	if err := json.Unmarshal([]byte(out), &bundle); err != nil {
+		t.Fatalf("not valid JSON: %v\n%s", err, out)
+	}
+	if bundle.Plan.File != "" {
+		t.Errorf("plan.file should be empty when share is not registered; got %q", bundle.Plan.File)
+	}
+	if bundle.Plan.MarkdownB64 == "" {
+		t.Fatal("plan.markdown_b64 must be set when plan.file is empty")
+	}
+	decoded, err := base64.StdEncoding.DecodeString(bundle.Plan.MarkdownB64)
+	if err != nil {
+		t.Fatalf("markdown_b64 not valid base64: %v", err)
+	}
+	if string(decoded) != planText {
+		t.Errorf("decoded markdown_b64 doesn't match original.\n  got:  %q\n  want: %q",
+			string(decoded), planText)
+	}
+}
+
 // mustDecodeKey decodes a base64url key or fatals the test.
 func mustDecodeKey(t *testing.T, b64 string) []byte {
 	t.Helper()
diff --git a/docs/review_howto.md b/docs/review_howto.md
index f3879f3..9c7f847 100644
--- a/docs/review_howto.md
+++ b/docs/review_howto.md
@@ -68,11 +68,81 @@ You could collapse Resolve and Reject into a single "Decline" — GitHub roughly
 
 If in practice you find yourself never using one of these states, that's a signal we should simplify the UI. The current design errs on the side of preserving rationale, since "feedback that's helpful for an LLM" is the project's product goal.
 
-## Reviewers can refine their own comments
+## Editing annotations
+
+Two roles can edit an annotation while it's `open` or `reopened`:
+
+1. **The original commenter** can refine their own wording.
+2. **The plan author** can sharpen any reviewer's comment — useful for turning a thin "expand this more" into a fully-formed instruction the LLM can act on, without waiting on the reviewer.
+
+Either way, **`comment.author_name` doesn't change** — Steve's comment is still attributed to Steve even after Ben rewrites the body. Only the *body* (and `suggested_text`, `comment_type`) changes. The underlying edit event records who actually edited, so the audit trail is preserved if you ever want to inspect it.
+
+Once a comment is Accepted, Rejected, or Resolved, the edit button disappears for everyone. The reasoning: the meaning has been "consumed" by the resolution decision, and changing it after the fact would invalidate that decision.
+
+## JSON output for LLM consumers
+
+`arc share comments <id> --json` emits a single JSON object structured for direct LLM consumption.
+
+**Local case** — share is registered in `~/.arc/shares.json` and the file is readable:
+
+```json
+{
+  "plan": {
+    "id": "abc123",
+    "title": "Test Plan",
+    "author_name": "Ben",
+    "file": "/abs/path/to/docs/plans/foo.md"
+  },
+  "comments": [
+    {
+      "comment": {
+        "kind": "comment",
+        "id": "c-abc",
+        "author_name": "Steve",
+        "comment_type": "issue",
+        "action": "comment",
+        "body": "Goal section should mention success criteria",
+        "anchor": { "line_start": 5, "line_end": 5, "quoted_text": "...", "heading_slug": "goal" },
+        "created_at": "..."
+      },
+      "status": "accepted",
+      "resolved_anchor": {
+        "status": "ok",
+        "line_start": 5,
+        "line_end": 5,
+        "snippet": "## Goal\n\nValidate the shared review feature."
+      }
+    }
+  ]
+}
+```
+
+The agent reads `plan.file` directly — the markdown content isn't included to avoid bloating every CLI call with content the agent can read in one tool call.
+
+**Remote case** — share isn't registered locally (e.g. an agent consuming a shared URL it didn't create). The `file` field is omitted; `markdown_b64` carries the plan content base64-encoded:
+
+```json
+{
+  "plan": {
+    "id": "abc123",
+    "markdown_b64": "IyBUZXN0IFBsYW4KCiMjIEdvYWwK..."
+  },
+  "comments": [...]
+}
+```
+
+Base64 sidesteps the JSON-escape penalty for markdown (every `\n` and `\"` doubles the size and destroys readability when piped to `cat`). Decode with any standard base64 implementation.
+
+Key fields for an agent applying feedback:
 
-A reviewer who left a thin comment ("expand this more") can revise it themselves before the author has acted on it. Look for the **✎ Edit** button on your own annotation cards — it's only visible while the comment is `open` or `reopened`.
+- **`plan.file`** *(local case)* — absolute path the agent should `Edit` directly.
+- **`plan.markdown_b64`** *(remote case)* — base64-encoded plan content. Decode and write to disk if the agent needs to operate on a file.
+- **`comment.action`** — `"comment"` (default) or `"delete"`. Delete annotations request removal of `quoted_text`; the body may be empty since the strikethrough IS the action.
+- **`comment.suggested_text`** — when present, this is a literal find-and-replace candidate.
+- **`resolved_anchor.status`** — `"ok"` if line numbers match the current content; `"drifted"` if the comment was relocated via the heading or fuzzy fallback (use the new line numbers); `"orphaned"` if the quoted text isn't in the current content (the agent should grep or skip).
+- **`resolved_anchor.snippet`** — a few lines of context around the anchor, for orientation.
 
-Once a comment is Accepted, Rejected, or Resolved, the edit button disappears. The reasoning: the author has already decided based on the wording at that moment, and changing it after the fact would be misleading.
+`arc share pull <id> --json` is the same shape filtered to `status === "accepted"` — typical agent input.
 
 ## What flows where
 
diff --git a/docs/runbooks/paste-server.md b/docs/runbooks/paste-server.md
index 4502a7e..5530c81 100644
--- a/docs/runbooks/paste-server.md
+++ b/docs/runbooks/paste-server.md
@@ -96,6 +96,7 @@ Open the printed URL in Chrome/Firefox.
 5. **Post** — the comment appears in the sidebar
 6. As the author (your localStorage name matches `plan.author_name`), you'll see **Accept / Resolve / Reject** controls. Try Accept on one comment, Reject (with reply) on another, and Resolve on a third. If the controls don't appear, double-check that the name in the header chip matches the value in `git config user.name` (or whatever you passed to `--author`) — the comparison is case- and whitespace-sensitive.
 7. As a reviewer (your localStorage name does NOT match the plan's author), find your own annotation in the sidebar. You should see an **✎ Edit** button on it. Click it; the body becomes a textarea pre-filled with your existing comment. Refine the wording — e.g. expand "expand this more" into a fully-formed suggestion — and **⌘/Ctrl-⏎** (or click Save). The card re-renders with `· edited Nm` next to the timestamp. Confirm `arc share comments <id>` prints the new body, not the original.
+8. Switch back to the author window. The **✎ Edit** button should also appear on every reviewer's annotation (not just your own). Use it to sharpen a thin reviewer comment — the displayed `author_name` stays as the reviewer, only the body changes. Run `arc share comments <id>` again and confirm the refined body shows up; this is the path that lets the author shape feedback for downstream LLM consumption without round-trips with the reviewer.
 
 ### Pull comments back to the CLI
 
diff --git a/internal/paste/anchor.go b/internal/paste/anchor.go
new file mode 100644
index 0000000..03c3b2d
--- /dev/null
+++ b/internal/paste/anchor.go
@@ -0,0 +1,153 @@
+// Package paste — anchor.go
+//
+// Anchor resolution for replaying reviewer annotations against a possibly-
+// edited plan. Mirror of web/src/lib/paste/anchor.ts; the two sides MUST
+// stay in sync since both consume the same encrypted Anchor payloads.
+//
+// 4-step fallback (same as the TS):
+//  1. Exact: line_start..line_end still contain quoted_text → status=ok
+//  2. Heading-scoped: search the 50 lines after heading_slug → status=drifted
+//  3. Fuzzy: context_before + quoted_text + context_after appears in the plan
+//     → status=drifted
+//  4. None of the above: status=orphaned, original line numbers preserved
+//     for display purposes.
+
+package paste
+
+import (
+	"regexp"
+	"strings"
+)
+
+// Anchor mirrors the TS Anchor type (web/src/lib/paste/types.ts). Encoded as
+// JSON inside encrypted comment events; decoded here only when the CLI needs
+// to relocate a comment against a current plan.
+type Anchor struct {
+	LineStart     int    `json:"line_start"`
+	LineEnd       int    `json:"line_end"`
+	CharStart     *int   `json:"char_start,omitempty"`
+	CharEnd       *int   `json:"char_end,omitempty"`
+	QuotedText    string `json:"quoted_text"`
+	ContextBefore string `json:"context_before,omitempty"`
+	ContextAfter  string `json:"context_after,omitempty"`
+	HeadingSlug   string `json:"heading_slug,omitempty"`
+}
+
+// AnchorResolution is the result of running ResolveAnchor against a plan.
+// Status disambiguates "found at original location" from "relocated" from
+// "couldn't find at all" — agents care about this for deciding whether to
+// trust the line numbers or fall back to a Grep on QuotedText.
+type AnchorResolution struct {
+	LineStart int    `json:"line_start"`
+	LineEnd   int    `json:"line_end"`
+	Status    string `json:"status"` // "ok" | "drifted" | "orphaned"
+}
+
+// ResolveAnchor finds the current location of an anchor in plan markdown.
+// Returns the original line numbers + status="orphaned" if every fallback
+// fails — never returns an error.
+func ResolveAnchor(plan string, a Anchor) AnchorResolution {
+	lines := strings.Split(plan, "\n")
+
+	// Step 1: exact location still holds.
+	if a.LineStart >= 1 && a.LineEnd <= len(lines) && a.LineStart <= a.LineEnd {
+		slice := strings.Join(lines[a.LineStart-1:a.LineEnd], "\n")
+		if strings.Contains(slice, a.QuotedText) {
+			return AnchorResolution{
+				LineStart: a.LineStart,
+				LineEnd:   a.LineEnd,
+				Status:    "ok",
+			}
+		}
+	}
+
+	// Step 2: heading-scoped — look 50 lines past the matching heading.
+	if a.HeadingSlug != "" {
+		if hi := findHeadingIndex(lines, a.HeadingSlug); hi >= 0 {
+			end := min(hi+50, len(lines))
+			window := strings.Join(lines[hi:end], "\n")
+			if off := strings.Index(window, a.QuotedText); off >= 0 {
+				lineNum := hi + 1 + countNewlinesBefore(window, off)
+				return AnchorResolution{
+					LineStart: lineNum,
+					LineEnd:   lineNum + countNewlinesBefore(a.QuotedText, len(a.QuotedText)),
+					Status:    "drifted",
+				}
+			}
+		}
+	}
+
+	// Step 3: fuzzy — match the surrounding window verbatim.
+	if a.ContextBefore != "" && a.ContextAfter != "" {
+		needle := a.ContextBefore + a.QuotedText + a.ContextAfter
+		if idx := strings.Index(plan, needle); idx >= 0 {
+			startOff := idx + len(a.ContextBefore)
+			lineNum := countNewlinesBefore(plan, startOff) + 1
+			return AnchorResolution{
+				LineStart: lineNum,
+				LineEnd:   lineNum + countNewlinesBefore(a.QuotedText, len(a.QuotedText)),
+				Status:    "drifted",
+			}
+		}
+	}
+
+	// Step 4: orphaned. Preserve original coords so the UI can still display
+	// "this comment used to be at line X" rather than rendering nothing.
+	return AnchorResolution{
+		LineStart: a.LineStart,
+		LineEnd:   a.LineEnd,
+		Status:    "orphaned",
+	}
+}
+
+// Snippet returns up to ~5 lines around the resolved anchor — handy for
+// LLM consumers that want a small chunk of context without re-reading the
+// whole plan. Returns "" if the resolution is orphaned (no reliable
+// location to extract from).
+func Snippet(plan string, r AnchorResolution) string {
+	if r.Status == "orphaned" {
+		return ""
+	}
+	lines := strings.Split(plan, "\n")
+	const padding = 2
+	start := max(r.LineStart-1-padding, 0)
+	end := min(r.LineEnd+padding, len(lines))
+	if start >= end {
+		return ""
+	}
+	return strings.Join(lines[start:end], "\n")
+}
+
+func findHeadingIndex(lines []string, slug string) int {
+	re := regexp.MustCompile(`^#+\s+(.*)$`)
+	for i, line := range lines {
+		m := re.FindStringSubmatch(line)
+		if len(m) == 2 && Slugify(m[1]) == slug {
+			return i
+		}
+	}
+	return -1
+}
+
+// Slugify mirrors web/src/lib/paste/anchor.ts:slugify so heading_slug values
+// produced by the SPA match what we recompute here. Lowercase ASCII letters
+// + digits + hyphens; whitespace becomes '-'.
+func Slugify(text string) string {
+	lowered := strings.ToLower(text)
+	// Replace anything that isn't [a-z0-9 -] with empty string.
+	stripped := nonSlugChars.ReplaceAllString(lowered, "")
+	trimmed := strings.TrimSpace(stripped)
+	return whitespaceRun.ReplaceAllString(trimmed, "-")
+}
+
+var (
+	nonSlugChars  = regexp.MustCompile(`[^a-z0-9\s-]`)
+	whitespaceRun = regexp.MustCompile(`\s+`)
+)
+
+func countNewlinesBefore(s string, idx int) int {
+	if idx > len(s) {
+		idx = len(s)
+	}
+	return strings.Count(s[:idx], "\n")
+}
diff --git a/internal/paste/anchor_test.go b/internal/paste/anchor_test.go
new file mode 100644
index 0000000..aab4360
--- /dev/null
+++ b/internal/paste/anchor_test.go
@@ -0,0 +1,141 @@
+package paste
+
+import (
+	"strings"
+	"testing"
+)
+
+const samplePlan = "# Title\n\nFirst paragraph.\nSecond paragraph.\n## Sub\nThird.\n"
+
+func TestResolveAnchor_Ok(t *testing.T) {
+	r := ResolveAnchor(samplePlan, Anchor{
+		LineStart:  3,
+		LineEnd:    3,
+		QuotedText: "First paragraph.",
+	})
+	if r.Status != "ok" {
+		t.Errorf("status = %q, want ok", r.Status)
+	}
+	if r.LineStart != 3 || r.LineEnd != 3 {
+		t.Errorf("line range = (%d, %d), want (3, 3)", r.LineStart, r.LineEnd)
+	}
+}
+
+func TestResolveAnchor_DriftedViaHeading(t *testing.T) {
+	// Insert a prelude — the same paragraph now lives at line 5, not 3.
+	// The heading_slug fallback must relocate it.
+	edited := "PRELUDE\n# Title\n\nMore content.\nFirst paragraph.\n## Sub\nThird.\n"
+	r := ResolveAnchor(edited, Anchor{
+		LineStart:   3,
+		LineEnd:     3,
+		QuotedText:  "First paragraph.",
+		HeadingSlug: "title",
+	})
+	if r.Status != "drifted" {
+		t.Errorf("status = %q, want drifted", r.Status)
+	}
+	if r.LineStart != 5 {
+		t.Errorf("line_start = %d, want 5", r.LineStart)
+	}
+}
+
+func TestResolveAnchor_DriftedViaContext(t *testing.T) {
+	// Heading was renamed (slug doesn't match) but the surrounding context
+	// is intact, so the fuzzy fallback should still find the location.
+	edited := "# A different title\n\nFirst paragraph.\nSecond paragraph.\n"
+	r := ResolveAnchor(edited, Anchor{
+		LineStart:     5,
+		LineEnd:       5,
+		QuotedText:    "First paragraph.",
+		HeadingSlug:   "old-slug",
+		ContextBefore: "\n\n",
+		ContextAfter:  "\nSecond",
+	})
+	if r.Status != "drifted" {
+		t.Errorf("status = %q, want drifted via fuzzy match", r.Status)
+	}
+}
+
+func TestResolveAnchor_Orphaned(t *testing.T) {
+	edited := "# Title\n\nDifferent stuff.\n"
+	r := ResolveAnchor(edited, Anchor{
+		LineStart:   3,
+		LineEnd:     3,
+		QuotedText:  "First paragraph.",
+		HeadingSlug: "title",
+	})
+	if r.Status != "orphaned" {
+		t.Errorf("status = %q, want orphaned", r.Status)
+	}
+	// Original coordinates preserved so callers can still display them.
+	if r.LineStart != 3 || r.LineEnd != 3 {
+		t.Errorf("orphaned should preserve original coords; got (%d, %d)", r.LineStart, r.LineEnd)
+	}
+}
+
+func TestResolveAnchor_OutOfRangeFallsThrough(t *testing.T) {
+	// Anchor refers to a line beyond the plan — must NOT panic, must fall
+	// through to subsequent steps.
+	short := "# Title\n\nOnly one paragraph.\n"
+	r := ResolveAnchor(short, Anchor{
+		LineStart:   500,
+		LineEnd:     500,
+		QuotedText:  "Only one paragraph.",
+		HeadingSlug: "title",
+	})
+	if r.Status != "drifted" {
+		t.Errorf("status = %q, want drifted (fell through to heading match)", r.Status)
+	}
+}
+
+func TestSlugify(t *testing.T) {
+	cases := map[string]string{
+		"Title":           "title",
+		"Hello World":     "hello-world",
+		"Multi  Spaces":   "multi-spaces",
+		"With-Dashes":     "with-dashes",
+		"Punctuation!?.":  "punctuation",
+		"Mixed Case 123":  "mixed-case-123",
+		"  Trim Me  ":     "trim-me",
+		// Non-ASCII letters are stripped char-by-char (the regex is `[^a-z0-9\s-]`),
+		// leaving only the ASCII letters embedded in the words. Matches what the
+		// TS implementation produces.
+		"Über Größe": "ber-gre",
+	}
+	for in, want := range cases {
+		if got := Slugify(in); got != want {
+			t.Errorf("Slugify(%q) = %q, want %q", in, got, want)
+		}
+	}
+}
+
+func TestSlugify_TSCompatibility(t *testing.T) {
+	// Crucially this MUST match what web/src/lib/paste/anchor.ts produces,
+	// since the SPA writes heading_slug values into the encrypted anchor.
+	// If these diverge, drifted/heading-scoped resolution silently fails.
+	if got := Slugify("Goal"); got != "goal" {
+		t.Errorf(`Slugify("Goal") = %q, want "goal"`, got)
+	}
+	if got := Slugify("Approach"); got != "approach" {
+		t.Errorf(`Slugify("Approach") = %q, want "approach"`, got)
+	}
+}
+
+func TestSnippet(t *testing.T) {
+	r := AnchorResolution{LineStart: 3, LineEnd: 3, Status: "ok"}
+	got := Snippet(samplePlan, r)
+	// Should include lines 1-5 (line 3 ± 2 padding).
+	if !strings.Contains(got, "First paragraph.") {
+		t.Errorf("snippet missing the anchor line; got: %q", got)
+	}
+	if !strings.Contains(got, "# Title") {
+		t.Errorf("snippet missing leading context; got: %q", got)
+	}
+}
+
+func TestSnippet_OrphanedReturnsEmpty(t *testing.T) {
+	r := AnchorResolution{LineStart: 99, LineEnd: 99, Status: "orphaned"}
+	if got := Snippet(samplePlan, r); got != "" {
+		t.Errorf("orphaned should yield empty snippet; got %q", got)
+	}
+}
diff --git a/web/src/lib/paste/events.test.ts b/web/src/lib/paste/events.test.ts
index 959e763..614409d 100644
--- a/web/src/lib/paste/events.test.ts
+++ b/web/src/lib/paste/events.test.ts
@@ -130,5 +130,66 @@ describe('replayEvents', () => {
 			expect(s?.status).toBe('accepted');
 			expect(s?.event.body).toBe('expanded reasoning: the issue is X because Y');
 		});
+
+		describe('plan author edits reviewer comments', () => {
+			it('lets the plan author refine a reviewer comment', () => {
+				// Steve leaves a thin "expand this more"; Ben (plan author)
+				// rewrites the body. comment.author_name stays "Alice"
+				// (the original reviewer) — only the body changes.
+				const banEdit = {
+					...baseEdit,
+					author_name: 'Ben',
+					body: 'success criteria for "validated" should be enumerated'
+				};
+				const states = replayEvents('Ben', [c, banEdit]);
+				const s = states.get('c1');
+				expect(s?.event.body).toBe(
+					'success criteria for "validated" should be enumerated'
+				);
+				// Original author attribution preserved.
+				expect(s?.event.author_name).toBe('Alice');
+				expect(s?.editedAt).toBe(banEdit.created_at);
+			});
+
+			it('still drops edits from third parties', () => {
+				const malloryEdit = {
+					...baseEdit,
+					author_name: 'Mallory',
+					body: 'rewrite by random visitor'
+				};
+				const states = replayEvents('Ben', [c, malloryEdit]);
+				expect(states.get('c1')?.event.body).toBe('looks good');
+			});
+
+			it('does not grant plan-author rights when planAuthor is empty', () => {
+				// Edge case: if the plan was created without an author name,
+				// an edit event with empty author_name would otherwise match
+				// the empty plan_author. This must not authorize the edit.
+				const empty = { ...baseEdit, author_name: '', body: 'should not apply' };
+				const states = replayEvents(undefined, [c, empty]);
+				expect(states.get('c1')?.event.body).toBe('looks good');
+			});
+
+			it('applies original-author then plan-author edits chronologically', () => {
+				// Alice refines her own wording, then Ben (author) refines
+				// it further. Last write wins.
+				const aliceFirst = {
+					...baseEdit,
+					id: 'e1',
+					author_name: 'Alice',
+					body: 'alice version',
+					created_at: '2026-04-29T00:05:00Z'
+				};
+				const benSecond = {
+					...baseEdit,
+					id: 'e2',
+					author_name: 'Ben',
+					body: 'ben final',
+					created_at: '2026-04-29T00:10:00Z'
+				};
+				const states = replayEvents('Ben', [c, aliceFirst, benSecond]);
+				expect(states.get('c1')?.event.body).toBe('ben final');
+			});
+		});
 	});
 });
diff --git a/web/src/lib/paste/events.ts b/web/src/lib/paste/events.ts
index 4a21154..205e12f 100644
--- a/web/src/lib/paste/events.ts
+++ b/web/src/lib/paste/events.ts
@@ -35,9 +35,18 @@ export function replayEvents(
 		} else if (e.kind === 'edit') {
 			const target = states.get(e.comment_id);
 			if (!target) continue;
-			// Only the original author of the comment can edit it. The server
-			// can't enforce this (events are encrypted) so the gate lives here.
-			if (e.author_name !== target.event.author_name) continue;
+			// Edits are accepted from two roles:
+			//   1. The original author of the comment (refining their own wording).
+			//   2. The plan author (sharpening reviewer feedback into something
+			//      LLM-consumable without waiting on the reviewer).
+			// The displayed `comment.author_name` does NOT change either way —
+			// the edit event in the log records who actually edited.
+			//
+			// `planAuthor` must be non-empty before granting plan-owner edit
+			// rights; otherwise empty strings would all match each other.
+			const isOriginalAuthor = e.author_name === target.event.author_name;
+			const isPlanAuthor = !!planAuthor && e.author_name === planAuthor;
+			if (!isOriginalAuthor && !isPlanAuthor) continue;
 			// Build a new event object with the supplied fields applied. We
 			// replace `target.event` rather than mutate so consumers that hold
 			// a stale reference don't see partial state during the merge.
diff --git a/web/src/routes/share/[id]/+page.svelte b/web/src/routes/share/[id]/+page.svelte
index 80a2bde..7cded6d 100644
--- a/web/src/routes/share/[id]/+page.svelte
+++ b/web/src/routes/share/[id]/+page.svelte
@@ -265,9 +265,13 @@
 	) {
 		if (!reviewerName) return;
 		const target = comments.get(commentId);
-		// The replay layer will reject mismatched authors anyway, but failing
-		// fast here avoids posting a useless event to the server.
-		if (!target || target.event.author_name !== reviewerName) return;
+		if (!target) return;
+		// Authorization mirror of replayEvents:
+		//   - Original commenter can edit their own comment.
+		//   - Plan author can edit any comment (sharpening thin feedback).
+		// Failing fast here avoids posting events the replay would discard.
+		const isMyComment = target.event.author_name === reviewerName;
+		if (!isMyComment && !isAuthor) return;
 
 		const event: EditEvent = {
 			kind: 'edit',
diff --git a/web/src/routes/share/[id]/components/AnnotationCard.svelte b/web/src/routes/share/[id]/components/AnnotationCard.svelte
index dfc65e7..bf4d4ba 100644
--- a/web/src/routes/share/[id]/components/AnnotationCard.svelte
+++ b/web/src/routes/share/[id]/components/AnnotationCard.svelte
@@ -88,9 +88,16 @@
 	// Edits are only meaningful while the comment is still under discussion.
 	// Once it's accepted/rejected/resolved the meaning has been "consumed" by
 	// the plan author — editing the body would be misleading.
+	//
+	// Two roles can edit:
+	//   - The original commenter (refining their own wording)
+	//   - The plan author (sharpening thin reviewer feedback into something
+	//     LLM-consumable without waiting on the reviewer to update)
+	// The displayed `author_name` doesn't change either way; the edit event
+	// records who actually edited.
 	const canEdit = $derived(
 		reviewerName !== null &&
-			e.author_name === reviewerName &&
+			(e.author_name === reviewerName || isAuthor) &&
 			(entry.status === 'open' || entry.status === 'reopened')
 	);
 

From 7b60505723fdf106341fe56539d6206f4194e840 Mon Sep 17 00:00:00 2001
From: Ben Firestone <ben.firestone@krypticlabs.com>
Date: Wed, 29 Apr 2026 20:43:52 -0700
Subject: [PATCH 18/20] feat(share): proper markdown rendering, planner-aligned
 theme, merged toolbar
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Three intertwined improvements to the /share/[id] surface:

1. Fix the broken plan renderer
   The previous PlanRenderer split markdown on blank lines to attach
   per-block `data-source-line` attributes for selection anchoring.
   That destroyed fenced code blocks containing blank lines: the SQL
   schema, the TypeScript type definitions, and the `arc share *` CLI
   block all rendered as flowing prose with `# comment` lines becoming
   <h1> headings and the rest of the fence body becoming <p>.

   Fixed by switching to `marked.lexer()` to enumerate top-level tokens
   (each fenced block is ONE token, blank lines and all). Per-token
   line numbers come from `token.raw`'s offset in the source. The full
   document renders once through the project's existing shiki-powered
   `renderMarkdown` (github-dark-dimmed theme) for syntax highlighting,
   then DOMParser walks the result and tags each top-level element with
   data-source-line directly — no wrapper divs.

2. Match /planner's color theme
   The share page's editorial Newsreader/warm-amber palette read as a
   visual outlier inside arc. Now `--ink-paper`, `--ink-text`,
   `--ink-rule` etc. alias to arc's `--color-surface-*` /
   `--color-text-*` / `--color-border` tokens, the doc inherits
   Instrument Sans, headings drop the italic display style, bullets
   become standard discs, and inline code uses the planner's indigo-
   on-raised-surface treatment.

   Annotation-domain tokens (`--ink-comment` amber highlight,
   `--ink-delete` red, `--ink-praise` green) stay distinct since
   they encode review semantics, not chrome. `--ink-delete` and
   `--ink-praise` are now derived from `--color-status-blocked` and
   `--color-status-open` via `oklch(from var(...) l c h / alpha)` so
   any future palette tuning carries through automatically.

3. Merge the two action rows in AnnotationCard
   When the plan author viewed an editable comment, they saw two
   separate bordered toolbars: one for ✎ Edit, another for
   Accept/Resolve/Reject. Single-row treatment with a typographic
   `·` separator (the same glyph used elsewhere in the card for
   metadata) reads as one decision row instead of two stacked
   choices. Color hierarchy already differentiates the soft action
   (Edit, muted text) from the load-bearing decisions (Accept green,
   Reject red), so no extra styling needed.

Tests
  44 web tests still pass; svelte-check clean. No test changes — these
  are visual / rendering-pipeline fixes covered by the existing replay
  + components test suite.
---
 web/src/app.css                               | 239 ++++++++++--------
 .../[id]/components/AnnotationCard.svelte     | 130 ++++++----
 .../share/[id]/components/PlanRenderer.svelte | 107 ++++++--
 3 files changed, 297 insertions(+), 179 deletions(-)

diff --git a/web/src/app.css b/web/src/app.css
index 7d76efa..b9c6811 100644
--- a/web/src/app.css
+++ b/web/src/app.css
@@ -717,27 +717,37 @@
 	margin-right: auto;
 }
 
+/*
+ * Token system — `--ink-*` names kept for backward-compat with the
+ * existing annotation UI selectors, but VALUES now point at arc's
+ * standard `--color-*` tokens so the share page reads the same as
+ * /planner and the rest of the app. Annotation-specific tones
+ * (comment / delete / praise) keep their distinctive review-domain
+ * hues since they encode semantic meaning, not just decoration.
+ */
 .share-page {
-	--ink-paper: oklch(0.16 0.02 260);
-	--ink-paper-raised: oklch(0.2 0.015 260);
-	--ink-paper-edge: oklch(0.24 0.015 260);
-	--ink-text: oklch(0.92 0.02 85);
-	--ink-text-muted: oklch(0.72 0.02 85);
-	--ink-text-faint: oklch(0.55 0.02 260);
-	--ink-rule: oklch(0.3 0.015 260);
-
-	/* Annotation inks */
-	--ink-comment: oklch(0.78 0.16 75); /* warm amber - quill on parchment */
+	/* Surfaces & text — alias to arc's Refined Terminal palette. */
+	--ink-paper: var(--color-surface-900);
+	--ink-paper-raised: var(--color-surface-800);
+	--ink-paper-edge: var(--color-surface-700);
+	--ink-text: var(--color-text-primary);
+	--ink-text-muted: var(--color-text-secondary);
+	--ink-text-faint: var(--color-text-muted);
+	--ink-rule: var(--color-border);
+
+	/* Annotation inks — these are review-domain semantics (highlight =
+	   amber, deletion = red, praise = green) and stay distinct from
+	   surface chrome. Kept in oklch with explicit alphas so the badges
+	   read clearly against any surface. */
+	--ink-comment: oklch(0.78 0.16 75); /* warm amber highlight */
 	--ink-comment-bg: oklch(0.78 0.16 75 / 0.16);
 	--ink-comment-edge: oklch(0.78 0.16 75 / 0.55);
-	--ink-delete: oklch(0.68 0.2 25); /* editorial red */
-	--ink-delete-bg: oklch(0.68 0.2 25 / 0.18);
-	--ink-delete-edge: oklch(0.68 0.2 25 / 0.55);
-	--ink-praise: oklch(0.72 0.14 150); /* sage / proofreader green */
-	--ink-praise-bg: oklch(0.72 0.14 150 / 0.16);
-
-	font-family: "Newsreader", ui-serif, Georgia, serif;
-	font-feature-settings: "kern", "liga", "clig", "calt", "onum";
+	--ink-delete: var(--color-status-blocked);
+	--ink-delete-bg: oklch(from var(--color-status-blocked) l c h / 0.18);
+	--ink-delete-edge: oklch(from var(--color-status-blocked) l c h / 0.55);
+	--ink-praise: var(--color-status-open);
+	--ink-praise-bg: oklch(from var(--color-status-open) l c h / 0.16);
+
 	background: var(--ink-paper);
 	color: var(--ink-text);
 	min-height: 100vh;
@@ -752,142 +762,166 @@
 	font-family: "JetBrains Mono", ui-monospace, monospace;
 }
 
-/* Document column — the "page" being read */
+/*
+ * Document column — mirrors the planner's `.markdown` styles so
+ * /share/[id] reads as the same product as /planner. Inherits
+ * Instrument Sans from `html` (no font-family override here).
+ */
 .share-page .doc {
-	font-family: "Newsreader", ui-serif, Georgia, serif;
-	font-size: 1.0625rem; /* 17px */
+	font-size: 1rem;
 	line-height: 1.7;
-	color: var(--ink-text);
+	color: var(--color-text-primary);
 }
 .share-page .doc h1,
 .share-page .doc h2,
 .share-page .doc h3,
-.share-page .doc h4 {
-	font-family: "Newsreader", ui-serif, Georgia, serif;
+.share-page .doc h4,
+.share-page .doc h5,
+.share-page .doc h6 {
+	color: var(--color-text-primary);
 	font-weight: 600;
-	letter-spacing: -0.01em;
-	color: var(--ink-text);
+	margin-top: 1.5em;
+	margin-bottom: 0.5em;
 	line-height: 1.25;
 }
+.share-page .doc h1:first-child,
+.share-page .doc h2:first-child,
+.share-page .doc h3:first-child,
+.share-page .doc h4:first-child,
+.share-page .doc h5:first-child,
+.share-page .doc h6:first-child {
+	margin-top: 0;
+}
 .share-page .doc h1 {
-	font-size: 2rem;
-	margin: 0 0 1.5rem 0;
-	font-weight: 600;
-	font-style: italic;
-	letter-spacing: -0.02em;
+	font-size: 1.5em;
 }
 .share-page .doc h2 {
-	font-size: 1.375rem;
-	margin: 2.5rem 0 1rem 0;
-	border-bottom: 1px solid var(--ink-rule);
-	padding-bottom: 0.5rem;
+	font-size: 1.25em;
+	padding-bottom: 0.25em;
+	border-bottom: 1px solid var(--color-border-subtle);
 }
 .share-page .doc h3 {
-	font-size: 1.125rem;
-	margin: 2rem 0 0.75rem 0;
+	font-size: 1.1em;
 }
-.share-page .doc h4 {
-	font-size: 1rem;
-	margin: 1.5rem 0 0.5rem 0;
-	color: var(--ink-text-muted);
-	text-transform: uppercase;
-	letter-spacing: 0.06em;
-	font-size: 0.85rem;
+.share-page .doc h4,
+.share-page .doc h5,
+.share-page .doc h6 {
+	font-size: 1em;
 }
 .share-page .doc p {
-	margin: 0 0 1rem 0;
+	margin-bottom: 0.75em;
+	color: var(--color-text-secondary);
+	line-height: 1.7;
 }
 .share-page .doc ul,
 .share-page .doc ol {
-	margin: 0 0 1rem 0;
-	padding-left: 1.5rem;
-}
-.share-page .doc ul li {
-	list-style: none;
-	position: relative;
+	margin: 0.75em 0;
+	padding-left: 1.5em;
+	color: var(--color-text-secondary);
 }
-.share-page .doc ul li::before {
-	content: "·";
-	position: absolute;
-	left: -1rem;
-	color: var(--ink-text-faint);
-	font-size: 1.4em;
-	line-height: 1;
+.share-page .doc ul {
+	list-style-type: disc;
 }
 .share-page .doc ol {
-	list-style: decimal;
-}
-.share-page .doc ol li::marker {
-	color: var(--ink-text-faint);
-	font-feature-settings: "onum";
+	list-style-type: decimal;
 }
 .share-page .doc li {
-	margin: 0.25rem 0;
+	margin-bottom: 0.25em;
+	line-height: 1.7;
 }
 .share-page .doc strong {
-	font-weight: 600;
-	color: var(--ink-text);
+	color: var(--color-text-primary);
 }
 .share-page .doc em {
 	font-style: italic;
 }
 .share-page .doc code {
-	font-family: "JetBrains Mono", ui-monospace, monospace;
-	font-size: 0.875em;
-	background: var(--ink-paper-edge);
-	padding: 0.125rem 0.375rem;
+	font-family: var(--font-mono);
+	font-size: 0.85em;
+	background: var(--color-surface-700);
+	color: var(--color-primary-300);
+	padding: 0.15em 0.4em;
 	border-radius: 3px;
-	color: var(--ink-text);
 }
+/*
+ * Code blocks come through shiki (see src/lib/markdown.ts) which sets its
+ * own `background-color` and `color` via inline styles — those take
+ * precedence over our CSS by specificity. We keep border, padding,
+ * border-radius, and font-size for layout consistency, and explicitly
+ * DON'T set `background` so shiki's github-dark-dimmed theme can shine
+ * through. The `.shiki` class is shiki's own marker; targeting both
+ * `pre` and `pre.shiki` keeps non-highlighted text-blocks looking
+ * consistent.
+ */
+/*
+ * Code blocks come through shiki (see src/lib/markdown.ts) which sets
+ * its own `background-color` and `color` via inline styles — those
+ * win over our CSS by specificity. We provide border + padding +
+ * font-size for layout, and only set `background` for plain (no-lang)
+ * fences via the `:not(.shiki)` escape hatch.
+ */
 .share-page .doc pre {
-	font-family: "JetBrains Mono", ui-monospace, monospace;
-	font-size: 0.8125rem;
-	background: var(--ink-paper-edge);
-	padding: 1rem 1.25rem;
+	font-family: var(--font-mono);
+	font-size: 0.85em;
+	padding: 1em;
 	border-radius: 6px;
-	border: 1px solid var(--ink-rule);
+	border: 1px solid var(--color-border);
 	overflow-x: auto;
 	line-height: 1.6;
-	margin: 1rem 0;
+	margin: 1em 0;
+}
+.share-page .doc pre:not(.shiki) {
+	background: var(--color-surface-900);
 }
 .share-page .doc pre code {
 	background: transparent;
 	padding: 0;
 	border-radius: 0;
+	color: inherit;
 }
 .share-page .doc blockquote {
-	border-left: 2px solid var(--ink-text-faint);
-	padding: 0.25rem 0 0.25rem 1.25rem;
-	margin: 1rem 0;
-	color: var(--ink-text-muted);
+	border-left: 3px solid var(--color-primary-600);
+	background: var(--color-surface-800);
+	padding: 0.75em 1em;
+	margin: 1em 0;
 	font-style: italic;
+	color: var(--color-text-secondary);
+}
+.share-page .doc blockquote p:last-child {
+	margin-bottom: 0;
 }
 .share-page .doc hr {
 	border: none;
-	border-top: 1px solid var(--ink-rule);
-	margin: 2rem 0;
+	border-top: 1px solid var(--color-border-subtle);
+	margin: 1.5em 0;
 }
 .share-page .doc a {
-	color: var(--ink-comment);
+	color: var(--color-primary-400);
+	text-decoration: none;
+}
+.share-page .doc a:hover {
 	text-decoration: underline;
-	text-decoration-color: var(--ink-comment-edge);
-	text-underline-offset: 3px;
 }
 .share-page .doc table {
+	width: 100%;
 	border-collapse: collapse;
-	margin: 1rem 0;
-	font-family: "Inter Tight", ui-sans-serif, sans-serif;
-	font-size: 0.9rem;
-}
-.share-page .doc th,
-.share-page .doc td {
-	border: 1px solid var(--ink-rule);
-	padding: 0.5rem 0.75rem;
-	text-align: left;
+	margin: 1em 0;
+	font-size: 0.875em;
 }
 .share-page .doc th {
-	background: var(--ink-paper-raised);
+	background: var(--color-surface-700);
 	font-weight: 600;
+	text-align: left;
+	padding: 0.5em 0.75em;
+	border-bottom: 2px solid var(--color-border);
+}
+.share-page .doc td {
+	padding: 0.5em 0.75em;
+	border-bottom: 1px solid var(--color-border-subtle);
+	color: var(--color-text-secondary);
+}
+.share-page .doc tr:hover td {
+	background: var(--color-surface-800);
 }
 
 /* Inline annotation marks (added by inline-annotations.ts after render) */
@@ -972,7 +1006,8 @@
 	border-color: var(--ink-comment-edge);
 }
 .share-page .anno-card .quote {
-	font-family: "Newsreader", ui-serif, Georgia, serif;
+	/* Italic kept as a typographic marker for "this is a quoted span" —
+	   the rest of the card is Instrument Sans like the planner. */
 	font-style: italic;
 	color: var(--ink-text-muted);
 	background: var(--ink-paper);
@@ -1017,15 +1052,9 @@
 	animation: toolbar-in 150ms cubic-bezier(0.16, 1, 0.3, 1);
 }
 
-/* Subtle paper grain — barely-there to break up the flat dark surface */
 .share-page .doc-area {
-	background:
-		radial-gradient(circle at 0 0, oklch(1 0 0 / 0.015) 1px, transparent 1px),
-		radial-gradient(circle at 12px 12px, oklch(1 0 0 / 0.012) 1px, transparent 1px),
-		var(--ink-paper);
-	background-size:
-		24px 24px,
-		24px 24px;
+	/* Flat surface to match the planner's clean Refined Terminal look. */
+	background: var(--color-surface-900);
 }
 
 /* Reviewer name chip */
diff --git a/web/src/routes/share/[id]/components/AnnotationCard.svelte b/web/src/routes/share/[id]/components/AnnotationCard.svelte
index bf4d4ba..d96ad1d 100644
--- a/web/src/routes/share/[id]/components/AnnotationCard.svelte
+++ b/web/src/routes/share/[id]/components/AnnotationCard.svelte
@@ -289,71 +289,91 @@
 		</div>
 	{/if}
 
-	{#if canEdit && !isEditing && !showRejectReply}
-		<div class="mt-3 flex flex-wrap gap-1.5 border-t border-[var(--ink-rule)] pt-2">
-			<button
-				type="button"
-				class="rounded-md px-2 py-1 text-[11px] text-[var(--ink-text-muted)] hover:bg-[var(--ink-paper)]"
-				onclick={(ev) => {
-					ev.stopPropagation();
-					void startEdit();
-				}}
-				title="Edit your annotation"
-			>
-				✎ Edit
-			</button>
-		</div>
-	{/if}
+	<!--
+		Single action toolbar combining Edit + the resolution actions, with
+		a middle-dot separator between the two groups when both are present
+		(plan author looking at an editable comment). The separator uses the
+		same `·` glyph the card already uses for header metadata, keeping the
+		editorial aesthetic consistent across the component.
 
-	{#if isAuthor && !showRejectReply && !isEditing}
-		<div class="mt-3 flex flex-wrap gap-1.5 border-t border-[var(--ink-rule)] pt-2">
-			{#if entry.status !== 'accepted'}
-				<button
-					type="button"
-					class="rounded-md px-2 py-1 text-[11px] text-[var(--ink-praise)] hover:bg-[var(--ink-praise-bg)]"
-					onclick={(e) => {
-						e.stopPropagation();
-						onResolve('accepted');
-					}}
-				>
-					✓ Accept
-				</button>
-			{/if}
-			{#if entry.status !== 'resolved'}
+		Color hierarchy carries the visual semantics:
+		  - Edit: `--ink-text-muted` (soft, recessive — it's a refinement)
+		  - Accept: `--ink-praise` (sage green — load-bearing yes)
+		  - Reject: `--ink-delete` (editorial red — load-bearing no)
+		  - Resolve / Reopen: muted (closing actions, no decision weight)
+	-->
+	{#if (canEdit || isAuthor) && !isEditing && !showRejectReply}
+		<div class="mt-3 flex flex-wrap items-center gap-1.5 border-t border-[var(--ink-rule)] pt-2">
+			{#if canEdit}
 				<button
 					type="button"
 					class="rounded-md px-2 py-1 text-[11px] text-[var(--ink-text-muted)] hover:bg-[var(--ink-paper)]"
-					onclick={(e) => {
-						e.stopPropagation();
-						onResolve('resolved');
+					onclick={(ev) => {
+						ev.stopPropagation();
+						void startEdit();
 					}}
+					title="Refine the wording before deciding"
 				>
-					— Resolve
+					✎ Edit
 				</button>
 			{/if}
-			{#if entry.status !== 'rejected'}
-				<button
-					type="button"
-					class="rounded-md px-2 py-1 text-[11px] text-[var(--ink-delete)] hover:bg-[var(--ink-delete-bg)]"
-					onclick={(e) => {
-						e.stopPropagation();
-						showRejectReply = true;
-					}}
+
+			{#if canEdit && isAuthor}
+				<span
+					class="select-none px-0.5 text-[11px] text-[var(--ink-text-faint)]"
+					aria-hidden="true">·</span
 				>
-					✕ Reject
-				</button>
 			{/if}
-			{#if entry.status !== 'open' && entry.status !== 'reopened'}
-				<button
-					type="button"
-					class="rounded-md px-2 py-1 text-[11px] text-[var(--ink-text-muted)] hover:bg-[var(--ink-paper)]"
-					onclick={(e) => {
-						e.stopPropagation();
-						onResolve('reopened');
-					}}
-				>
-					↻ Reopen
-				</button>
+
+			{#if isAuthor}
+				{#if entry.status !== 'accepted'}
+					<button
+						type="button"
+						class="rounded-md px-2 py-1 text-[11px] text-[var(--ink-praise)] hover:bg-[var(--ink-praise-bg)]"
+						onclick={(e) => {
+							e.stopPropagation();
+							onResolve('accepted');
+						}}
+					>
+						✓ Accept
+					</button>
+				{/if}
+				{#if entry.status !== 'resolved'}
+					<button
+						type="button"
+						class="rounded-md px-2 py-1 text-[11px] text-[var(--ink-text-muted)] hover:bg-[var(--ink-paper)]"
+						onclick={(e) => {
+							e.stopPropagation();
+							onResolve('resolved');
+						}}
+					>
+						— Resolve
+					</button>
+				{/if}
+				{#if entry.status !== 'rejected'}
+					<button
+						type="button"
+						class="rounded-md px-2 py-1 text-[11px] text-[var(--ink-delete)] hover:bg-[var(--ink-delete-bg)]"
+						onclick={(e) => {
+							e.stopPropagation();
+							showRejectReply = true;
+						}}
+					>
+						✕ Reject
+					</button>
+				{/if}
+				{#if entry.status !== 'open' && entry.status !== 'reopened'}
+					<button
+						type="button"
+						class="rounded-md px-2 py-1 text-[11px] text-[var(--ink-text-muted)] hover:bg-[var(--ink-paper)]"
+						onclick={(e) => {
+							e.stopPropagation();
+							onResolve('reopened');
+						}}
+					>
+						↻ Reopen
+					</button>
+				{/if}
 			{/if}
 		</div>
 	{/if}
diff --git a/web/src/routes/share/[id]/components/PlanRenderer.svelte b/web/src/routes/share/[id]/components/PlanRenderer.svelte
index bc56ea7..97e5ca1 100644
--- a/web/src/routes/share/[id]/components/PlanRenderer.svelte
+++ b/web/src/routes/share/[id]/components/PlanRenderer.svelte
@@ -2,6 +2,7 @@
 	import { tick } from 'svelte';
 	import { marked } from 'marked';
 	import { slugify } from '$lib/paste/anchor';
+	import { renderMarkdown } from '$lib/markdown';
 	import { applyInlineAnnotations, type InlineMark } from './inline-annotations';
 
 	type SelectionPayload = {
@@ -29,30 +30,98 @@
 	} = $props();
 
 	let container: HTMLElement | undefined = $state();
-	const html = $derived(renderWithSourceLines(markdown));
+	let html = $state('');
 
-	function renderWithSourceLines(md: string): string {
-		const lines = md.split('\n');
-		const blocks: { startLine: number; text: string }[] = [];
-		let cur: { startLine: number; lines: string[] } | null = null;
-		for (let i = 0; i < lines.length; i++) {
-			const ln = lines[i];
-			if (ln.trim() === '') {
-				if (cur) {
-					blocks.push({ startLine: cur.startLine, text: cur.lines.join('\n') });
-					cur = null;
-				}
-			} else {
-				if (!cur) cur = { startLine: i + 1, lines: [] };
-				cur.lines.push(ln);
+	/**
+	 * Render markdown to HTML, attaching `data-source-line` to each
+	 * top-level element so the selection→anchor pipeline can recover
+	 * line numbers.
+	 *
+	 * Why this is custom and not just `renderMarkdown(md)`:
+	 *   The selection toolbar needs to know which source lines a user's
+	 *   selection covers. We do that by tagging every top-level rendered
+	 *   element with the markdown line where its source starts, then
+	 *   `closest('[data-source-line]')` from the selection range gives
+	 *   us start/end lines.
+	 *
+	 * Why we don't just split the markdown on blank lines (the previous
+	 * approach):
+	 *   Fenced code blocks legally contain blank lines (separating SQL
+	 *   statements, TS declarations, comment blocks). Splitting on those
+	 *   destroys the fence boundary — `marked` then sees an unclosed
+	 *   ```` ``` ```` and renders the rest as paragraphs/headings. That's
+	 *   the bug that made SQL render as flowing prose and `#` comment
+	 *   lines render as <h1>.
+	 *
+	 * The right approach: use `marked.lexer()` to get top-level tokens
+	 * (each fenced code block is ONE token regardless of internal blank
+	 * lines), compute each token's source-line position from `token.raw`'s
+	 * offset in the original document, render the whole thing once via
+	 * the shared markdown pipeline (shiki-highlighted + sanitized), then
+	 * inject `data-source-line` onto the corresponding top-level elements.
+	 */
+	async function renderWithSourceLines(md: string): Promise<string> {
+		// 1. Tokenize to compute line numbers per top-level block.
+		const tokens = marked.lexer(md);
+		const lineNumbers: number[] = [];
+		let cursor = 0;
+		for (const t of tokens) {
+			if (t.type === 'space') {
+				// `space` tokens are blank-line gaps with no rendered HTML.
+				// Advance the cursor but don't claim a line slot.
+				cursor += t.raw.length;
+				continue;
 			}
+			const startIdx = md.indexOf(t.raw, cursor);
+			if (startIdx === -1) {
+				// Defensive — shouldn't happen since `raw` is a literal
+				// substring of the source. Skip rather than crash.
+				cursor += t.raw.length;
+				continue;
+			}
+			lineNumbers.push(md.slice(0, startIdx).split('\n').length);
+			cursor = startIdx + t.raw.length;
 		}
-		if (cur) blocks.push({ startLine: cur.startLine, text: cur.lines.join('\n') });
-		return blocks
-			.map((b) => `<div data-source-line="${b.startLine}">${marked.parse(b.text)}</div>`)
-			.join('\n');
+
+		// 2. Render the WHOLE document through the shared pipeline.
+		// This preserves fenced code blocks correctly and adds shiki
+		// syntax highlighting via the existing markdown.ts wiring.
+		const rendered = await renderMarkdown(md);
+
+		// 3. Walk the rendered top-level elements and tag each with the
+		// corresponding source line number. Direct attribute attach
+		// avoids wrapper divs that would muddy the DOM tree and shift
+		// the document's spacing rhythm.
+		const parser = new DOMParser();
+		const doc = parser.parseFromString(`<div id="r">${rendered}</div>`, 'text/html');
+		const root = doc.getElementById('r');
+		if (!root) return rendered;
+		Array.from(root.children).forEach((child, i) => {
+			if (i < lineNumbers.length) {
+				child.setAttribute('data-source-line', String(lineNumbers[i]));
+			}
+		});
+		return root.innerHTML;
 	}
 
+	$effect(() => {
+		// Re-render whenever the markdown source changes. The cancelled
+		// flag protects against late promise resolutions overwriting a
+		// newer render — same pattern as a debounced fetch.
+		const src = markdown;
+		if (!src) {
+			html = '';
+			return;
+		}
+		let cancelled = false;
+		void renderWithSourceLines(src).then((rendered) => {
+			if (!cancelled) html = rendered;
+		});
+		return () => {
+			cancelled = true;
+		};
+	});
+
 	$effect(() => {
 		void html;
 		void marks;

From 0f8c12939cea603bc77116724dbd37763413cbc9 Mon Sep 17 00:00:00 2001
From: Ben Firestone <ben.firestone@krypticlabs.com>
Date: Wed, 29 Apr 2026 20:51:49 -0700
Subject: [PATCH 19/20] feat(share): fluid doc width with clamp() for breathing
 room on wide screens
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The doc was hard-capped at max-w-[760px] regardless of viewport, so
1200px and 1920px monitors had identical doc widths with the latter
showing ~400px of empty space between the doc and the rail.

Switch to a single clamp() that interpolates smoothly between three
principled bounds:

  floor 47.5rem (760px) — current width; viewports that already feel
                           comfortable don't change behavior.
  pref  80%             — 80% of the doc-area (= 1fr column = vw - 360
                           rail). Grows fluidly with available space.
  ceil  60rem  (960px)  — readable upper bound. Past ~95ch the eye's
                           saccade between line-end and next-line gets
                           too long for comfortable prose. Code blocks
                           tolerate the extra width fine.

Effective widths by viewport:
  1100px (doc-area 740): 740 (parent caps)        — same as before
  1200px (doc-area 840): 760 (floor wins)         — same as before
  1440px (doc-area 1080): 864 (80% pref)          — +104
  1600px (doc-area 1240): 960 (ceiling)           — +200
  1920px+:                960 (ceiling)           — +200, stable

Static `max-w-[760px]` removed from the markup so the CSS clamp is
the single source of truth — no Tailwind/CSS conflict.

Side benefit: ASCII-art code blocks (e.g. the architecture diagram in
the shared-review plan) fit at 960px without horizontal scroll. The
narrow-viewport reading experience is unchanged.
---
 web/src/app.css                        | 19 +++++++++++++++++++
 web/src/routes/share/[id]/+page.svelte |  2 +-
 2 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/web/src/app.css b/web/src/app.css
index b9c6811..316be49 100644
--- a/web/src/app.css
+++ b/web/src/app.css
@@ -712,7 +712,26 @@
 .share-page {
 	grid-template-columns: minmax(0, 1fr) 360px;
 }
+/*
+ * Doc width — fluid clamp so the prose breathes on wide viewports
+ * without ever shrinking the comfortable narrow-screen experience.
+ *
+ *   floor 47.5rem (760px) — same width as before; viewports already
+ *                           comfortable today don't change.
+ *   pref  80%             — 80% of doc-area (= viewport minus rail);
+ *                           grows smoothly with available space.
+ *   ceil  60rem  (960px)  — readable upper bound. Past ~95ch the eye
+ *                           saccade between line-end and next-line
+ *                           gets too long for comfortable reading,
+ *                           even though monospace code blocks tolerate
+ *                           the extra width fine.
+ *
+ * `%` is relative to the parent's content box (the doc-area = `1fr`
+ * column), so we don't have to subtract the rail width by hand —
+ * the layout already did that for us.
+ */
 .share-page .doc-inner {
+	max-width: clamp(47.5rem, 80%, 60rem);
 	margin-left: auto;
 	margin-right: auto;
 }
diff --git a/web/src/routes/share/[id]/+page.svelte b/web/src/routes/share/[id]/+page.svelte
index 7cded6d..fefc35e 100644
--- a/web/src/routes/share/[id]/+page.svelte
+++ b/web/src/routes/share/[id]/+page.svelte
@@ -349,7 +349,7 @@
 		 the phantom desk column on the left and the rail on the right.
 		 See `.share-page` rules in app.css for the grid geometry. -->
 	<main class="doc-area overflow-y-auto">
-		<div class="doc-inner flex max-w-[760px] flex-col px-10 py-12">
+		<div class="doc-inner flex flex-col px-10 py-12">
 			<header
 				class="mb-10 flex items-baseline justify-between border-b border-[var(--ink-rule)] pb-6"
 			>

From 145beb1817339913b7c89ead0510a1459e6617bd Mon Sep 17 00:00:00 2001
From: Ben Firestone <ben.firestone@krypticlabs.com>
Date: Wed, 29 Apr 2026 21:32:03 -0700
Subject: [PATCH 20/20] chore(lint): clear all golangci-lint issues across
 paste & share packages
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Brings the repo back to a clean lint state after the share/paste feature
landed. Highlights:

- Rename paste.PasteShare/PasteEvent → paste.Share/Event (revive exported
  rule) and update all call sites.
- Hoist magic numbers to named constants (share ID length, edit token
  bytes, heading window, file modes, etc.).
- Replace deprecated middleware.Logger with RequestLoggerWithConfig in
  arc-paste; restructure main into run() error so deferred db.Close runs.
- Decompose printComments (cognitive complexity 52 → small helpers),
  resolveShareRef nesting, and TestResolveServer table-driven.
- Move paste tests to package paste_test; use t.Setenv; tighten test file
  perms to 0o600; add //nolint:gosec with reasons where the variable URL
  is the deliberate CLI behaviour.
- Add ErrShareNotFound to sharesconfig (replacing nil/nil return) and
  thread errors.Is checks through callers.
---
 arc-paste/main.go                          |  35 ++-
 arc-paste/main_test.go                     |   2 +-
 cmd/arc/share.go                           | 328 ++++++++++++---------
 cmd/arc/share_test.go                      | 201 +++++++------
 internal/paste/anchor.go                   |  36 ++-
 internal/paste/anchor_test.go              |  54 ++--
 internal/paste/cmd/genxlang/main.go        |  10 +-
 internal/paste/crypto.go                   |  10 +
 internal/paste/crypto_test.go              |  20 +-
 internal/paste/crypto_xlang_test.go        |  10 +-
 internal/paste/handlers.go                 |  60 +++-
 internal/paste/handlers_test.go            |  12 +-
 internal/paste/sqlite/migrations.go        |  18 +-
 internal/paste/sqlite/store.go             |  36 ++-
 internal/paste/sqlite/store_test.go        |  15 +-
 internal/paste/storage.go                  |  22 +-
 internal/paste/types.go                    |   8 +-
 internal/paste/types_test.go               |  43 +--
 internal/sharesconfig/sharesconfig.go      |  19 +-
 internal/sharesconfig/sharesconfig_test.go |   5 +-
 internal/storage/sqlite/store.go           |   2 +-
 21 files changed, 581 insertions(+), 365 deletions(-)

diff --git a/arc-paste/main.go b/arc-paste/main.go
index 03f4b4d..4e7b902 100644
--- a/arc-paste/main.go
+++ b/arc-paste/main.go
@@ -6,6 +6,7 @@ package main
 import (
 	"context"
 	"database/sql"
+	"fmt"
 	"log"
 	"os"
 	"path/filepath"
@@ -19,7 +20,18 @@ import (
 	"github.com/sentiolabs/arc/web"
 )
 
+// dbDirMode is the permission used when creating the parent directory of the
+// SQLite database. World-readable on purpose — the file mode itself (which
+// SQLite controls) is what protects the data.
+const dbDirMode = 0o755
+
 func main() {
+	if err := run(); err != nil {
+		log.Fatal(err)
+	}
+}
+
+func run() error {
 	addr := envOr("ARC_PASTE_ADDR", ":7433")
 	dbPath := envOr("ARC_PASTE_DB", "./arc-paste.db")
 
@@ -27,19 +39,19 @@ func main() {
 	// not the directory, which matters when running under scratch / distroless
 	// images that mount a fresh volume at a path the binary has never seen.
 	if dir := filepath.Dir(dbPath); dir != "." && dir != "/" {
-		if err := os.MkdirAll(dir, 0o755); err != nil {
-			log.Fatalf("create db dir %q: %v", dir, err)
+		if err := os.MkdirAll(dir, dbDirMode); err != nil {
+			return fmt.Errorf("create db dir %q: %w", dir, err)
 		}
 	}
 
 	db, err := sql.Open("sqlite", dbPath)
 	if err != nil {
-		log.Fatalf("open db: %v", err)
+		return fmt.Errorf("open db: %w", err)
 	}
 	defer db.Close()
 
 	if err := pastesqlite.Apply(context.Background(), db); err != nil {
-		log.Fatalf("apply migrations: %v", err)
+		return fmt.Errorf("apply migrations: %w", err)
 	}
 
 	store := pastesqlite.New(db)
@@ -47,7 +59,16 @@ func main() {
 
 	e := echo.New()
 	e.HideBanner = true
-	e.Use(middleware.Logger())
+	e.Use(middleware.RequestLoggerWithConfig(middleware.RequestLoggerConfig{
+		LogStatus: true,
+		LogURI:    true,
+		LogMethod: true,
+		LogError:  true,
+		LogValuesFunc: func(_ echo.Context, v middleware.RequestLoggerValues) error {
+			log.Printf("%s %s -> %d (err=%v)", v.Method, v.URI, v.Status, v.Error)
+			return nil
+		},
+	}))
 	e.Use(middleware.Recover())
 	e.Use(middleware.CORS())
 
@@ -57,9 +78,7 @@ func main() {
 	// Serve embedded SPA with fallback to index.html for routing
 	web.RegisterSPA(e)
 
-	if err := e.Start(addr); err != nil {
-		log.Fatalf("start server: %v", err)
-	}
+	return e.Start(addr)
 }
 
 // envOr returns the value of env variable key, or defaultVal if not set.
diff --git a/arc-paste/main_test.go b/arc-paste/main_test.go
index 7fb9c49..c1adb7c 100644
--- a/arc-paste/main_test.go
+++ b/arc-paste/main_test.go
@@ -9,10 +9,10 @@ import (
 	"net/http/httptest"
 	"testing"
 
-	_ "modernc.org/sqlite"
 	"github.com/labstack/echo/v4"
 	"github.com/sentiolabs/arc/internal/paste"
 	pastesqlite "github.com/sentiolabs/arc/internal/paste/sqlite"
+	_ "modernc.org/sqlite"
 )
 
 func TestArcPasteCreate(t *testing.T) {
diff --git a/cmd/arc/share.go b/cmd/arc/share.go
index bbe3ce8..9432c4c 100644
--- a/cmd/arc/share.go
+++ b/cmd/arc/share.go
@@ -5,6 +5,7 @@ package main
 import (
 	"encoding/base64"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"net/http"
@@ -53,11 +54,11 @@ type commentEvent struct {
 }
 
 type resolutionEvent struct {
-	Kind      string `json:"kind"`
-	ID        string `json:"id"`
-	CommentID string `json:"comment_id"`
-	Status    string `json:"status"`
-	Reply     string `json:"reply,omitempty"`
+	Kind       string `json:"kind"`
+	ID         string `json:"id"`
+	CommentID  string `json:"comment_id"`
+	Status     string `json:"status"`
+	Reply      string `json:"reply,omitempty"`
 	AuthorName string `json:"author_name"`
 	CreatedAt  string `json:"created_at"`
 }
@@ -87,14 +88,14 @@ type commentEntry struct {
 // fields distinguish "field omitted (keep)" from "field set to empty
 // (clear)" — Go zero values would conflate the two.
 type editEvent struct {
-	Kind        string  `json:"kind"` // always "edit"
-	ID          string  `json:"id"`
-	CommentID   string  `json:"comment_id"`
-	AuthorName  string  `json:"author_name"`
-	Body        *string `json:"body,omitempty"`
+	Kind          string  `json:"kind"` // always "edit"
+	ID            string  `json:"id"`
+	CommentID     string  `json:"comment_id"`
+	AuthorName    string  `json:"author_name"`
+	Body          *string `json:"body,omitempty"`
 	SuggestedText *string `json:"suggested_text,omitempty"`
-	CommentType *string `json:"comment_type,omitempty"`
-	CreatedAt   string  `json:"created_at"`
+	CommentType   *string `json:"comment_type,omitempty"`
+	CreatedAt     string  `json:"created_at"`
 }
 
 // --- commands ---
@@ -148,10 +149,22 @@ var shareApproveCmd = &cobra.Command{
 var shareUpdateCmd = &cobra.Command{
 	Use:   "update <id-or-url> <plan-file>",
 	Short: "Replace the encrypted plan content (uses edit_token from shares.json)",
-	Args:  cobra.ExactArgs(2),
-	RunE:  runShareUpdate,
+	// `update` takes exactly the share ref AND the plan file path.
+	Args: cobra.ExactArgs(shareUpdateArgCount),
+	RunE: runShareUpdate,
 }
 
+const shareUpdateArgCount = 2
+
+// shareKindLocal / shareKindShared label the resolved server in the saved
+// shares.json registry and surface in `arc share list` output.
+const (
+	shareKindLocal  = "local"
+	shareKindShared = "shared"
+)
+
+const defaultShareServer = "https://arcplanner.sentiolabs.io"
+
 var shareDeleteCmd = &cobra.Command{
 	Use:   "delete <id-or-url>",
 	Short: "Delete a share (uses edit_token from shares.json)",
@@ -172,9 +185,15 @@ var (
 func init() {
 	shareCreateCmd.Flags().BoolVar(&shareCreateLocal, "local", false, "Use the local arc-server")
 	shareCreateCmd.Flags().BoolVar(&shareCreateRemote, "share", false, "Use the configured remote share server")
-	shareCreateCmd.Flags().StringVar(&shareCreateServer, "server", "", "Server URL override. With --share, resolution is: --server flag → share_server in ~/.arc/cli-config.json → $ARC_SHARE_SERVER → https://arcplanner.sentiolabs.io.")
-	shareCreateCmd.Flags().StringVar(&shareCreateAuthor, "author", "", "Author name embedded in the plan. Resolution: --author flag → share_author in ~/.arc/cli-config.json → $ARC_SHARE_AUTHOR → `git config user.name`. Reviewers who enter this exact name in the share UI gain Accept/Resolve/Reject controls.")
-	shareCreateCmd.Flags().StringVar(&shareCreateTitle, "title", "", "Optional plan title shown in the share UI header (defaults to the filename)")
+	shareCreateCmd.Flags().StringVar(&shareCreateServer, "server", "",
+		"Server URL override (precedence: flag > share_server in cli-config.json > "+
+			"$ARC_SHARE_SERVER > built-in default).")
+	shareCreateCmd.Flags().StringVar(&shareCreateAuthor, "author", "",
+		"Author name embedded in the plan (precedence: flag > share_author in "+
+			"cli-config.json > $ARC_SHARE_AUTHOR > `git config user.name`). "+
+			"Reviewers entering this exact name gain Accept/Resolve/Reject controls.")
+	shareCreateCmd.Flags().StringVar(&shareCreateTitle, "title", "",
+		"Optional plan title shown in the share UI header (defaults to the filename)")
 	shareCommentsCmd.Flags().BoolVar(&shareCommentsAccepted, "accepted-only", false, "Only print accepted comments")
 	shareCommentsCmd.Flags().BoolVar(&shareCommentsJSON, "json", false, "Output as JSON")
 
@@ -198,11 +217,11 @@ func runShareCreate(cmd *cobra.Command, args []string) error {
 	}
 	author := resolveAuthor(shareCreateAuthor)
 	if author == "" {
-		fmt.Fprintln(os.Stderr, "warning: no author name resolved.")
-		fmt.Fprintln(os.Stderr, "         Set one via --author, share_author in ~/.arc/cli-config.json,")
-		fmt.Fprintln(os.Stderr, "         $ARC_SHARE_AUTHOR, or `git config user.name`.")
-		fmt.Fprintln(os.Stderr, "         Without an author, Accept/Resolve/Reject controls in the share UI")
-		fmt.Fprintln(os.Stderr, "         stay hidden for every reviewer.")
+		_, _ = fmt.Fprintln(os.Stderr, "warning: no author name resolved.")
+		_, _ = fmt.Fprintln(os.Stderr, "         Set one via --author, share_author in ~/.arc/cli-config.json,")
+		_, _ = fmt.Fprintln(os.Stderr, "         $ARC_SHARE_AUTHOR, or `git config user.name`.")
+		_, _ = fmt.Fprintln(os.Stderr, "         Without an author, Accept/Resolve/Reject controls in the share UI")
+		_, _ = fmt.Fprintln(os.Stderr, "         stay hidden for every reviewer.")
 	}
 	title := shareCreateTitle
 	if title == "" {
@@ -390,14 +409,14 @@ func resolveAuthor(flag string) string {
 // For local mode, the server URL comes from `server_url` in the CLI config
 // (defaulting to http://localhost:7432). The `--server` flag still wins over
 // everything in either mode.
-func resolveServer(_ bool, share bool, override string) (string, string) {
+func resolveServer(_, share bool, override string) (server, kind string) {
 	if s := strings.TrimSpace(override); s != "" {
-		return s, "shared"
+		return s, shareKindShared
 	}
 	if share {
-		return resolveShareServer(), "shared"
+		return resolveShareServer(), shareKindShared
 	}
-	return cliConfigServerURL(), "local"
+	return cliConfigServerURL(), shareKindLocal
 }
 
 // resolveShareServer returns the URL of the remote paste server, resolving in
@@ -412,7 +431,7 @@ func resolveShareServer() string {
 	if s := strings.TrimSpace(os.Getenv("ARC_SHARE_SERVER")); s != "" {
 		return s
 	}
-	return "https://arcplanner.sentiolabs.io"
+	return defaultShareServer
 }
 
 // cliConfigServerURL returns the server URL from the CLI config, falling back
@@ -429,6 +448,8 @@ func cliConfigServerURL() string {
 func postCreate(server string, blob, iv []byte) (*paste.CreatePasteResponse, error) {
 	u := strings.TrimRight(server, "/") + "/api/paste"
 	body, _ := json.Marshal(paste.CreatePasteRequest{PlanBlob: blob, PlanIV: iv, SchemaVer: 1})
+	// Variable URL is the entire point of the CLI — the user picks the server.
+	//nolint:gosec // G107: intentional user-supplied server URL
 	resp, err := http.Post(u, "application/json", strings.NewReader(string(body)))
 	if err != nil {
 		return nil, err
@@ -446,6 +467,8 @@ func postCreate(server string, blob, iv []byte) (*paste.CreatePasteResponse, err
 func postEvent(server, id string, blob, iv []byte) error {
 	u := strings.TrimRight(server, "/") + "/api/paste/" + url.PathEscape(id) + "/blobs"
 	body, _ := json.Marshal(paste.AppendEventRequest{Blob: blob, IV: iv})
+	// Variable URL is the entire point of the CLI — the user picks the server.
+	//nolint:gosec // G107: intentional user-supplied server URL
 	resp, err := http.Post(u, "application/json", strings.NewReader(string(body)))
 	if err != nil {
 		return err
@@ -496,8 +519,10 @@ func deleteShare(server, id, token string) error {
 
 // fetchAndDecrypt retrieves a share from the server and decrypts the plan
 // blob using the provided key.
-func fetchAndDecrypt(server, id string, key []byte) (*planPlaintext, []paste.PasteEvent, error) {
-	resp, err := http.Get(strings.TrimRight(server, "/") + "/api/paste/" + url.PathEscape(id))
+func fetchAndDecrypt(server, id string, key []byte) (*planPlaintext, []paste.Event, error) {
+	// Variable URL is the entire point of the CLI — the user picks the server.
+	getURL := strings.TrimRight(server, "/") + "/api/paste/" + url.PathEscape(id)
+	resp, err := http.Get(getURL) //nolint:gosec // G107: intentional user-supplied server URL
 	if err != nil {
 		return nil, nil, err
 	}
@@ -506,8 +531,8 @@ func fetchAndDecrypt(server, id string, key []byte) (*planPlaintext, []paste.Pas
 		return nil, nil, fmt.Errorf("get paste: %s", resp.Status)
 	}
 	var pr struct {
-		paste.PasteShare
-		Events []paste.PasteEvent `json:"events"`
+		paste.Share
+		Events []paste.Event `json:"events"`
 	}
 	if err := json.NewDecoder(resp.Body).Decode(&pr); err != nil {
 		return nil, nil, err
@@ -537,13 +562,28 @@ func printComments(server, id string, key []byte, acceptedOnly, asJSON bool) err
 	if err != nil {
 		return err
 	}
-	type decoded struct {
-		kind string
-		raw  json.RawMessage
-		ts   string
-		eid  string
+	decoded := decodeAndSortEvents(events, key)
+	comments, resolutions := replayEvents(decoded, plan.AuthorName)
+	entries := buildCommentEntries(comments, resolutions, acceptedOnly)
+	if asJSON {
+		return emitBundle(id, plan, entries)
 	}
-	decodedEvents := make([]decoded, 0, len(events))
+	printCommentEntries(entries)
+	return nil
+}
+
+// decodedEvent is the intermediate form used to sort events chronologically
+// before replaying them. raw is kept around so the typed unmarshal can run in
+// the replay loop without re-decrypting.
+type decodedEvent struct {
+	kind string
+	raw  json.RawMessage
+	ts   string
+	eid  string
+}
+
+func decodeAndSortEvents(events []paste.Event, key []byte) []decodedEvent {
+	out := make([]decodedEvent, 0, len(events))
 	for _, e := range events {
 		var raw json.RawMessage
 		if err := paste.DecryptJSON(e.Blob, e.IV, key, &raw); err != nil {
@@ -557,81 +597,98 @@ func printComments(server, id string, key []byte, acceptedOnly, asJSON bool) err
 		if err := json.Unmarshal(raw, &generic); err != nil {
 			continue
 		}
-		decodedEvents = append(decodedEvents, decoded{
-			kind: generic.Kind,
-			raw:  raw,
-			ts:   generic.CreatedAt,
-			eid:  generic.ID,
-		})
+		out = append(out, decodedEvent{kind: generic.Kind, raw: raw, ts: generic.CreatedAt, eid: generic.ID})
 	}
 	// Stable chronological order for deterministic edit application.
-	sort.SliceStable(decodedEvents, func(i, j int) bool {
-		if decodedEvents[i].ts != decodedEvents[j].ts {
-			return decodedEvents[i].ts < decodedEvents[j].ts
+	sort.SliceStable(out, func(i, j int) bool {
+		if out[i].ts != out[j].ts {
+			return out[i].ts < out[j].ts
 		}
-		return decodedEvents[i].eid < decodedEvents[j].eid
+		return out[i].eid < out[j].eid
 	})
+	return out
+}
 
+func replayEvents(events []decodedEvent, planAuthor string) (map[string]commentEvent, map[string]resolutionEvent) {
 	comments := map[string]commentEvent{}
 	resolutions := map[string]resolutionEvent{}
-	for _, d := range decodedEvents {
+	for _, d := range events {
 		switch d.kind {
 		case "comment":
-			var c commentEvent
-			if err := json.Unmarshal(d.raw, &c); err == nil {
-				comments[c.ID] = c
-			}
+			applyCommentEvent(d.raw, comments)
 		case "resolution":
-			var r resolutionEvent
-			if err := json.Unmarshal(d.raw, &r); err == nil {
-				if plan.AuthorName == "" || r.AuthorName == plan.AuthorName {
-					resolutions[r.CommentID] = r
-				}
-			}
+			applyResolutionEvent(d.raw, planAuthor, resolutions)
 		case "edit":
-			var ed editEvent
-			if err := json.Unmarshal(d.raw, &ed); err != nil {
-				continue
-			}
-			c, ok := comments[ed.CommentID]
-			if !ok {
-				continue
-			}
-			// Replay-time auth: edits are accepted from either the comment's
-			// original author OR the plan author (so the author can sharpen
-			// thin reviewer feedback like "expand this more"). The displayed
-			// comment.author_name is unchanged either way — only the edit
-			// event itself records who actually edited. Forged events from
-			// third parties are silently dropped.
-			//
-			// `plan.AuthorName` must be non-empty before granting plan-owner
-			// edit rights; otherwise empty strings on both sides would all
-			// match and accidentally authorize anonymous edits.
-			isOriginal := ed.AuthorName == c.AuthorName
-			isPlanAuthor := plan.AuthorName != "" && ed.AuthorName == plan.AuthorName
-			if !isOriginal && !isPlanAuthor {
-				continue
-			}
-			if ed.Body != nil {
-				c.Body = *ed.Body
-			}
-			if ed.SuggestedText != nil {
-				c.SuggestedText = *ed.SuggestedText
-			}
-			if ed.CommentType != nil {
-				c.CommentType = *ed.CommentType
-			}
-			comments[ed.CommentID] = c
+			applyEditEvent(d.raw, planAuthor, comments)
 		}
 	}
+	return comments, resolutions
+}
+
+func applyCommentEvent(raw json.RawMessage, comments map[string]commentEvent) {
+	var c commentEvent
+	if err := json.Unmarshal(raw, &c); err == nil {
+		comments[c.ID] = c
+	}
+}
+
+func applyResolutionEvent(raw json.RawMessage, planAuthor string, resolutions map[string]resolutionEvent) {
+	var r resolutionEvent
+	if err := json.Unmarshal(raw, &r); err != nil {
+		return
+	}
+	if planAuthor == "" || r.AuthorName == planAuthor {
+		resolutions[r.CommentID] = r
+	}
+}
+
+// applyEditEvent merges body/suggested_text/comment_type fields onto the
+// target comment. Replay-time auth: edits are accepted from either the
+// comment's original author OR the plan author (so the author can sharpen
+// thin reviewer feedback like "expand this more"). The displayed
+// comment.author_name is unchanged either way — only the edit event itself
+// records who actually edited. Forged events from third parties are silently
+// dropped. planAuthor must be non-empty before granting plan-owner edit
+// rights; otherwise empty strings on both sides would all match and
+// accidentally authorize anonymous edits.
+func applyEditEvent(raw json.RawMessage, planAuthor string, comments map[string]commentEvent) {
+	var ed editEvent
+	if err := json.Unmarshal(raw, &ed); err != nil {
+		return
+	}
+	c, ok := comments[ed.CommentID]
+	if !ok {
+		return
+	}
+	isOriginal := ed.AuthorName == c.AuthorName
+	isPlanAuthor := planAuthor != "" && ed.AuthorName == planAuthor
+	if !isOriginal && !isPlanAuthor {
+		return
+	}
+	if ed.Body != nil {
+		c.Body = *ed.Body
+	}
+	if ed.SuggestedText != nil {
+		c.SuggestedText = *ed.SuggestedText
+	}
+	if ed.CommentType != nil {
+		c.CommentType = *ed.CommentType
+	}
+	comments[ed.CommentID] = c
+}
+
+func buildCommentEntries(
+	comments map[string]commentEvent,
+	resolutions map[string]resolutionEvent,
+	acceptedOnly bool,
+) []commentEntry {
 	// Build a deterministic-order list of comment entries so multiple runs
 	// produce identical output (Go map iteration is randomized).
 	entries := make([]commentEntry, 0, len(comments))
 	for cid, c := range comments {
-		res, ok := resolutions[cid]
 		status := "open"
 		reply := ""
-		if ok {
+		if res, ok := resolutions[cid]; ok {
 			status = res.Status
 			reply = res.Reply
 		}
@@ -643,19 +700,19 @@ func printComments(server, id string, key []byte, acceptedOnly, asJSON bool) err
 	sort.SliceStable(entries, func(i, j int) bool {
 		return entries[i].comment.CreatedAt < entries[j].comment.CreatedAt
 	})
+	return entries
+}
 
-	if asJSON {
-		return emitBundle(id, plan, entries)
-	}
+func printCommentEntries(entries []commentEntry) {
 	for _, e := range entries {
 		// Mark deletes visually so they don't get mistaken for empty-body comments.
 		prefix := ""
 		if e.comment.Action == "delete" {
 			prefix = "[delete] "
 		}
-		fmt.Printf("[%s] %s%s (%s): %s\n", e.status, prefix, e.comment.AuthorName, e.comment.CommentType, e.comment.Body)
+		fmt.Printf("[%s] %s%s (%s): %s\n",
+			e.status, prefix, e.comment.AuthorName, e.comment.CommentType, e.comment.Body)
 	}
-	return nil
 }
 
 // shareBundle is the JSON shape emitted by `arc share comments --json`.
@@ -692,10 +749,10 @@ type bundlePlan struct {
 }
 
 type bundleComment struct {
-	Comment        commentEvent           `json:"comment"`
-	Status         string                 `json:"status"`
-	Reply          string                 `json:"reply,omitempty"`
-	ResolvedAnchor *bundleResolvedAnchor  `json:"resolved_anchor,omitempty"`
+	Comment        commentEvent          `json:"comment"`
+	Status         string                `json:"status"`
+	Reply          string                `json:"reply,omitempty"`
+	ResolvedAnchor *bundleResolvedAnchor `json:"resolved_anchor,omitempty"`
 }
 
 type bundleResolvedAnchor struct {
@@ -780,39 +837,46 @@ func emitBundle(id string, plan *planPlaintext, entries []commentEntry) error {
 }
 
 // resolveShareRef parses a share reference which may be either a full share
-// URL (e.g. https://arcplanner.sentiolabs.io/share/abc12345#k=KEY) or a bare share ID
-// known to ~/.arc/shares.json.
-func resolveShareRef(ref string) (string, string, []byte, error) {
+// URL (e.g. https://arcplanner.sentiolabs.io/share/abc12345#k=KEY) or a bare
+// share ID known to ~/.arc/shares.json.
+func resolveShareRef(ref string) (id, server string, key []byte, err error) {
 	if strings.Contains(ref, "://") {
-		u, err := url.Parse(ref)
-		if err != nil {
-			return "", "", nil, err
-		}
-		parts := strings.Split(strings.Trim(u.Path, "/"), "/")
-		if len(parts) < 2 || parts[0] != "share" {
-			return "", "", nil, fmt.Errorf("invalid share URL: %s", ref)
-		}
-		id := parts[1]
-		frag, _ := url.ParseQuery(u.Fragment)
-		keyB64 := frag.Get("k")
-		if keyB64 == "" {
-			if s, _ := sharesconfig.Find(id); s != nil {
-				keyB64 = s.KeyB64Url
-			}
-		}
-		key, err := base64.RawURLEncoding.DecodeString(keyB64)
-		if err != nil {
-			return "", "", nil, err
+		return resolveShareURL(ref)
+	}
+	s, ferr := sharesconfig.Find(ref)
+	if ferr != nil {
+		if errors.Is(ferr, sharesconfig.ErrShareNotFound) {
+			return "", "", nil, fmt.Errorf("unknown share id: %s", ref)
 		}
-		return id, u.Scheme + "://" + u.Host, key, nil
+		return "", "", nil, ferr
 	}
-	s, err := sharesconfig.Find(ref)
-	if err != nil {
-		return "", "", nil, err
+	key, _ = base64.RawURLEncoding.DecodeString(s.KeyB64Url)
+	return s.ID, s.URL, key, nil
+}
+
+// resolveShareURL is the URL branch of resolveShareRef, split out to keep the
+// nesting depth low. Falls back to ~/.arc/shares.json for the key if the URL
+// has no fragment.
+func resolveShareURL(ref string) (id, server string, key []byte, err error) {
+	u, perr := url.Parse(ref)
+	if perr != nil {
+		return "", "", nil, perr
+	}
+	parts := strings.Split(strings.Trim(u.Path, "/"), "/")
+	if len(parts) < 2 || parts[0] != "share" {
+		return "", "", nil, fmt.Errorf("invalid share URL: %s", ref)
+	}
+	id = parts[1]
+	frag, _ := url.ParseQuery(u.Fragment)
+	keyB64 := frag.Get("k")
+	if keyB64 == "" {
+		if s, ferr := sharesconfig.Find(id); ferr == nil {
+			keyB64 = s.KeyB64Url
+		}
 	}
-	if s == nil {
-		return "", "", nil, fmt.Errorf("unknown share id: %s", ref)
+	key, derr := base64.RawURLEncoding.DecodeString(keyB64)
+	if derr != nil {
+		return "", "", nil, derr
 	}
-	key, _ := base64.RawURLEncoding.DecodeString(s.KeyB64Url)
-	return s.ID, s.URL, key, nil
+	return id, u.Scheme + "://" + u.Host, key, nil
 }
diff --git a/cmd/arc/share_test.go b/cmd/arc/share_test.go
index f6c914e..83baedf 100644
--- a/cmd/arc/share_test.go
+++ b/cmd/arc/share_test.go
@@ -43,7 +43,7 @@ func TestShareCreateRoundTrip(t *testing.T) {
 	defer srv.Close()
 
 	plan := filepath.Join(t.TempDir(), "plan.md")
-	_ = os.WriteFile(plan, []byte("# Hello\n\nBody."), 0o644)
+	_ = os.WriteFile(plan, []byte("# Hello\n\nBody."), 0o600)
 
 	shareCreateServer = srv.URL
 	if err := runShareCreate(shareCreateCmd, []string{plan}); err != nil {
@@ -81,7 +81,7 @@ func TestRunShareCommentsRoundTrip(t *testing.T) {
 
 	// Create a plan
 	plan := filepath.Join(t.TempDir(), "p.md")
-	_ = os.WriteFile(plan, []byte("# P"), 0o644)
+	_ = os.WriteFile(plan, []byte("# P"), 0o600)
 	shareCreateServer = srv.URL
 	_ = runShareCreate(shareCreateCmd, []string{plan})
 
@@ -118,7 +118,7 @@ func TestRunShareCommentsAppliesEdits(t *testing.T) {
 	defer srv.Close()
 
 	plan := filepath.Join(t.TempDir(), "p.md")
-	_ = os.WriteFile(plan, []byte("# P"), 0o644)
+	_ = os.WriteFile(plan, []byte("# P"), 0o600)
 	shareCreateServer = srv.URL
 	_ = runShareCreate(shareCreateCmd, []string{plan})
 
@@ -185,7 +185,7 @@ func TestRunShareCommentsAppliesPlanAuthorEdits(t *testing.T) {
 	defer srv.Close()
 
 	plan := filepath.Join(t.TempDir(), "p.md")
-	_ = os.WriteFile(plan, []byte("# P"), 0o644)
+	_ = os.WriteFile(plan, []byte("# P"), 0o600)
 	shareCreateServer = srv.URL
 	// Pin the plan author via flag so the replay knows who has author rights.
 	shareCreateAuthor = "Ben"
@@ -259,9 +259,10 @@ func TestRunShareCommentsJSONBundle(t *testing.T) {
 	defer srv.Close()
 
 	// A small but realistic plan with sections the SPA would slugify.
-	planText := "# Test Plan\n\n## Goal\n\nValidate the shared review feature.\n\n## Approach\n\n- Selection-based annotation\n- Conventional labels\n"
+	planText := "# Test Plan\n\n## Goal\n\nValidate the shared review feature.\n\n" +
+		"## Approach\n\n- Selection-based annotation\n- Conventional labels\n"
 	planFile := filepath.Join(t.TempDir(), "plan.md")
-	if err := os.WriteFile(planFile, []byte(planText), 0o644); err != nil {
+	if err := os.WriteFile(planFile, []byte(planText), 0o600); err != nil {
 		t.Fatal(err)
 	}
 	shareCreateServer = srv.URL
@@ -410,7 +411,7 @@ func TestRunShareCommentsJSONBundle_NoLocalFile(t *testing.T) {
 	// has the plan content, so the CLI falls back to it.
 	planText := "# Test Plan\n\n## Goal\n\nA quick \"quoted\" test with newlines.\n"
 	planFile := filepath.Join(t.TempDir(), "plan.md")
-	if err := os.WriteFile(planFile, []byte(planText), 0o644); err != nil {
+	if err := os.WriteFile(planFile, []byte(planText), 0o600); err != nil {
 		t.Fatal(err)
 	}
 	shareCreateServer = srv.URL
@@ -474,7 +475,8 @@ func mustDecodeKey(t *testing.T, b64 string) []byte {
 // is not 2xx.
 func postRaw(t *testing.T, url string, body []byte) error {
 	t.Helper()
-	resp, err := http.Post(url, "application/json", bytes.NewReader(body))
+	// Variable URL is intentional — tests post to httptest.Server URLs.
+	resp, err := http.Post(url, "application/json", bytes.NewReader(body)) //nolint:gosec // G107: test-controlled URL
 	if err != nil {
 		return err
 	}
@@ -499,18 +501,13 @@ func captureStdout(t *testing.T, fn func()) string {
 
 	fn()
 
-	w.Close()
+	_ = w.Close()
 	os.Stdout = old
 	var buf bytes.Buffer
 	_, _ = io.Copy(&buf, r)
 	return buf.String()
 }
 
-// contains is a convenience wrapper around strings.Contains.
-func contains(s, substr string) bool {
-	return strings.Contains(s, substr)
-}
-
 // TestResolveAuthor locks in the resolution precedence:
 //
 //	flag > config file > env var > git config (lowest)
@@ -520,18 +517,13 @@ func contains(s, substr string) bool {
 // running each subtest with $PATH cleared so `git` is unavailable (the
 // helper falls back silently to "" on git failure).
 func TestResolveAuthor(t *testing.T) {
-	// Save & restore globals touched by the helper.
+	// Save & restore globals touched by the helper. Env vars use t.Setenv
+	// which auto-restores; configPath is package-global so we restore manually.
 	origConfigPath := configPath
-	origEnv := os.Getenv("ARC_SHARE_AUTHOR")
-	origPath := os.Getenv("PATH")
-	t.Cleanup(func() {
-		configPath = origConfigPath
-		_ = os.Setenv("ARC_SHARE_AUTHOR", origEnv)
-		_ = os.Setenv("PATH", origPath)
-	})
+	t.Cleanup(func() { configPath = origConfigPath })
 
 	// Strip git from PATH so the lowest tier resolves to "" deterministically.
-	_ = os.Setenv("PATH", "")
+	t.Setenv("PATH", "")
 
 	writeConfig := func(t *testing.T, author string) {
 		t.Helper()
@@ -542,14 +534,14 @@ func TestResolveAuthor(t *testing.T) {
 			body += `,"share_author":"` + author + `"`
 		}
 		body += `}`
-		if err := os.WriteFile(configPath, []byte(body), 0600); err != nil {
+		if err := os.WriteFile(configPath, []byte(body), 0o600); err != nil {
 			t.Fatalf("write config: %v", err)
 		}
 	}
 
 	t.Run("flag wins over everything", func(t *testing.T) {
 		writeConfig(t, "from-config")
-		_ = os.Setenv("ARC_SHARE_AUTHOR", "from-env")
+		t.Setenv("ARC_SHARE_AUTHOR", "from-env")
 		if got := resolveAuthor("from-flag"); got != "from-flag" {
 			t.Errorf("flag should win; got %q", got)
 		}
@@ -557,7 +549,7 @@ func TestResolveAuthor(t *testing.T) {
 
 	t.Run("config wins over env when no flag", func(t *testing.T) {
 		writeConfig(t, "from-config")
-		_ = os.Setenv("ARC_SHARE_AUTHOR", "from-env")
+		t.Setenv("ARC_SHARE_AUTHOR", "from-env")
 		if got := resolveAuthor(""); got != "from-config" {
 			t.Errorf("config should win over env; got %q", got)
 		}
@@ -565,7 +557,7 @@ func TestResolveAuthor(t *testing.T) {
 
 	t.Run("env wins when config empty", func(t *testing.T) {
 		writeConfig(t, "")
-		_ = os.Setenv("ARC_SHARE_AUTHOR", "from-env")
+		t.Setenv("ARC_SHARE_AUTHOR", "from-env")
 		if got := resolveAuthor(""); got != "from-env" {
 			t.Errorf("env should win; got %q", got)
 		}
@@ -573,7 +565,7 @@ func TestResolveAuthor(t *testing.T) {
 
 	t.Run("flag whitespace is trimmed and treated as empty", func(t *testing.T) {
 		writeConfig(t, "from-config")
-		_ = os.Setenv("ARC_SHARE_AUTHOR", "")
+		t.Setenv("ARC_SHARE_AUTHOR", "")
 		if got := resolveAuthor("   "); got != "from-config" {
 			t.Errorf("whitespace flag should fall through; got %q", got)
 		}
@@ -581,7 +573,7 @@ func TestResolveAuthor(t *testing.T) {
 
 	t.Run("everything empty resolves to empty string", func(t *testing.T) {
 		writeConfig(t, "")
-		_ = os.Setenv("ARC_SHARE_AUTHOR", "")
+		t.Setenv("ARC_SHARE_AUTHOR", "")
 		if got := resolveAuthor(""); got != "" {
 			t.Errorf("expected empty; got %q", got)
 		}
@@ -599,80 +591,87 @@ func TestResolveAuthor(t *testing.T) {
 func TestResolveServer(t *testing.T) {
 	const builtinDefault = "https://arcplanner.sentiolabs.io"
 
+	// Save & restore configPath manually; ARC_SHARE_SERVER uses t.Setenv
+	// inside subtests for auto-restore.
 	origConfigPath := configPath
-	origEnv := os.Getenv("ARC_SHARE_SERVER")
-	t.Cleanup(func() {
-		configPath = origConfigPath
-		_ = os.Setenv("ARC_SHARE_SERVER", origEnv)
-	})
-
-	writeConfigShareServer := func(t *testing.T, server string) {
-		t.Helper()
-		dir := t.TempDir()
-		configPath = filepath.Join(dir, "cli-config.json")
-		body := `{"server_url":"http://localhost:7432"`
-		if server != "" {
-			body += `,"share_server":"` + server + `"`
-		}
-		body += `}`
-		if err := os.WriteFile(configPath, []byte(body), 0600); err != nil {
-			t.Fatalf("write config: %v", err)
-		}
+	t.Cleanup(func() { configPath = origConfigPath })
+
+	cases := []struct {
+		name      string
+		config    string // share_server in cli-config.json; "" omits the field
+		env       string // ARC_SHARE_SERVER value; "" clears it
+		share     bool
+		local     bool
+		flag      string
+		wantURL   string
+		wantKind  string
+		wantNoEnv bool // true → don't t.Setenv at all (skip env priming)
+	}{
+		{
+			name:   "flag wins over everything",
+			config: "https://from-config.example", env: "https://from-env.example",
+			share: true, flag: "https://from-flag.example",
+			wantURL: "https://from-flag.example", wantKind: shareKindShared,
+		},
+		{
+			// The override flag is intentionally global — it forces shared mode
+			// regardless of which boolean flags are set, mirroring the previous
+			// behavior. Locked in here so it doesn't silently drift.
+			name:   "flag wins even without --share",
+			config: "https://from-config.example",
+			local:  true, flag: "https://from-flag.example", wantNoEnv: true,
+			wantURL: "https://from-flag.example", wantKind: shareKindShared,
+		},
+		{
+			name:   "config wins over env when no flag",
+			config: "https://from-config.example", env: "https://from-env.example",
+			share:   true,
+			wantURL: "https://from-config.example", wantKind: shareKindShared,
+		},
+		{
+			name: "env wins when config empty",
+			env:  "https://from-env.example", share: true,
+			wantURL: "https://from-env.example", wantKind: shareKindShared,
+		},
+		{
+			name:    "falls back to built-in default",
+			share:   true,
+			wantURL: builtinDefault, wantKind: shareKindShared,
+		},
+		{
+			name:   "flag whitespace is trimmed and treated as empty",
+			config: "https://from-config.example",
+			share:  true, flag: "   ",
+			wantURL: "https://from-config.example", wantKind: shareKindShared,
+		},
 	}
 
-	t.Run("flag wins over everything", func(t *testing.T) {
-		writeConfigShareServer(t, "https://from-config.example")
-		_ = os.Setenv("ARC_SHARE_SERVER", "https://from-env.example")
-		got, kind := resolveServer(false, true, "https://from-flag.example")
-		if got != "https://from-flag.example" || kind != "shared" {
-			t.Errorf("flag should win; got (%q, %q)", got, kind)
-		}
-	})
-
-	t.Run("flag wins even without --share", func(t *testing.T) {
-		// The override flag is intentionally global — it forces shared mode
-		// regardless of which boolean flags are set, mirroring the previous
-		// behavior. Locked in here so it doesn't silently drift.
-		writeConfigShareServer(t, "https://from-config.example")
-		got, kind := resolveServer(true, false, "https://from-flag.example")
-		if got != "https://from-flag.example" || kind != "shared" {
-			t.Errorf("flag should win even without --share; got (%q, %q)", got, kind)
-		}
-	})
-
-	t.Run("config wins over env when no flag", func(t *testing.T) {
-		writeConfigShareServer(t, "https://from-config.example")
-		_ = os.Setenv("ARC_SHARE_SERVER", "https://from-env.example")
-		got, kind := resolveServer(false, true, "")
-		if got != "https://from-config.example" || kind != "shared" {
-			t.Errorf("config should win over env; got (%q, %q)", got, kind)
-		}
-	})
-
-	t.Run("env wins when config empty", func(t *testing.T) {
-		writeConfigShareServer(t, "")
-		_ = os.Setenv("ARC_SHARE_SERVER", "https://from-env.example")
-		got, kind := resolveServer(false, true, "")
-		if got != "https://from-env.example" || kind != "shared" {
-			t.Errorf("env should win; got (%q, %q)", got, kind)
-		}
-	})
-
-	t.Run("falls back to built-in default", func(t *testing.T) {
-		writeConfigShareServer(t, "")
-		_ = os.Setenv("ARC_SHARE_SERVER", "")
-		got, kind := resolveServer(false, true, "")
-		if got != builtinDefault || kind != "shared" {
-			t.Errorf("expected default; got (%q, %q)", got, kind)
-		}
-	})
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			writeShareServerConfig(t, tc.config)
+			if !tc.wantNoEnv {
+				t.Setenv("ARC_SHARE_SERVER", tc.env)
+			}
+			got, kind := resolveServer(tc.local, tc.share, tc.flag)
+			if got != tc.wantURL || kind != tc.wantKind {
+				t.Errorf("resolveServer = (%q, %q), want (%q, %q)", got, kind, tc.wantURL, tc.wantKind)
+			}
+		})
+	}
+}
 
-	t.Run("flag whitespace is trimmed and treated as empty", func(t *testing.T) {
-		writeConfigShareServer(t, "https://from-config.example")
-		_ = os.Setenv("ARC_SHARE_SERVER", "")
-		got, kind := resolveServer(false, true, "   ")
-		if got != "https://from-config.example" || kind != "shared" {
-			t.Errorf("whitespace flag should fall through; got (%q, %q)", got, kind)
-		}
-	})
+// writeShareServerConfig points the global configPath at a temp cli-config.json
+// containing the given share_server (omitted entirely when empty).
+func writeShareServerConfig(t *testing.T, server string) {
+	t.Helper()
+	dir := t.TempDir()
+	configPath = filepath.Join(dir, "cli-config.json")
+	body := `{"server_url":"http://localhost:7432"`
+	if server != "" {
+		body += `,"share_server":"` + server + `"`
+	}
+	body += `}`
+	if err := os.WriteFile(configPath, []byte(body), 0o600); err != nil {
+		t.Fatalf("write config: %v", err)
+	}
 }
diff --git a/internal/paste/anchor.go b/internal/paste/anchor.go
index 03c3b2d..011ba0d 100644
--- a/internal/paste/anchor.go
+++ b/internal/paste/anchor.go
@@ -1,5 +1,3 @@
-// Package paste — anchor.go
-//
 // Anchor resolution for replaying reviewer annotations against a possibly-
 // edited plan. Mirror of web/src/lib/paste/anchor.ts; the two sides MUST
 // stay in sync since both consume the same encrypted Anchor payloads.
@@ -11,7 +9,6 @@
 //     → status=drifted
 //  4. None of the above: status=orphaned, original line numbers preserved
 //     for display purposes.
-
 package paste
 
 import (
@@ -19,6 +16,11 @@ import (
 	"strings"
 )
 
+// headingWindowLines bounds the heading-scoped fuzzy search at step 2 of
+// ResolveAnchor — large enough to span typical sections, small enough that an
+// unrelated re-occurrence later in the plan can't accidentally match.
+const headingWindowLines = 50
+
 // Anchor mirrors the TS Anchor type (web/src/lib/paste/types.ts). Encoded as
 // JSON inside encrypted comment events; decoded here only when the CLI needs
 // to relocate a comment against a current plan.
@@ -33,6 +35,20 @@ type Anchor struct {
 	HeadingSlug   string `json:"heading_slug,omitempty"`
 }
 
+// AnchorStatus values for AnchorResolution.Status. Mirrored on the SPA side;
+// adding/renaming a status here breaks the cross-language contract.
+const (
+	// AnchorStatusOK means the original line numbers still contain the quoted
+	// text — no relocation was needed.
+	AnchorStatusOK = "ok"
+	// AnchorStatusDrifted means the anchor was relocated via heading scope
+	// or fuzzy context match; the new line numbers are best-effort.
+	AnchorStatusDrifted = "drifted"
+	// AnchorStatusOrphaned means we couldn't relocate the anchor at all; the
+	// original line numbers are preserved for display only.
+	AnchorStatusOrphaned = "orphaned"
+)
+
 // AnchorResolution is the result of running ResolveAnchor against a plan.
 // Status disambiguates "found at original location" from "relocated" from
 // "couldn't find at all" — agents care about this for deciding whether to
@@ -40,7 +56,7 @@ type Anchor struct {
 type AnchorResolution struct {
 	LineStart int    `json:"line_start"`
 	LineEnd   int    `json:"line_end"`
-	Status    string `json:"status"` // "ok" | "drifted" | "orphaned"
+	Status    string `json:"status"` // one of AnchorStatus* constants
 }
 
 // ResolveAnchor finds the current location of an anchor in plan markdown.
@@ -56,7 +72,7 @@ func ResolveAnchor(plan string, a Anchor) AnchorResolution {
 			return AnchorResolution{
 				LineStart: a.LineStart,
 				LineEnd:   a.LineEnd,
-				Status:    "ok",
+				Status:    AnchorStatusOK,
 			}
 		}
 	}
@@ -64,14 +80,14 @@ func ResolveAnchor(plan string, a Anchor) AnchorResolution {
 	// Step 2: heading-scoped — look 50 lines past the matching heading.
 	if a.HeadingSlug != "" {
 		if hi := findHeadingIndex(lines, a.HeadingSlug); hi >= 0 {
-			end := min(hi+50, len(lines))
+			end := min(hi+headingWindowLines, len(lines))
 			window := strings.Join(lines[hi:end], "\n")
 			if off := strings.Index(window, a.QuotedText); off >= 0 {
 				lineNum := hi + 1 + countNewlinesBefore(window, off)
 				return AnchorResolution{
 					LineStart: lineNum,
 					LineEnd:   lineNum + countNewlinesBefore(a.QuotedText, len(a.QuotedText)),
-					Status:    "drifted",
+					Status:    AnchorStatusDrifted,
 				}
 			}
 		}
@@ -86,7 +102,7 @@ func ResolveAnchor(plan string, a Anchor) AnchorResolution {
 			return AnchorResolution{
 				LineStart: lineNum,
 				LineEnd:   lineNum + countNewlinesBefore(a.QuotedText, len(a.QuotedText)),
-				Status:    "drifted",
+				Status:    AnchorStatusDrifted,
 			}
 		}
 	}
@@ -96,7 +112,7 @@ func ResolveAnchor(plan string, a Anchor) AnchorResolution {
 	return AnchorResolution{
 		LineStart: a.LineStart,
 		LineEnd:   a.LineEnd,
-		Status:    "orphaned",
+		Status:    AnchorStatusOrphaned,
 	}
 }
 
@@ -105,7 +121,7 @@ func ResolveAnchor(plan string, a Anchor) AnchorResolution {
 // whole plan. Returns "" if the resolution is orphaned (no reliable
 // location to extract from).
 func Snippet(plan string, r AnchorResolution) string {
-	if r.Status == "orphaned" {
+	if r.Status == AnchorStatusOrphaned {
 		return ""
 	}
 	lines := strings.Split(plan, "\n")
diff --git a/internal/paste/anchor_test.go b/internal/paste/anchor_test.go
index aab4360..521532c 100644
--- a/internal/paste/anchor_test.go
+++ b/internal/paste/anchor_test.go
@@ -1,14 +1,16 @@
-package paste
+package paste_test
 
 import (
 	"strings"
 	"testing"
+
+	"github.com/sentiolabs/arc/internal/paste"
 )
 
 const samplePlan = "# Title\n\nFirst paragraph.\nSecond paragraph.\n## Sub\nThird.\n"
 
 func TestResolveAnchor_Ok(t *testing.T) {
-	r := ResolveAnchor(samplePlan, Anchor{
+	r := paste.ResolveAnchor(samplePlan, paste.Anchor{
 		LineStart:  3,
 		LineEnd:    3,
 		QuotedText: "First paragraph.",
@@ -25,13 +27,13 @@ func TestResolveAnchor_DriftedViaHeading(t *testing.T) {
 	// Insert a prelude — the same paragraph now lives at line 5, not 3.
 	// The heading_slug fallback must relocate it.
 	edited := "PRELUDE\n# Title\n\nMore content.\nFirst paragraph.\n## Sub\nThird.\n"
-	r := ResolveAnchor(edited, Anchor{
+	r := paste.ResolveAnchor(edited, paste.Anchor{
 		LineStart:   3,
 		LineEnd:     3,
 		QuotedText:  "First paragraph.",
 		HeadingSlug: "title",
 	})
-	if r.Status != "drifted" {
+	if r.Status != paste.AnchorStatusDrifted {
 		t.Errorf("status = %q, want drifted", r.Status)
 	}
 	if r.LineStart != 5 {
@@ -43,7 +45,7 @@ func TestResolveAnchor_DriftedViaContext(t *testing.T) {
 	// Heading was renamed (slug doesn't match) but the surrounding context
 	// is intact, so the fuzzy fallback should still find the location.
 	edited := "# A different title\n\nFirst paragraph.\nSecond paragraph.\n"
-	r := ResolveAnchor(edited, Anchor{
+	r := paste.ResolveAnchor(edited, paste.Anchor{
 		LineStart:     5,
 		LineEnd:       5,
 		QuotedText:    "First paragraph.",
@@ -51,14 +53,14 @@ func TestResolveAnchor_DriftedViaContext(t *testing.T) {
 		ContextBefore: "\n\n",
 		ContextAfter:  "\nSecond",
 	})
-	if r.Status != "drifted" {
+	if r.Status != paste.AnchorStatusDrifted {
 		t.Errorf("status = %q, want drifted via fuzzy match", r.Status)
 	}
 }
 
 func TestResolveAnchor_Orphaned(t *testing.T) {
 	edited := "# Title\n\nDifferent stuff.\n"
-	r := ResolveAnchor(edited, Anchor{
+	r := paste.ResolveAnchor(edited, paste.Anchor{
 		LineStart:   3,
 		LineEnd:     3,
 		QuotedText:  "First paragraph.",
@@ -77,34 +79,34 @@ func TestResolveAnchor_OutOfRangeFallsThrough(t *testing.T) {
 	// Anchor refers to a line beyond the plan — must NOT panic, must fall
 	// through to subsequent steps.
 	short := "# Title\n\nOnly one paragraph.\n"
-	r := ResolveAnchor(short, Anchor{
+	r := paste.ResolveAnchor(short, paste.Anchor{
 		LineStart:   500,
 		LineEnd:     500,
 		QuotedText:  "Only one paragraph.",
 		HeadingSlug: "title",
 	})
-	if r.Status != "drifted" {
+	if r.Status != paste.AnchorStatusDrifted {
 		t.Errorf("status = %q, want drifted (fell through to heading match)", r.Status)
 	}
 }
 
 func TestSlugify(t *testing.T) {
 	cases := map[string]string{
-		"Title":           "title",
-		"Hello World":     "hello-world",
-		"Multi  Spaces":   "multi-spaces",
-		"With-Dashes":     "with-dashes",
-		"Punctuation!?.":  "punctuation",
-		"Mixed Case 123":  "mixed-case-123",
-		"  Trim Me  ":     "trim-me",
+		"Title":          "title",
+		"Hello World":    "hello-world",
+		"Multi  Spaces":  "multi-spaces",
+		"With-Dashes":    "with-dashes",
+		"Punctuation!?.": "punctuation",
+		"Mixed Case 123": "mixed-case-123",
+		"  Trim Me  ":    "trim-me",
 		// Non-ASCII letters are stripped char-by-char (the regex is `[^a-z0-9\s-]`),
 		// leaving only the ASCII letters embedded in the words. Matches what the
 		// TS implementation produces.
 		"Über Größe": "ber-gre",
 	}
 	for in, want := range cases {
-		if got := Slugify(in); got != want {
-			t.Errorf("Slugify(%q) = %q, want %q", in, got, want)
+		if got := paste.Slugify(in); got != want {
+			t.Errorf("paste.Slugify(%q) = %q, want %q", in, got, want)
 		}
 	}
 }
@@ -113,17 +115,17 @@ func TestSlugify_TSCompatibility(t *testing.T) {
 	// Crucially this MUST match what web/src/lib/paste/anchor.ts produces,
 	// since the SPA writes heading_slug values into the encrypted anchor.
 	// If these diverge, drifted/heading-scoped resolution silently fails.
-	if got := Slugify("Goal"); got != "goal" {
-		t.Errorf(`Slugify("Goal") = %q, want "goal"`, got)
+	if got := paste.Slugify("Goal"); got != "goal" {
+		t.Errorf(`paste.Slugify("Goal") = %q, want "goal"`, got)
 	}
-	if got := Slugify("Approach"); got != "approach" {
-		t.Errorf(`Slugify("Approach") = %q, want "approach"`, got)
+	if got := paste.Slugify("Approach"); got != "approach" {
+		t.Errorf(`paste.Slugify("Approach") = %q, want "approach"`, got)
 	}
 }
 
 func TestSnippet(t *testing.T) {
-	r := AnchorResolution{LineStart: 3, LineEnd: 3, Status: "ok"}
-	got := Snippet(samplePlan, r)
+	r := paste.AnchorResolution{LineStart: 3, LineEnd: 3, Status: "ok"}
+	got := paste.Snippet(samplePlan, r)
 	// Should include lines 1-5 (line 3 ± 2 padding).
 	if !strings.Contains(got, "First paragraph.") {
 		t.Errorf("snippet missing the anchor line; got: %q", got)
@@ -134,8 +136,8 @@ func TestSnippet(t *testing.T) {
 }
 
 func TestSnippet_OrphanedReturnsEmpty(t *testing.T) {
-	r := AnchorResolution{LineStart: 99, LineEnd: 99, Status: "orphaned"}
-	if got := Snippet(samplePlan, r); got != "" {
+	r := paste.AnchorResolution{LineStart: 99, LineEnd: 99, Status: "orphaned"}
+	if got := paste.Snippet(samplePlan, r); got != "" {
 		t.Errorf("orphaned should yield empty snippet; got %q", got)
 	}
 }
diff --git a/internal/paste/cmd/genxlang/main.go b/internal/paste/cmd/genxlang/main.go
index d6f014d..0146e52 100644
--- a/internal/paste/cmd/genxlang/main.go
+++ b/internal/paste/cmd/genxlang/main.go
@@ -21,7 +21,10 @@ type fixture struct {
 }
 
 func main() {
-	cases := []struct{ name string; v any }{
+	cases := []struct {
+		name string
+		v    any
+	}{
 		{"simple-string", "hello world"},
 		{"empty-object", map[string]any{}},
 		{"nested-object", map[string]any{
@@ -29,7 +32,7 @@ func main() {
 			"anchor": map[string]any{"line_start": 1, "line_end": 1, "quoted_text": "x"},
 		}},
 	}
-	var out []fixture
+	out := make([]fixture, 0, len(cases))
 	for _, c := range cases {
 		key, _ := paste.GenerateKey()
 		ct, iv, err := paste.EncryptJSON(c.v, key)
@@ -46,5 +49,6 @@ func main() {
 	}
 	data, _ := json.MarshalIndent(out, "", "  ")
 	fmt.Println(string(data))
-	_ = os.WriteFile("internal/paste/testdata/xlang_fixtures.json", data, 0o644)
+	const fixtureMode = 0o600
+	_ = os.WriteFile("internal/paste/testdata/xlang_fixtures.json", data, fixtureMode)
 }
diff --git a/internal/paste/crypto.go b/internal/paste/crypto.go
index d91e812..2b6d35d 100644
--- a/internal/paste/crypto.go
+++ b/internal/paste/crypto.go
@@ -8,14 +8,20 @@ import (
 	"errors"
 )
 
+// KeySize is the AES-256-GCM key length in bytes used by all paste crypto.
 const KeySize = 32
 
+// GenerateKey returns a fresh random 32-byte key suitable for paste encryption.
 func GenerateKey() ([]byte, error) {
 	key := make([]byte, KeySize)
 	_, err := rand.Read(key)
 	return key, err
 }
 
+// EncryptJSON marshals v to JSON and encrypts it with AES-256-GCM under key,
+// returning the ciphertext and the freshly generated nonce (iv). The nonce is
+// drawn fresh from crypto/rand on every call — callers must NOT reuse a nonce
+// with the same key, which would catastrophically break GCM's confidentiality.
 func EncryptJSON(v any, key []byte) (ciphertext, iv []byte, err error) {
 	if len(key) != KeySize {
 		return nil, nil, errors.New("paste: key must be 32 bytes")
@@ -40,6 +46,10 @@ func EncryptJSON(v any, key []byte) (ciphertext, iv []byte, err error) {
 	return ciphertext, iv, nil
 }
 
+// DecryptJSON inverts EncryptJSON: it decrypts ciphertext under key with the
+// given nonce iv and unmarshals the plaintext JSON into v. Returns an error
+// if the GCM tag fails to verify, the key is wrong, or the plaintext is not
+// valid JSON for the target type.
 func DecryptJSON(ciphertext, iv, key []byte, v any) error {
 	if len(key) != KeySize {
 		return errors.New("paste: key must be 32 bytes")
diff --git a/internal/paste/crypto_test.go b/internal/paste/crypto_test.go
index fa1bb1f..323a5af 100644
--- a/internal/paste/crypto_test.go
+++ b/internal/paste/crypto_test.go
@@ -1,22 +1,24 @@
-package paste
+package paste_test
 
 import (
 	"bytes"
 	"testing"
+
+	"github.com/sentiolabs/arc/internal/paste"
 )
 
 func TestEncryptDecryptRoundtrip(t *testing.T) {
-	key, err := GenerateKey()
+	key, err := paste.GenerateKey()
 	if err != nil {
 		t.Fatal(err)
 	}
 	in := map[string]any{"hello": "world", "n": float64(42)}
-	ct, iv, err := EncryptJSON(in, key)
+	ct, iv, err := paste.EncryptJSON(in, key)
 	if err != nil {
 		t.Fatal(err)
 	}
 	var out map[string]any
-	if err := DecryptJSON(ct, iv, key, &out); err != nil {
+	if err := paste.DecryptJSON(ct, iv, key, &out); err != nil {
 		t.Fatalf("DecryptJSON: %v", err)
 	}
 	if out["hello"] != "world" {
@@ -25,18 +27,18 @@ func TestEncryptDecryptRoundtrip(t *testing.T) {
 }
 
 func TestDecryptWithWrongKeyFails(t *testing.T) {
-	k1, _ := GenerateKey()
-	k2, _ := GenerateKey()
-	ct, iv, _ := EncryptJSON("secret", k1)
+	k1, _ := paste.GenerateKey()
+	k2, _ := paste.GenerateKey()
+	ct, iv, _ := paste.EncryptJSON("secret", k1)
 	var out string
-	if err := DecryptJSON(ct, iv, k2, &out); err == nil {
+	if err := paste.DecryptJSON(ct, iv, k2, &out); err == nil {
 		t.Error("expected decrypt to fail with wrong key")
 	}
 }
 
 func TestKeySizeValidation(t *testing.T) {
 	short := bytes.Repeat([]byte{1}, 16)
-	if _, _, err := EncryptJSON("x", short); err == nil {
+	if _, _, err := paste.EncryptJSON("x", short); err == nil {
 		t.Error("expected error for short key")
 	}
 }
diff --git a/internal/paste/crypto_xlang_test.go b/internal/paste/crypto_xlang_test.go
index ebf85f1..7d3790b 100644
--- a/internal/paste/crypto_xlang_test.go
+++ b/internal/paste/crypto_xlang_test.go
@@ -1,4 +1,4 @@
-package paste
+package paste_test
 
 import (
 	"encoding/base64"
@@ -7,6 +7,8 @@ import (
 	"path/filepath"
 	"reflect"
 	"testing"
+
+	"github.com/sentiolabs/arc/internal/paste"
 )
 
 type xlangFixture struct {
@@ -38,7 +40,7 @@ func TestCryptoXLangFixtures(t *testing.T) {
 			ct, _ := base64.StdEncoding.DecodeString(f.CiphertextB64)
 			iv, _ := base64.StdEncoding.DecodeString(f.IvB64)
 			var got json.RawMessage
-			if err := DecryptJSON(ct, iv, key, &got); err != nil {
+			if err := paste.DecryptJSON(ct, iv, key, &got); err != nil {
 				t.Fatalf("decrypt: %v", err)
 			}
 			var a, b any
@@ -60,12 +62,12 @@ func TestCryptoXLangRoundtrip(t *testing.T) {
 	for _, f := range fixtures {
 		t.Run(f.Name+"-roundtrip", func(t *testing.T) {
 			key, _ := base64UrlDecode(f.KeyB64Url)
-			ct, iv, err := EncryptJSON(json.RawMessage(f.Plaintext), key)
+			ct, iv, err := paste.EncryptJSON(f.Plaintext, key)
 			if err != nil {
 				t.Fatal(err)
 			}
 			var out json.RawMessage
-			if err := DecryptJSON(ct, iv, key, &out); err != nil {
+			if err := paste.DecryptJSON(ct, iv, key, &out); err != nil {
 				t.Fatal(err)
 			}
 		})
diff --git a/internal/paste/handlers.go b/internal/paste/handlers.go
index 4d335cb..27989ce 100644
--- a/internal/paste/handlers.go
+++ b/internal/paste/handlers.go
@@ -11,6 +11,32 @@ import (
 	"github.com/labstack/echo/v4"
 )
 
+// ID and token sizes for paste resources. Picked to give plenty of entropy
+// without being painful to copy/paste manually.
+const (
+	// shareIDLen is the length, in characters, of a share's URL slug.
+	shareIDLen = 8
+	// editTokenBytes is the random byte count behind an edit token.
+	// 32 bytes → 64 hex chars, matching the format used by `arc share` clients.
+	editTokenBytes = 32
+	// eventIDRandBytes is the random tail appended to event IDs after the
+	// nanosecond timestamp prefix.
+	eventIDRandBytes = 12
+)
+
+// 64-bit nanosecond timestamps are split into 8 bytes by repeated >> 8 shifts;
+// these constants name the high-order shift amounts to keep the byte build-up
+// readable.
+const (
+	tsShift56 = 56
+	tsShift48 = 48
+	tsShift40 = 40
+	tsShift32 = 32
+	tsShift24 = 24
+	tsShift16 = 16
+	tsShift8  = 8
+)
+
 // Handlers holds the paste HTTP handler dependencies.
 type Handlers struct {
 	store Storage
@@ -30,6 +56,9 @@ func (h *Handlers) Register(g *echo.Group) {
 	g.POST("/:id/blobs", h.appendEvent)
 }
 
+// createPaste handles POST /. Creates a new share with a freshly minted ID
+// and edit token. The edit token is returned to the caller exactly once —
+// there is no recovery path if it's lost.
 func (h *Handlers) createPaste(c echo.Context) error {
 	var req CreatePasteRequest
 	if err := c.Bind(&req); err != nil {
@@ -47,7 +76,7 @@ func (h *Handlers) createPaste(c echo.Context) error {
 		return err
 	}
 	now := time.Now().UTC()
-	sh := PasteShare{
+	sh := Share{
 		ID:        id,
 		PlanBlob:  req.PlanBlob,
 		PlanIV:    req.PlanIV,
@@ -62,6 +91,9 @@ func (h *Handlers) createPaste(c echo.Context) error {
 	return c.JSON(http.StatusCreated, CreatePasteResponse{ID: id, EditToken: token})
 }
 
+// getPaste handles GET /:id. Returns the share row plus its event log.
+// Anonymous — no auth — since the encrypted blobs are already key-gated
+// client-side via the URL fragment.
 func (h *Handlers) getPaste(c echo.Context) error {
 	id := c.Param("id")
 	sh, err := h.store.GetShare(c.Request().Context(), id)
@@ -76,9 +108,9 @@ func (h *Handlers) getPaste(c echo.Context) error {
 		return err
 	}
 	if events == nil {
-		events = []PasteEvent{}
+		events = []Event{}
 	}
-	return c.JSON(http.StatusOK, GetPasteResponse{PasteShare: *sh, Events: events})
+	return c.JSON(http.StatusOK, GetPasteResponse{Share: *sh, Events: events})
 }
 
 func (h *Handlers) updatePaste(c echo.Context) error {
@@ -143,7 +175,7 @@ func (h *Handlers) appendEvent(c echo.Context) error {
 	if err != nil {
 		return err
 	}
-	e := PasteEvent{
+	e := Event{
 		ID:        eventID,
 		ShareID:   id,
 		Blob:      req.Blob,
@@ -166,38 +198,40 @@ func bearerToken(c echo.Context) (string, error) {
 	return strings.TrimPrefix(auth, prefix), nil
 }
 
-// newShareID returns an 8-character Crockford base32 (lowercase, without i/l/o/u) ID.
+// newShareID returns a Crockford base32 (lowercase, without i/l/o/u) ID.
 func newShareID() (string, error) {
 	const alphabet = "0123456789abcdefghjkmnpqrstvwxyz"
-	buf := make([]byte, 8)
+	buf := make([]byte, shareIDLen)
 	if _, err := rand.Read(buf); err != nil {
 		return "", err
 	}
-	out := make([]byte, 8)
+	out := make([]byte, shareIDLen)
 	for i := range out {
 		out[i] = alphabet[int(buf[i])%len(alphabet)]
 	}
 	return string(out), nil
 }
 
-// newEditToken returns a 64-character hex-encoded random token (32 random bytes).
+// newEditToken returns a hex-encoded random token (editTokenBytes random bytes).
 func newEditToken() (string, error) {
-	buf := make([]byte, 32)
+	buf := make([]byte, editTokenBytes)
 	if _, err := rand.Read(buf); err != nil {
 		return "", err
 	}
 	return hex.EncodeToString(buf), nil
 }
 
-// newEventID returns a time-prefixed random hex event ID.
+// newEventID returns a time-prefixed random hex event ID. The nanosecond
+// timestamp goes first so the event IDs sort lexicographically by creation
+// time, which is convenient when scanning logs or storage.
 func newEventID() (string, error) {
-	buf := make([]byte, 12)
+	buf := make([]byte, eventIDRandBytes)
 	if _, err := rand.Read(buf); err != nil {
 		return "", err
 	}
 	ts := time.Now().UTC().UnixNano()
 	return hex.EncodeToString([]byte{
-		byte(ts >> 56), byte(ts >> 48), byte(ts >> 40), byte(ts >> 32),
-		byte(ts >> 24), byte(ts >> 16), byte(ts >> 8), byte(ts),
+		byte(ts >> tsShift56), byte(ts >> tsShift48), byte(ts >> tsShift40), byte(ts >> tsShift32),
+		byte(ts >> tsShift24), byte(ts >> tsShift16), byte(ts >> tsShift8), byte(ts),
 	}) + hex.EncodeToString(buf), nil
 }
diff --git a/internal/paste/handlers_test.go b/internal/paste/handlers_test.go
index 1afc8a4..70e3e57 100644
--- a/internal/paste/handlers_test.go
+++ b/internal/paste/handlers_test.go
@@ -90,9 +90,9 @@ func TestGetPaste(t *testing.T) {
 	if got.ID != created.ID {
 		t.Errorf("expected id %q, got %q", created.ID, got.ID)
 	}
-	if got.Events == nil {
-		// Events may be nil when empty slice; just ensure no panic
-	}
+	// got.Events may be nil for an empty event log — that's fine, we just
+	// want to confirm the unmarshal didn't blow up above.
+	_ = got.Events
 }
 
 func TestGetPasteNotFound(t *testing.T) {
@@ -118,7 +118,7 @@ func TestUpdatePasteWithToken(t *testing.T) {
 	_ = json.Unmarshal(rec.Body.Bytes(), &created)
 
 	// Update with correct token
-	upd, _ := json.Marshal(map[string]interface{}{"plan_blob": []byte{9}, "plan_iv": []byte{8}})
+	upd, _ := json.Marshal(map[string]any{"plan_blob": []byte{9}, "plan_iv": []byte{8}})
 	req2 := httptest.NewRequest(http.MethodPut, "/api/paste/"+created.ID, bytes.NewReader(upd))
 	req2.Header.Set("Content-Type", "application/json")
 	req2.Header.Set("Authorization", "Bearer "+created.EditToken)
@@ -142,7 +142,7 @@ func TestUpdatePasteWrongToken(t *testing.T) {
 	_ = json.Unmarshal(rec.Body.Bytes(), &created)
 
 	// Update with wrong token
-	upd, _ := json.Marshal(map[string]interface{}{"plan_blob": []byte{9}, "plan_iv": []byte{8}})
+	upd, _ := json.Marshal(map[string]any{"plan_blob": []byte{9}, "plan_iv": []byte{8}})
 	req2 := httptest.NewRequest(http.MethodPut, "/api/paste/"+created.ID, bytes.NewReader(upd))
 	req2.Header.Set("Content-Type", "application/json")
 	req2.Header.Set("Authorization", "Bearer wrongtoken")
@@ -166,7 +166,7 @@ func TestUpdatePasteMissingAuth(t *testing.T) {
 	_ = json.Unmarshal(rec.Body.Bytes(), &created)
 
 	// Update with no Authorization header
-	upd, _ := json.Marshal(map[string]interface{}{"plan_blob": []byte{9}, "plan_iv": []byte{8}})
+	upd, _ := json.Marshal(map[string]any{"plan_blob": []byte{9}, "plan_iv": []byte{8}})
 	req2 := httptest.NewRequest(http.MethodPut, "/api/paste/"+created.ID, bytes.NewReader(upd))
 	req2.Header.Set("Content-Type", "application/json")
 	rec2 := httptest.NewRecorder()
diff --git a/internal/paste/sqlite/migrations.go b/internal/paste/sqlite/migrations.go
index 2c8c486..162d1e9 100644
--- a/internal/paste/sqlite/migrations.go
+++ b/internal/paste/sqlite/migrations.go
@@ -4,16 +4,27 @@ import (
 	"context"
 	"database/sql"
 	"embed"
+	"errors"
 	"fmt"
 	"io/fs"
 	"sort"
 	"strings"
 )
 
+// migrationsFS holds the embedded *.sql files. Each file is one migration;
+// they are applied in filename-sorted order, and the names are recorded in
+// the paste_migrations table so we never re-run one.
+//
 //go:embed migrations/*.sql
 var migrationsFS embed.FS
 
+// Apply runs every embedded migration that hasn't already been recorded in
+// paste_migrations, in lexicographic filename order. Idempotent — safe to call
+// on every server boot.
 func Apply(ctx context.Context, db *sql.DB) error {
+	// The bookkeeping table itself uses CREATE IF NOT EXISTS rather than a
+	// migration file so we have somewhere to write the first migration's
+	// completion record.
 	if _, err := db.ExecContext(ctx, `CREATE TABLE IF NOT EXISTS paste_migrations (
         name TEXT PRIMARY KEY, applied_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP)`); err != nil {
 		return fmt.Errorf("create paste_migrations: %w", err)
@@ -22,6 +33,8 @@ func Apply(ctx context.Context, db *sql.DB) error {
 	if err != nil {
 		return err
 	}
+	// Filter to .sql, sort lexicographically — naming convention:
+	// 0001_*.sql, 0002_*.sql, ... ensures the order is also chronological.
 	names := make([]string, 0, len(entries))
 	for _, e := range entries {
 		if !strings.HasSuffix(e.Name(), ".sql") {
@@ -31,12 +44,14 @@ func Apply(ctx context.Context, db *sql.DB) error {
 	}
 	sort.Strings(names)
 	for _, name := range names {
+		// Skip migrations we've already applied — `name` is the primary key
+		// in paste_migrations, so a successful Scan means we're done.
 		var existing string
 		err := db.QueryRowContext(ctx, `SELECT name FROM paste_migrations WHERE name = ?`, name).Scan(&existing)
 		if err == nil {
 			continue
 		}
-		if err != sql.ErrNoRows {
+		if !errors.Is(err, sql.ErrNoRows) {
 			return err
 		}
 		body, err := migrationsFS.ReadFile("migrations/" + name)
@@ -46,6 +61,7 @@ func Apply(ctx context.Context, db *sql.DB) error {
 		if _, err := db.ExecContext(ctx, string(body)); err != nil {
 			return fmt.Errorf("apply %s: %w", name, err)
 		}
+		// Record the completion so the next boot skips this file.
 		if _, err := db.ExecContext(ctx, `INSERT INTO paste_migrations(name) VALUES (?)`, name); err != nil {
 			return err
 		}
diff --git a/internal/paste/sqlite/store.go b/internal/paste/sqlite/store.go
index 208860b..f92ec88 100644
--- a/internal/paste/sqlite/store.go
+++ b/internal/paste/sqlite/store.go
@@ -9,13 +9,19 @@ import (
 	"github.com/sentiolabs/arc/internal/paste"
 )
 
+// Store is the SQLite-backed paste.Storage implementation.
 type Store struct {
 	db *sql.DB
 }
 
+// New wraps an open *sql.DB as a Store. The caller still owns the connection
+// and is responsible for closing it.
 func New(db *sql.DB) *Store { return &Store{db: db} }
 
-func (s *Store) CreateShare(ctx context.Context, share paste.PasteShare, editToken string) error {
+// CreateShare inserts a new share row plus its edit token. The token is
+// stored in the same row so the table is the source of truth for both the
+// public ID and the bearer credential needed to mutate it later.
+func (s *Store) CreateShare(ctx context.Context, share paste.Share, editToken string) error {
 	_, err := s.db.ExecContext(ctx,
 		`INSERT INTO paste_shares (id, edit_token, plan_blob, plan_iv, schema_ver, created_at, updated_at, expires_at)
          VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
@@ -25,8 +31,11 @@ func (s *Store) CreateShare(ctx context.Context, share paste.PasteShare, editTok
 	return err
 }
 
-func (s *Store) GetShare(ctx context.Context, id string) (*paste.PasteShare, error) {
-	var sh paste.PasteShare
+// GetShare returns the share row by ID. The edit_token column is intentionally
+// excluded from the SELECT — only VerifyEditToken consults it, so untrusted
+// reads can't accidentally leak the token via an error or log.
+func (s *Store) GetShare(ctx context.Context, id string) (*paste.Share, error) {
+	var sh paste.Share
 	var expires sql.NullTime
 	err := s.db.QueryRowContext(ctx,
 		`SELECT id, plan_blob, plan_iv, schema_ver, created_at, updated_at, expires_at
@@ -45,6 +54,8 @@ func (s *Store) GetShare(ctx context.Context, id string) (*paste.PasteShare, err
 	return &sh, nil
 }
 
+// UpdateSharePlan replaces the encrypted plan blob & nonce after verifying
+// the edit token. updated_at is bumped so clients can detect changes.
 func (s *Store) UpdateSharePlan(ctx context.Context, id string, planBlob, iv []byte, editToken string) error {
 	ok, err := s.VerifyEditToken(ctx, id, editToken)
 	if err != nil {
@@ -59,6 +70,8 @@ func (s *Store) UpdateSharePlan(ctx context.Context, id string, planBlob, iv []b
 	return err
 }
 
+// DeleteShare removes the share (and, via cascade, its event log) after
+// verifying the edit token.
 func (s *Store) DeleteShare(ctx context.Context, id, editToken string) error {
 	ok, err := s.VerifyEditToken(ctx, id, editToken)
 	if err != nil {
@@ -71,14 +84,20 @@ func (s *Store) DeleteShare(ctx context.Context, id, editToken string) error {
 	return err
 }
 
-func (s *Store) AppendEvent(ctx context.Context, e paste.PasteEvent) error {
+// AppendEvent appends a new event row to the share's append-only log. Events
+// are only ever inserted — never updated or deleted — so the entire history
+// is reproducible by replay.
+func (s *Store) AppendEvent(ctx context.Context, e paste.Event) error {
 	_, err := s.db.ExecContext(ctx,
 		`INSERT INTO paste_events (id, share_id, blob, iv, created_at) VALUES (?, ?, ?, ?, ?)`,
 		e.ID, e.ShareID, e.Blob, e.IV, e.CreatedAt)
 	return err
 }
 
-func (s *Store) ListEvents(ctx context.Context, shareID string) ([]paste.PasteEvent, error) {
+// ListEvents returns every event for the share, ordered by created_at then
+// id so callers can replay state deterministically (Go map iteration is
+// randomized, so the deterministic order has to come from the SQL side).
+func (s *Store) ListEvents(ctx context.Context, shareID string) ([]paste.Event, error) {
 	rows, err := s.db.QueryContext(ctx,
 		`SELECT id, share_id, blob, iv, created_at FROM paste_events
          WHERE share_id = ? ORDER BY created_at ASC, id ASC`, shareID)
@@ -86,9 +105,9 @@ func (s *Store) ListEvents(ctx context.Context, shareID string) ([]paste.PasteEv
 		return nil, err
 	}
 	defer rows.Close()
-	var out []paste.PasteEvent
+	var out []paste.Event
 	for rows.Next() {
-		var e paste.PasteEvent
+		var e paste.Event
 		if err := rows.Scan(&e.ID, &e.ShareID, &e.Blob, &e.IV, &e.CreatedAt); err != nil {
 			return nil, err
 		}
@@ -97,6 +116,9 @@ func (s *Store) ListEvents(ctx context.Context, shareID string) ([]paste.PasteEv
 	return out, rows.Err()
 }
 
+// VerifyEditToken checks token against the stored edit_token for share id.
+// Returns (false, ErrShareNotFound) when the share doesn't exist; (false, nil)
+// when the share exists but the token doesn't match; (true, nil) on success.
 func (s *Store) VerifyEditToken(ctx context.Context, id, token string) (bool, error) {
 	var stored string
 	err := s.db.QueryRowContext(ctx,
diff --git a/internal/paste/sqlite/store_test.go b/internal/paste/sqlite/store_test.go
index f7feecd..5b43c3a 100644
--- a/internal/paste/sqlite/store_test.go
+++ b/internal/paste/sqlite/store_test.go
@@ -3,6 +3,7 @@ package sqlite_test
 import (
 	"context"
 	"database/sql"
+	"errors"
 	"testing"
 	"time"
 
@@ -29,7 +30,7 @@ func newTestStore(t *testing.T) *sqlite.Store {
 func TestCreateAndGetShare(t *testing.T) {
 	s := newTestStore(t)
 	now := time.Now().UTC().Truncate(time.Second)
-	share := paste.PasteShare{
+	share := paste.Share{
 		ID:        "abc12345",
 		PlanBlob:  []byte{1, 2, 3},
 		PlanIV:    []byte{4, 5, 6},
@@ -52,7 +53,7 @@ func TestCreateAndGetShare(t *testing.T) {
 func TestVerifyEditToken(t *testing.T) {
 	s := newTestStore(t)
 	now := time.Now().UTC()
-	_ = s.CreateShare(context.Background(), paste.PasteShare{
+	_ = s.CreateShare(context.Background(), paste.Share{
 		ID:        "x",
 		PlanBlob:  []byte{0},
 		PlanIV:    []byte{0},
@@ -73,7 +74,7 @@ func TestVerifyEditToken(t *testing.T) {
 func TestUpdateSharePlanRequiresToken(t *testing.T) {
 	s := newTestStore(t)
 	now := time.Now().UTC()
-	_ = s.CreateShare(context.Background(), paste.PasteShare{
+	_ = s.CreateShare(context.Background(), paste.Share{
 		ID:        "x",
 		PlanBlob:  []byte{0},
 		PlanIV:    []byte{0},
@@ -82,7 +83,7 @@ func TestUpdateSharePlanRequiresToken(t *testing.T) {
 		UpdatedAt: now,
 	}, "good")
 	err := s.UpdateSharePlan(context.Background(), "x", []byte{9}, []byte{8}, "bad")
-	if err != paste.ErrInvalidEditToken {
+	if !errors.Is(err, paste.ErrInvalidEditToken) {
 		t.Errorf("expected ErrInvalidEditToken, got %v", err)
 	}
 }
@@ -90,7 +91,7 @@ func TestUpdateSharePlanRequiresToken(t *testing.T) {
 func TestAppendAndListEvents(t *testing.T) {
 	s := newTestStore(t)
 	now := time.Now().UTC()
-	_ = s.CreateShare(context.Background(), paste.PasteShare{
+	_ = s.CreateShare(context.Background(), paste.Share{
 		ID:        "x",
 		PlanBlob:  []byte{0},
 		PlanIV:    []byte{0},
@@ -98,14 +99,14 @@ func TestAppendAndListEvents(t *testing.T) {
 		CreatedAt: now,
 		UpdatedAt: now,
 	}, "tok")
-	_ = s.AppendEvent(context.Background(), paste.PasteEvent{
+	_ = s.AppendEvent(context.Background(), paste.Event{
 		ID:        "e1",
 		ShareID:   "x",
 		Blob:      []byte{1},
 		IV:        []byte{1},
 		CreatedAt: now,
 	})
-	_ = s.AppendEvent(context.Background(), paste.PasteEvent{
+	_ = s.AppendEvent(context.Background(), paste.Event{
 		ID:        "e2",
 		ShareID:   "x",
 		Blob:      []byte{2},
diff --git a/internal/paste/storage.go b/internal/paste/storage.go
index 608ef13..5a8fdc1 100644
--- a/internal/paste/storage.go
+++ b/internal/paste/storage.go
@@ -5,15 +5,25 @@ import (
 	"errors"
 )
 
-var ErrShareNotFound = errors.New("paste share not found")
-var ErrInvalidEditToken = errors.New("invalid edit token")
+// Sentinel errors returned by Storage implementations. Handlers translate
+// these into HTTP status codes; CLI clients pattern-match on them too.
+var (
+	// ErrShareNotFound is returned when no paste share exists with the given ID.
+	ErrShareNotFound = errors.New("paste share not found")
+	// ErrInvalidEditToken is returned when an edit/delete request's bearer
+	// token doesn't match the share's stored edit token.
+	ErrInvalidEditToken = errors.New("invalid edit token")
+)
 
+// Storage is the persistence interface backing the paste service. It captures
+// the full lifecycle of a share (create, read, update plan, delete) plus the
+// append-only event log used for review comments.
 type Storage interface {
-	CreateShare(ctx context.Context, s PasteShare, editToken string) error
-	GetShare(ctx context.Context, id string) (*PasteShare, error)
+	CreateShare(ctx context.Context, s Share, editToken string) error
+	GetShare(ctx context.Context, id string) (*Share, error)
 	UpdateSharePlan(ctx context.Context, id string, planBlob, iv []byte, editToken string) error
 	DeleteShare(ctx context.Context, id string, editToken string) error
-	AppendEvent(ctx context.Context, e PasteEvent) error
-	ListEvents(ctx context.Context, shareID string) ([]PasteEvent, error)
+	AppendEvent(ctx context.Context, e Event) error
+	ListEvents(ctx context.Context, shareID string) ([]Event, error)
 	VerifyEditToken(ctx context.Context, id, token string) (bool, error)
 }
diff --git a/internal/paste/types.go b/internal/paste/types.go
index 76c7b0c..b0f0f2c 100644
--- a/internal/paste/types.go
+++ b/internal/paste/types.go
@@ -5,7 +5,7 @@ package paste
 
 import "time"
 
-type PasteShare struct {
+type Share struct {
 	ID        string     `json:"id"`
 	PlanBlob  []byte     `json:"plan_blob"`
 	PlanIV    []byte     `json:"plan_iv"`
@@ -15,7 +15,7 @@ type PasteShare struct {
 	ExpiresAt *time.Time `json:"expires_at,omitempty"`
 }
 
-type PasteEvent struct {
+type Event struct {
 	ID        string    `json:"id"`
 	ShareID   string    `json:"share_id"`
 	Blob      []byte    `json:"blob"`
@@ -41,6 +41,6 @@ type AppendEventRequest struct {
 }
 
 type GetPasteResponse struct {
-	PasteShare
-	Events []PasteEvent `json:"events"`
+	Share
+	Events []Event `json:"events"`
 }
diff --git a/internal/paste/types_test.go b/internal/paste/types_test.go
index 5d26c09..deeb1c0 100644
--- a/internal/paste/types_test.go
+++ b/internal/paste/types_test.go
@@ -1,32 +1,33 @@
-package paste
+package paste_test
 
 import (
 	"testing"
-	"time"
+
+	"github.com/sentiolabs/arc/internal/paste"
 )
 
-func TestPasteShareContract(t *testing.T) {
-	var s PasteShare
-	var _ string = s.ID
-	var _ []byte = s.PlanBlob
-	var _ []byte = s.PlanIV
-	var _ int = s.SchemaVer
-	var _ time.Time = s.CreatedAt
-	var _ time.Time = s.UpdatedAt
-	var _ *time.Time = s.ExpiresAt
+func TestShareContract(t *testing.T) {
+	var s paste.Share
+	_ = s.ID
+	_ = s.PlanBlob
+	_ = s.PlanIV
+	_ = s.SchemaVer
+	_ = s.CreatedAt
+	_ = s.UpdatedAt
+	_ = s.ExpiresAt
 }
 
-func TestPasteEventContract(t *testing.T) {
-	var e PasteEvent
-	var _ string = e.ID
-	var _ string = e.ShareID
-	var _ []byte = e.Blob
-	var _ []byte = e.IV
-	var _ time.Time = e.CreatedAt
+func TestEventContract(t *testing.T) {
+	var e paste.Event
+	_ = e.ID
+	_ = e.ShareID
+	_ = e.Blob
+	_ = e.IV
+	_ = e.CreatedAt
 }
 
 func TestCreatePasteResponseContract(t *testing.T) {
-	var r CreatePasteResponse
-	var _ string = r.ID
-	var _ string = r.EditToken
+	var r paste.CreatePasteResponse
+	_ = r.ID
+	_ = r.EditToken
 }
diff --git a/internal/sharesconfig/sharesconfig.go b/internal/sharesconfig/sharesconfig.go
index e7a7ac4..736d4b0 100644
--- a/internal/sharesconfig/sharesconfig.go
+++ b/internal/sharesconfig/sharesconfig.go
@@ -10,6 +10,16 @@ import (
 	"time"
 )
 
+// File permission bits for the shares registry. shares.json holds edit
+// tokens, so it must not be world-readable.
+const (
+	dirMode  os.FileMode = 0o700
+	fileMode os.FileMode = 0o600
+)
+
+// ErrShareNotFound is returned by Find when no share matches the given ID.
+var ErrShareNotFound = errors.New("share not found")
+
 // Share holds the metadata for a single paste share created by this machine.
 type Share struct {
 	ID        string    `json:"id"`
@@ -63,14 +73,14 @@ func Save(f *File) error {
 	if err != nil {
 		return err
 	}
-	if err := os.MkdirAll(filepath.Dir(path), 0o700); err != nil {
+	if err := os.MkdirAll(filepath.Dir(path), dirMode); err != nil {
 		return err
 	}
 	data, err := json.MarshalIndent(f, "", "  ")
 	if err != nil {
 		return err
 	}
-	return os.WriteFile(path, data, 0o600)
+	return os.WriteFile(path, data, fileMode)
 }
 
 // Add upserts a Share into the registry. If a share with the same ID already
@@ -90,7 +100,8 @@ func Add(s Share) error {
 	return Save(f)
 }
 
-// Find returns the Share with the given ID, or nil if not found.
+// Find returns the Share with the given ID, or ErrShareNotFound if no entry
+// matches. Callers may also use errors.Is(err, ErrShareNotFound) to branch.
 func Find(id string) (*Share, error) {
 	f, err := Load()
 	if err != nil {
@@ -101,7 +112,7 @@ func Find(id string) (*Share, error) {
 			return &s, nil
 		}
 	}
-	return nil, nil
+	return nil, ErrShareNotFound
 }
 
 // Remove deletes the share with the given ID from the registry. It is a no-op
diff --git a/internal/sharesconfig/sharesconfig_test.go b/internal/sharesconfig/sharesconfig_test.go
index 5cfae4e..bf22230 100644
--- a/internal/sharesconfig/sharesconfig_test.go
+++ b/internal/sharesconfig/sharesconfig_test.go
@@ -11,7 +11,10 @@ import (
 
 func TestAddAndFind(t *testing.T) {
 	t.Setenv("HOME", t.TempDir())
-	s := sharesconfig.Share{ID: "abc", Kind: "local", URL: "http://x", KeyB64Url: "k", EditToken: "t", CreatedAt: time.Now()}
+	s := sharesconfig.Share{
+		ID: "abc", Kind: "local", URL: "http://x",
+		KeyB64Url: "k", EditToken: "t", CreatedAt: time.Now(),
+	}
 	if err := sharesconfig.Add(s); err != nil {
 		t.Fatal(err)
 	}
diff --git a/internal/storage/sqlite/store.go b/internal/storage/sqlite/store.go
index 4cf5e04..a76dc2d 100644
--- a/internal/storage/sqlite/store.go
+++ b/internal/storage/sqlite/store.go
@@ -10,9 +10,9 @@ import (
 	"path/filepath"
 	"time"
 
+	pastesqlite "github.com/sentiolabs/arc/internal/paste/sqlite"
 	"github.com/sentiolabs/arc/internal/storage"
 	"github.com/sentiolabs/arc/internal/storage/sqlite/db"
-	pastesqlite "github.com/sentiolabs/arc/internal/paste/sqlite"
 
 	_ "modernc.org/sqlite"
 )