Design settlement — pick/refine the workbench shell in Claude Design; Phase C starts after.

Merge — web-ui-polish (six commits, gates green) into the phase branch; the agent worktree and the two dev servers (ports 4880/4881) are cleaned up then.

serve prints http://<repo-dir>.localhost:<port> instead of 127.0.0.1 — *.localhost resolves in-browser (RFC 6761) and is a secure context, so no hosts file, no DNS, no "Not secure" chip. Verified live 2026-07-13. Safari caveat documented (system resolver; one /etc/hosts line). Opening the browser is Phase D’s --web work.

Fix the commit diff view repeating every subdirectory as its own entry in the changed-file list.

Effect adder: form + POST route (there is currently no way to add an effect from the web).

Toolchain importer: form + POST route mirroring the CLI recipe flow.

Key-for-<member-id>: <oid> trailer written by comment-resolve mutations, binding the resolver’s member id to their key blob oid at resolve time (provenance in the chain). Receive/model work + spec rule + Tracey coverage; surfaces later in the UI as provenance display.

Member autocomplete: a datalist/endpoint over refs/meta/member/* usable by forms now and the palette later (complete by id or name).

Parity fixes deferred from the unreadable-entities work: CLI and lens comment list paths still skip unreadables silently; forge NotFound on web detail pages still maps to HTTP 500.

Replace the tab shell in pages::layout with the icon rail (Dashboard / Code / Review / Tickets / Threads; governance and account at the rail’s bottom) plus top bar: repo name, branch pill, search box (palette placeholder), identity chip.

Master–detail panes, SSR-friendly (every selection is a real URL; the list pane always renders): file tree left / padded blob right; commits list left / diff right; tickets list left / ticket + in-pane composer right (replaces the separate new-issue page).

Dashboard (home): working-tree lane (changed files with +/− stats via gix status, snapshot action), needs-attention feed (unresolved threads, reviews awaiting the signer’s verdict), open tickets, history with Scoped-Commits scope chips colored per scope.

Theme pass: brighter surfaces both schemes (per the mocks' proposal-c.css), content padding on blob/diff panes, SSH keys as an identity card (key type badge, fingerprint, truncated middle) instead of a table row.

git ents --web standalone opens the homepage — the Dashboard.

Any read operation with --web (commits, issue show 42, members list, …​) opens the corresponding page instead of printing.

Any mutating operation with --web performs the mutation exactly as the CLI does (same signing, same gate), then opens the resulting entity’s page — --web never moves a mutation into the browser.

Serve lifecycle: reuse a running instance if one answers for this repo on the expected port; otherwise spawn detached. A --web-spawned serve exits after an idle timeout (a foreground git ents serve never does), keeping the view-command promise.

Mutating CLI commands print the localhost URL of what they created even without --web.

--app flag: open in the browser’s chromeless app-mode window.

Deep links both ways: web line numbers link zed:// (or zed path:line); ents-lens gains an "open in browser" code action per thread.