From 41cf98eea3b6e16ee54227810acc0294a1f0f45f Mon Sep 17 00:00:00 2001
From: Ash Shah <494shah@gmail.com>
Date: Thu, 6 Aug 2026 18:05:14 -0700
Subject: [PATCH 01/41] docs: add diff hunk/block affordance design

Design for a nested hover affordance (hunk + change-block rings with
floating stage/discard actions) in the working-copy diff, hunk- and
line-level discard, and a replacement for the line-selection visual
that is effectively invisible in the NERV theme.

Interaction model validated against a live prototype before writing.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .gitignore                                    |   3 +
 .../2026-08-06-diff-hunk-affordance-design.md | 253 ++++++++++++++++++
 2 files changed, 256 insertions(+)
 create mode 100644 docs/superpowers/specs/2026-08-06-diff-hunk-affordance-design.md

diff --git a/.gitignore b/.gitignore
index ea390ad..01abd7f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -10,3 +10,6 @@ node_modules
 !.env.example
 vite.config.js.timestamp-*
 vite.config.ts.timestamp-*
+
+# superpowers brainstorming scratch (mockups, prototypes)
+.superpowers/
diff --git a/docs/superpowers/specs/2026-08-06-diff-hunk-affordance-design.md b/docs/superpowers/specs/2026-08-06-diff-hunk-affordance-design.md
new file mode 100644
index 0000000..95295bc
--- /dev/null
+++ b/docs/superpowers/specs/2026-08-06-diff-hunk-affordance-design.md
@@ -0,0 +1,253 @@
+# Diff hunk/block affordance + line discard — Design
+
+**Goal:** Give the diff view a Fork/SourceTree-style hover affordance (ring + floating actions) at two nested
+levels — hunk and change-block — add **Discard** for hunks and line ranges (which the app does not have at any
+granularity below whole-file), and replace the line-selection visual that is effectively invisible in the NERV
+theme. Unified **and** Split views. Working Copy (Local Changes) only; commit and PR diffs stay inert.
+
+Interaction model was validated against a live prototype before this spec was written
+(`.superpowers/brainstorm/*/content/interactive-prototype-v2.html`, gitignored).
+
+## Background (verified)
+
+### The NERV selection bug
+
+`DiffView.svelte:889-896` is the entire selection visual:
+
+```css
+.diff-row.selected  { box-shadow: inset 2px 0 0 var(--accent);
+                      background: color-mix(in srgb, var(--accent) 15%, transparent); }
+.split-cell.selected { /* identical */ }
+```
+
+Both properties derive from `--accent`. In Classic that is `#2563eb` (blue) over a near-white row — legible.
+In NERV (`+page.svelte:762-774`) `--accent` is `#F2542D` (orange) and the row underneath a deletion is already
+`--diff-del-bg: rgba(255, 68, 56, 0.15)`. A 15% orange wash over a 15% red wash on a `#12171C` panel is very
+close to no change at all. Contributing factors:
+
+- `nerv.css:97-106` paints a fixed root `::after` (scanlines + a `color-mix(--accent 1.5%)` sheet) at
+  `z-index: 9999` over the whole app, which further flattens low-alpha differences.
+- `nerv.css:298-302` recolors `--accent` per scheme and nothing else, so **crimson** (`#E0445A`) collides with
+  deletions and **phosphor** (`#46E88B`) collides with additions. Any accent-derived 15% wash is unfixable by
+  tuning — it is the wrong mechanism.
+
+### Existing staging machinery (all reused)
+
+- `ops_worktree.rs:242` `split_hunks(diff) -> (header, Vec<hunk_text>)`.
+- `ops_worktree.rs:264` `git_apply(repo, patch, reverse)` — **hardcodes `--cached`**, pipes the patch via stdin.
+- `ops_worktree.rs:339` `build_partial_hunk(hunk, selected, reverse)` — `selected` holds **change-line ordinals**
+  (0-based over the `+`/`-` lines of one hunk; context and `\ No newline` excluded). With `reverse: true` it emits
+  a patch whose **new side matches the post-change image**: unselected `+` stay as context, unselected `-` are
+  dropped. Recomputes the `@@` header, so any `-U{context}` works.
+- `ops_worktree.rs:297/311/456/469` `stage_hunk` / `unstage_hunk` / `stage_lines` / `unstage_lines`.
+- Chain: `gitActions.ts:865-872` → `api.ts:193-199` → `invoke` → `commands.rs:446-462` → `ops_worktree`.
+  Commands registered at `lib.rs:199-202`. Context flows from `appState.effectiveDiffContext`.
+- `gitActions.ts:932` `discard(paths)` — the file-level danger-confirm pattern to match ("This cannot be undone.
+  (Stash instead to keep them.)"), routed through `runWorktree`.
+
+### DiffView structure
+
+- `DiffView.svelte:435` — a **single `<tbody>`** wraps every hunk of every file.
+- `DiffView.svelte:422` `<table class="diff-table" class:split>`; split adds a `<colgroup>` (`:428`).
+- `DiffView.svelte:260` `toSplitRows(hunk)` pairs a contiguous run of `del`/`add` lines into side-by-side rows;
+  context lines span both sides. Selection in split view lives on the `<td>`, not the `<tr>`.
+- `DiffView.svelte:210` `selected = $state<Map<string, Set<number>>>` keyed `"fileIdx:hunkIdx"`; `:230` `toggleLine`
+  toggles on single click; `:213` an `$effect` clears the selection whenever `patch` changes.
+- `DiffView.svelte:450-478` renders "Stage N line(s)" buttons inside the hunk-header row.
+- `DiffView.svelte:721-733` `.diff-table-wrap { overflow: auto }` is the single scroll container; the table is
+  `width: max-content`, so the view scrolls **horizontally** as one unit.
+- Three hosts: `WorkingCopyView.svelte:549` (passes staging callbacks), `CommitFilesDiff.svelte:94` and
+  `github/PrFilesTab.svelte:174` (pass none).
+- `+page.svelte:819` opts `.diff-cell` back into `user-select` (the body baseline is `user-select: none`) so diff
+  code can be copied.
+
+## Interaction model
+
+One ring visual, used by both hover and selection. They are **mutually exclusive**, so they cannot be confused
+and do not need to look different.
+
+| Gesture | Result |
+|---|---|
+| Hover a changed line | **Block ring** (contiguous run of `+`/`-` lines) + block actions |
+| Hover a context line | **Hunk ring** (outline on the hunk) + hunk actions |
+| Double-click a changed line | **Lock** a one-line selection; hover goes inert |
+| Shift+click another line, same hunk | Extend the selection to a contiguous range |
+| `Esc`, or any plain click | Clear the selection; hover resumes |
+
+While a selection is locked: no hunk ring, no block ring, no hover response of any kind. The only ring on screen
+is the selection, and its toolbar is persistent rather than hover-transient.
+
+Nesting: hovering a changed line draws **both** rings — the hunk ring (outer, subtle) and the block ring (inner,
+solid) — but only the innermost unit carries buttons. Never two toolbars.
+
+**Actions by pane:**
+
+| Pane | Buttons |
+|---|---|
+| Unstaged | `Stage <n>` · `Discard <n>` (or `Stage hunk` · `Discard hunk`) |
+| Staged | `Unstage <n>` (or `Unstage hunk`) |
+
+Discard is deliberately **unstaged-only**. On the staged side it would have to mean unstage-and-revert — a
+two-step destruction whose blast radius is not visible from the pane you are looking at, sitting one hover away
+from a routine action. Discarding staged work stays a deliberate two-step: unstage, then discard.
+
+**Ranges may span context lines.** A range anchored on a change line and extended past unchanged rows stays
+visually contiguous; `ordsInRange` collects only the change lines inside it, so `Stage 5` means five real
+changes even when the ring covers seven rows.
+
+**Where the affordance does not appear:** untracked files (no index entry — they render via
+`git diff --no-index` and have no hunk-level staging today), and any host that supplies no action callbacks
+(`CommitFilesDiff`, `PrFilesTab`). Gate on prop presence, matching how `onLineComment` already gates the
+PR-review comment button.
+
+## Frontend design
+
+### `src/lib/diff/blocks.ts` (new, pure, vitest-covered)
+
+Per the convention that logic which can be pure lives outside `.svelte`:
+
+```ts
+export interface Block { rows: number[]; ords: number[] }   // row indices within the hunk, change ordinals
+export function blocksOf(hunk: DiffHunk): Block[]           // contiguous runs of non-context lines
+export function ordinalsOf(hunk: DiffHunk): (number | null)[]  // per row: change ordinal, or null for context
+export function ordsInRange(hunk: DiffHunk, from: number, to: number): number[]
+```
+
+`blocksOf` and `ordinalsOf` replace the inline `hunkOrdinals` / `indexHunkLines` helpers
+(`DiffView.svelte:195-225`), which stay as thin callers or are removed.
+
+### `DiffView.svelte`
+
+**DOM:**
+- Emit **one `<tbody class="hunk">` per hunk** instead of the single wrapping `<tbody>` at `:435`. This is the
+  whole reason the hunk ring is free: a `<tbody>` is a real element and takes a CSS `outline`. A run of `<tr>`s
+  is not, which is why the block ring cannot use the same mechanism.
+- Add **one overlay `<div class="diff-ring">` and one `<div class="diff-tools">`** inside `.diff-table-wrap`,
+  which gains `position: relative`. Both are positioned in JS from the first/last row of the target range.
+- `pointer-events: none` on the ring. The toolbar is interactive and must sit above the rows.
+
+**State:**
+```ts
+let sel = $state<{ fi: number; hi: number; from: number; to: number } | null>(null);
+let hov = $state<{ fi: number; hi: number; block: number | null } | null>(null);
+```
+`sel` replaces `Map<string, Set<number>>` — contiguity makes a set unnecessary. The existing `$effect` that
+clears selection on `patch` change (`:213`) keeps working and stays.
+
+**Positioning:** the ring and toolbar are absolutely positioned against `.diff-table-wrap`, offset by both
+`scrollTop` **and `scrollLeft`** — the table is `width: max-content` and scrolls horizontally. A `scroll` listener
+on the wrap repaints. The prototype validated this approach including the horizontal case.
+
+**Split view:** the ring spans the **full row width**, covering both columns. A paired row's change ordinals are
+the same set as in Unified, so `stage_lines` / `discard_lines` receive identical arguments in both modes and no
+backend branching is needed. Accepted cost: a paired row selects as a unit, so Split loses "stage the addition
+but not its deletion" precision. Unified retains it and is one toolbar click away.
+
+**Removed:** `.diff-row.selected` / `.split-cell.selected` CSS (`:889-896`), the `toggleLine` single-click
+handler and its `onkeydown` twin, and the hunk-header selection buttons (`:450-457`, `:471-478`). The original
+NERV bug is fixed by **deleting** the rule that caused it, not by restyling it.
+
+**Also removed:** the hunk-header `Stage hunk` / `Unstage hunk` buttons (`:444-448`, `:465-469`). The hover
+toolbar supersedes them; leaving both would mean two live paths to the same action. The hunk header keeps its
+`@@` range label.
+
+**After any action** the selection clears and hover resumes. This falls out of the existing `$effect` at `:213`
+— every op triggers a working-copy refresh, the `patch` prop changes, and the hunk indices the selection was
+expressed in are stale by definition.
+
+### Keyboard
+
+Focus behaves as hover, so the feature is not mouse-only (today's rows are focusable and handle Enter/Space —
+this preserves that rather than regressing it):
+
+- Focusing a changed row raises its block ring + toolbar; focusing a context row raises the hunk ring.
+- `Enter` / `Space` on a focused changed row locks a one-line selection there.
+- `Shift`+`↑`/`↓` extends the locked range within the hunk.
+- `Esc` clears.
+- Toolbar buttons are real `<button>`s, reachable by Tab whenever the toolbar is visible.
+
+### Theming
+
+Introduce **`--diff-ring`**, defaulting to `var(--accent)` in the Classic token block. The ring is a solid
+1.5px edge rather than a low-alpha fill, which is a far stronger signal than the 15%-on-15% wash that failed —
+it is expected to hold across all six NERV schemes. The token exists so `nerv.css` can retune crimson/phosphor
+later **without touching component markup**, which is that file's standing contract. Per `CLAUDE.md`, any such
+rule must use bare `:root[data-theme="nerv"]` — never `:global()`, which is silently dropped in plain CSS.
+
+## Backend design — `crates/git-core/src/ops_worktree.rs`
+
+Thread a flag through the existing helper:
+
+```rust
+fn git_apply(repo: &Path, patch: &str, reverse: bool, cached: bool) -> Result<(), String>
+```
+`cached: true` keeps `--cached` (index); `cached: false` omits it, so the patch applies to the **working tree
+only**. Existing callers pass `true`.
+
+```rust
+pub fn discard_hunk(repo: &Path, path: &str, hunk_index: usize, context: u32) -> Result<(), String>
+pub fn discard_lines(repo: &Path, path: &str, hunk_index: usize, selected: &[usize], context: u32)
+    -> Result<(), String>
+```
+
+Both read the **unstaged** diff (`diff(repo, Some(path), false, context)`), reuse `split_hunks` /
+`build_partial_hunk(.., reverse: true)`, and call `git_apply(.., reverse: true, cached: false)`.
+
+`reverse: true` is already exactly correct here and needs no new logic: it emits a patch whose new side matches
+the working file (unselected `+` become context because they *are* in the worktree; unselected `-` are dropped
+because they are not). The unstaged diff's old side is the **index**, so a reverse-apply reverts the selected
+lines to their staged state — **not** to HEAD. Staged work on the same file survives untouched. This is what
+makes Discard safe to place beside Stage.
+
+Hunk indices and ordinals refer to the **current** diff; any successful op re-indexes the remainder, so the
+frontend must re-fetch before issuing another. The existing `runWorktree` refresh already does this.
+
+## Plumbing
+
+| Layer | Addition |
+|---|---|
+| `src-tauri/src/commands.rs` | `discard_hunk`, `discard_lines` — sync, matching the existing staging commands (local `git apply` is fast; the async rule targets `gh`/network `git`) |
+| `src-tauri/src/lib.rs:199` | register both |
+| `src/lib/api.ts` | `discardHunk`, `discardLines` — mirror `stageHunk` / `stageLines` signatures incl. `context` |
+| `src/lib/gitActions.ts` | `discardHunk`, `discardLines` — danger-confirm via `dialogs.confirm` (same copy as `discard`, including "Stash instead to keep them"), then `runWorktree` |
+| `WorkingCopyView.svelte:549` | pass `onDiscardHunk` / `onDiscardLines` only when `!selectedIsStaged && !selectedIsUntracked` |
+
+Confirm-before-discard is **on**, matching file-level discard. No undo bundle: uncommitted work is not in the
+reflog and a `--all` bundle would not capture it — the same reasoning already documented at `gitActions.ts:928`.
+
+## Testing
+
+**vitest — `src/lib/diff/blocks.test.ts`:**
+- `blocksOf`: adjacent `del`/`add` runs form one block; context splits blocks; a block at the first and last row
+  of a hunk; a hunk that is entirely context yields none.
+- `ordinalsOf`: context rows are `null`; ordinals count only `+`/`-`, in order, from 0.
+- `ordsInRange`: a range spanning context lines returns only the change ordinals; a single-row range; a range
+  covering a whole hunk equals every ordinal.
+
+**cargo — `ops_worktree.rs` tests:**
+- `discard_hunk_reverts_only_that_hunk` — two hunks, discard one, assert the other survives in the worktree.
+- `discard_lines_reverts_only_selected` — partial-selection revert, both an addition and a deletion.
+- `discard_lines_leaves_staged_changes_intact` — **load-bearing**: stage some lines, discard others in the same
+  file, assert the staged content is still staged and only the worktree changed. This is the test that proves
+  the `cached: false` semantic.
+- `git_apply` existing callers unaffected (staging round-trip tests already cover this).
+
+**Manual (`npm run tauri dev` — Tauri-only, not reachable from vitest or the browser preview):** hover both ring
+levels; double-click + Shift+click across context lines; Split view; the staged pane offering only Unstage; all
+six NERV schemes plus Classic light and dark; discard with and without staged changes on the same file.
+
+**Gate before done:** `npm run check` (0 errors) + `npm test` + `cargo test`.
+
+## Risks
+
+- **Double-click collides with text selection.** `.diff-cell` deliberately opts back into `user-select`
+  (`+page.svelte:819`) so diff code can be copied, and double-click is the browser's select-word gesture.
+  Mitigation: `getSelection().removeAllRanges()` on `dblclick` (validated in the prototype; a brief
+  word-highlight flicker is possible). If it proves annoying in the real app, the fallback is drag-to-select
+  instead of double-click — the range model is identical either way, so only the gesture binding changes.
+- **Ring tracking on horizontal scroll** — the table is wider than its container by design. Covered by the
+  `scroll` listener; verify with a long-line diff.
+- **Scheme collision on the ring edge.** Expected to hold, but unverified in the real app across all six
+  schemes. `--diff-ring` is the escape hatch if it does not.
+- **`<tbody>`-per-hunk is a structural change** to a table that also renders split mode with a `<colgroup>`.
+  Verify column sizing is unaffected in both modes (the `<colgroup>` sits outside `<tbody>` and should not care).

From 3c23ce2c2ed504b4828095d8070141b413732ef4 Mon Sep 17 00:00:00 2001
From: Ash Shah <494shah@gmail.com>
Date: Thu, 6 Aug 2026 18:14:52 -0700
Subject: [PATCH 02/41] docs: add diff hunk affordance implementation plan

Eight TDD tasks: pure block/ordinal helpers, git-core discard ops,
Tauri/api/gitActions plumbing, hover rings, floating toolbar, range
selection, split view, and keyboard parity.

Also corrects the spec's ring mechanism: box-shadow does not merge
across rules but custom properties do, so the block ring is pure CSS
rather than a JS-positioned overlay. Only the toolbar needs measuring.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .../plans/2026-08-06-diff-hunk-affordance.md  | 1527 +++++++++++++++++
 .../2026-08-06-diff-hunk-affordance-design.md |   29 +-
 2 files changed, 1546 insertions(+), 10 deletions(-)
 create mode 100644 docs/superpowers/plans/2026-08-06-diff-hunk-affordance.md

diff --git a/docs/superpowers/plans/2026-08-06-diff-hunk-affordance.md b/docs/superpowers/plans/2026-08-06-diff-hunk-affordance.md
new file mode 100644
index 0000000..a100ff6
--- /dev/null
+++ b/docs/superpowers/plans/2026-08-06-diff-hunk-affordance.md
@@ -0,0 +1,1527 @@
+# Diff Hunk/Block Affordance + Line Discard — Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Add a nested hover affordance (hunk ring + change-block ring with a floating Stage/Discard/Unstage toolbar) to the working-copy diff, add hunk- and line-level Discard, and replace the line-selection visual that is invisible in the NERV theme.
+
+**Architecture:** Pure block/ordinal math moves to a vitest-covered `src/lib/diff/blocks.ts`. `DiffView.svelte` emits one `<tbody>` per hunk (so the hunk ring is a plain CSS `outline`) and draws the block/selection ring with four *separate CSS custom properties* feeding one `box-shadow` on every `<td>` — these merge instead of overriding, which is what makes a ring around a run of `<tr>`s possible without JS measurement. Only the floating toolbar needs JS, and only for its vertical offset. In Rust, `git_apply` gains a `cached` flag; dropping `--cached` turns the existing reverse-apply into a worktree discard.
+
+**Tech Stack:** SvelteKit 5 (runes), TypeScript, vitest, Rust (cargo workspace), Tauri 2.
+
+## Global Constraints
+
+- **Never `:global()` in `src/lib/theme/nerv.css`** — it is not a Svelte `<style>` block, so the browser silently drops the selector. Use bare `:root[data-theme="nerv"]`.
+- **Classic must render byte-identically** except where this plan explicitly changes shared markup. All NERV-only rules stay `data-theme`-scoped.
+- **Shell-out safety:** any new `git` invocation with user-controlled operands places `--` / `--end-of-options` before them. (No new operand-bearing invocations here — patches go over stdin.)
+- **Business logic that can be pure lives in `src/lib/*.ts` with vitest coverage**, not inside a `.svelte` component.
+- **Full green gate before claiming done:** `npm run check` (0 errors) + `npm test` + `cargo test`.
+- **Tauri-only paths** (real staging/discarding via `invoke`) cannot be exercised by vitest or the browser preview. They require `npm run tauri dev`.
+- Commit subjects: **lowercase first letter, ≤100 chars** (commitlint).
+- Branch is already `feat/diff-hunk-affordance`, cut from `next`.
+
+---
+
+### Task 1: Pure block/ordinal math
+
+**Files:**
+- Create: `src/lib/diff/blocks.ts`
+- Test: `src/lib/diff/blocks.test.ts`
+
+**Interfaces:**
+- Consumes: `DiffHunk`, `DiffLineKind` from `src/lib/diff/types.ts`
+- Produces:
+  - `interface Block { rows: number[]; ords: number[] }`
+  - `ordinalsOf(hunk: DiffHunk): (number | null)[]`
+  - `blocksOf(hunk: DiffHunk): Block[]`
+  - `blockAt(hunk: DiffHunk, row: number): number | null`
+  - `ordsInRange(hunk: DiffHunk, from: number, to: number): number[]`
+
+  Vocabulary note for later tasks: a **row** is an index into `hunk.lines`. An **ordinal** is the 0-based position of a line among only the `+`/`-` lines of that hunk — the argument `stage_lines` / `unstage_lines` / `discard_lines` take.
+
+- [ ] **Step 1: Write the failing test**
+
+Create `src/lib/diff/blocks.test.ts`:
+
+```ts
+import { describe, it, expect } from "vitest";
+import { blocksOf, ordinalsOf, blockAt, ordsInRange } from "./blocks";
+import type { DiffHunk, DiffLineKind } from "./types";
+
+/**
+ * Build a hunk from a compact spec string, one char per line:
+ * " " context, "+" add, "-" del.  e.g. "  -+  -++ "
+ */
+const hunk = (spec: string): DiffHunk => ({
+  header: "@@ -1,1 +1,1 @@",
+  lines: [...spec].map((ch, i) => ({
+    kind: (ch === "+" ? "add" : ch === "-" ? "del" : "context") as DiffLineKind,
+    text: `line${i}`,
+    oldNo: ch === "+" ? null : i,
+    newNo: ch === "-" ? null : i,
+  })),
+});
+
+// Two blocks: rows 2-3 (ords 0,1) and rows 6-8 (ords 2,3,4).
+const TWO_BLOCKS = hunk("  -+  -++ ");
+
+describe("ordinalsOf", () => {
+  it("numbers only changed lines, in order, leaving context null", () => {
+    expect(ordinalsOf(hunk("  -+ "))).toEqual([null, null, 0, 1, null]);
+  });
+
+  it("returns all-null for a hunk of pure context", () => {
+    expect(ordinalsOf(hunk("   "))).toEqual([null, null, null]);
+  });
+});
+
+describe("blocksOf", () => {
+  it("groups an adjacent del/add pair into ONE block", () => {
+    expect(blocksOf(hunk(" -+ "))).toEqual([{ rows: [1, 2], ords: [0, 1] }]);
+  });
+
+  it("splits blocks on context lines and keeps ordinals continuous across them", () => {
+    expect(blocksOf(TWO_BLOCKS)).toEqual([
+      { rows: [2, 3], ords: [0, 1] },
+      { rows: [6, 7, 8], ords: [2, 3, 4] },
+    ]);
+  });
+
+  it("handles blocks touching the first and last row of the hunk", () => {
+    expect(blocksOf(hunk("+  +"))).toEqual([
+      { rows: [0], ords: [0] },
+      { rows: [3], ords: [1] },
+    ]);
+  });
+
+  it("returns no blocks for a hunk of pure context", () => {
+    expect(blocksOf(hunk("   "))).toEqual([]);
+  });
+});
+
+describe("blockAt", () => {
+  it("returns the index of the block containing the row", () => {
+    expect(blockAt(TWO_BLOCKS, 3)).toBe(0);
+    expect(blockAt(TWO_BLOCKS, 7)).toBe(1);
+  });
+
+  it("returns null for a context row", () => {
+    expect(blockAt(TWO_BLOCKS, 5)).toBeNull();
+  });
+});
+
+describe("ordsInRange", () => {
+  it("collects only changed lines when the range spans context rows", () => {
+    // rows 2..8 covers both blocks AND the context rows 4,5 between them
+    expect(ordsInRange(TWO_BLOCKS, 2, 8)).toEqual([0, 1, 2, 3, 4]);
+  });
+
+  it("handles a single-row range", () => {
+    expect(ordsInRange(TWO_BLOCKS, 2, 2)).toEqual([0]);
+  });
+
+  it("normalizes a reversed range", () => {
+    expect(ordsInRange(TWO_BLOCKS, 8, 2)).toEqual([0, 1, 2, 3, 4]);
+  });
+
+  it("returns empty when the range covers only context", () => {
+    expect(ordsInRange(TWO_BLOCKS, 4, 5)).toEqual([]);
+  });
+
+  it("covers every ordinal when given the whole hunk", () => {
+    expect(ordsInRange(TWO_BLOCKS, 0, 9)).toEqual([0, 1, 2, 3, 4]);
+  });
+});
+```
+
+- [ ] **Step 2: Run the test to verify it fails**
+
+```bash
+npx vitest run src/lib/diff/blocks.test.ts
+```
+
+Expected: FAIL — `Failed to resolve import "./blocks"`.
+
+- [ ] **Step 3: Write the implementation**
+
+Create `src/lib/diff/blocks.ts`:
+
+```ts
+import type { DiffHunk } from "./types";
+
+/** A contiguous run of changed (+/-) lines within one hunk. */
+export interface Block {
+  /** Indices into `hunk.lines`, ascending and contiguous. */
+  rows: number[];
+  /** The change-line ordinals for those rows — what the staging backend takes. */
+  ords: number[];
+}
+
+/**
+ * Per row of the hunk: its 0-based change-line ordinal, or null for a context row.
+ * Ordinals count ONLY +/- lines, in order — the vocabulary `stage_lines`,
+ * `unstage_lines` and `discard_lines` expect.
+ */
+export function ordinalsOf(hunk: DiffHunk): (number | null)[] {
+  let n = 0;
+  return hunk.lines.map((l) => (l.kind === "context" ? null : n++));
+}
+
+/** Contiguous runs of changed lines. A context line breaks a run. */
+export function blocksOf(hunk: DiffHunk): Block[] {
+  const out: Block[] = [];
+  let cur: Block | null = null;
+  let ord = 0;
+  for (let i = 0; i < hunk.lines.length; i++) {
+    if (hunk.lines[i].kind === "context") {
+      cur = null;
+      continue;
+    }
+    if (cur === null) {
+      cur = { rows: [], ords: [] };
+      out.push(cur);
+    }
+    cur.rows.push(i);
+    cur.ords.push(ord++);
+  }
+  return out;
+}
+
+/** Index of the block containing `row`, or null when `row` is a context line. */
+export function blockAt(hunk: DiffHunk, row: number): number | null {
+  const i = blocksOf(hunk).findIndex((b) => b.rows.includes(row));
+  return i === -1 ? null : i;
+}
+
+/**
+ * Change-line ordinals inside an inclusive row range (either order). Context rows
+ * inside the range are skipped, so a range may span unchanged rows and still be
+ * contiguous in the only sense the backend cares about.
+ */
+export function ordsInRange(hunk: DiffHunk, from: number, to: number): number[] {
+  const ords = ordinalsOf(hunk);
+  const lo = Math.min(from, to);
+  const hi = Math.max(from, to);
+  const out: number[] = [];
+  for (let i = lo; i <= hi; i++) {
+    const o = ords[i];
+    if (o !== null && o !== undefined) out.push(o);
+  }
+  return out;
+}
+```
+
+- [ ] **Step 4: Run the test to verify it passes**
+
+```bash
+npx vitest run src/lib/diff/blocks.test.ts
+```
+
+Expected: PASS — 14 tests.
+
+- [ ] **Step 5: Run the type gate**
+
+```bash
+npm run check
+```
+
+Expected: 0 errors.
+
+- [ ] **Step 6: Commit**
+
+```bash
+git add src/lib/diff/blocks.ts src/lib/diff/blocks.test.ts
+git commit -m "feat: add pure block/ordinal helpers for diff hunks"
+```
+
+---
+
+### Task 2: `discard_hunk` / `discard_lines` in git-core
+
+**Files:**
+- Modify: `crates/git-core/src/ops_worktree.rs:264-288` (`git_apply` gains a `cached` param), `:301`, `:315`, `:462`, `:475` (existing call sites), and append two public functions after `unstage_lines` (`:476`)
+- Test: `crates/git-core/src/ops_worktree.rs` (the existing `#[cfg(test)] mod tests`)
+
+**Interfaces:**
+- Consumes: existing `diff`, `split_hunks`, `build_partial_hunk`, `git_apply` in the same file. `TempRepo` test fixture (`:557`) with methods `new()`, `git(&[&str])`, `write(f, s)`, `commit_file(f, s, m)`, `staged_paths()`, field `path`.
+- Produces:
+  - `pub fn discard_hunk(repo: &Path, path: &str, hunk_index: usize, context: u32) -> Result<(), String>`
+  - `pub fn discard_lines(repo: &Path, path: &str, hunk_index: usize, selected: &[usize], context: u32) -> Result<(), String>`
+
+- [ ] **Step 1: Write the failing tests**
+
+Append inside the existing `mod tests` block in `crates/git-core/src/ops_worktree.rs`, next to `stage_lines_stages_only_selected_lines`:
+
+```rust
+    // ── discard (worktree reverse-apply) ─────────────────────────────────────
+
+    #[test]
+    fn discard_hunk_reverts_only_that_hunk() {
+        let r = TempRepo::new();
+        // 20 lines so two separated edits land in two hunks at -U3.
+        let base: String = (1..=20).map(|i| format!("line{}\n", i)).collect();
+        r.commit_file("f.txt", &base, "init");
+
+        let mut edited: Vec<String> = (1..=20).map(|i| format!("line{}\n", i)).collect();
+        edited[1] = "CHANGED2\n".to_string();
+        edited[17] = "CHANGED18\n".to_string();
+        r.write("f.txt", &edited.concat());
+
+        let d = diff(&r.path, Some("f.txt"), false, 3).unwrap();
+        let (_h, hunks) = split_hunks(&d);
+        assert_eq!(hunks.len(), 2, "expected two hunks, diff was:\n{}", d);
+
+        discard_hunk(&r.path, "f.txt", 0, 3).unwrap();
+
+        let now = fs::read_to_string(r.path.join("f.txt")).unwrap();
+        assert!(now.contains("line2\n"), "hunk 0 should be reverted");
+        assert!(!now.contains("CHANGED2"), "hunk 0's change should be gone");
+        assert!(now.contains("CHANGED18"), "hunk 1 must be untouched");
+    }
+
+    #[test]
+    fn discard_lines_reverts_only_selected() {
+        let r = TempRepo::new();
+        r.commit_file("f.txt", "base\n", "init");
+        r.write("f.txt", "base\nline1\nline2\nline3\n");
+        // ordinals 0,1,2 == +line1,+line2,+line3 — discard only line2.
+        discard_lines(&r.path, "f.txt", 0, &[1], 3).unwrap();
+        assert_eq!(
+            fs::read_to_string(r.path.join("f.txt")).unwrap(),
+            "base\nline1\nline3\n",
+            "only the selected line should be reverted"
+        );
+    }
+
+    /// The load-bearing one: discarding UNSTAGED lines reverts them to the INDEX
+    /// state, not to HEAD, so staged work on the same file survives. This is what
+    /// makes Discard safe to sit beside Stage.
+    #[test]
+    fn discard_lines_leaves_staged_changes_intact() {
+        let r = TempRepo::new();
+        r.commit_file("f.txt", "base\n", "init");
+        r.write("f.txt", "base\nkeep\ndrop\n");
+
+        // Stage only `keep` (ordinal 0); `drop` stays unstaged.
+        stage_lines(&r.path, "f.txt", 0, &[0], 3).unwrap();
+        let staged = diff(&r.path, Some("f.txt"), true, 3).unwrap();
+        assert!(staged.contains("+keep"), "precondition: keep must be staged");
+
+        // The unstaged diff now holds exactly one change line (`+drop`) at ordinal 0.
+        discard_lines(&r.path, "f.txt", 0, &[0], 3).unwrap();
+
+        assert_eq!(
+            fs::read_to_string(r.path.join("f.txt")).unwrap(),
+            "base\nkeep\n",
+            "drop reverted to the INDEX state, not HEAD"
+        );
+        let still = diff(&r.path, Some("f.txt"), true, 3).unwrap();
+        assert!(still.contains("+keep"), "staged work must survive the discard");
+    }
+```
+
+- [ ] **Step 2: Run the tests to verify they fail**
+
+```bash
+cargo test -p git-core discard_
+```
+
+Expected: FAIL to compile — `cannot find function 'discard_hunk' in this scope`.
+
+- [ ] **Step 3: Add the `cached` flag to `git_apply`**
+
+In `crates/git-core/src/ops_worktree.rs`, replace the signature and body head of `git_apply` (currently at `:262-268`):
+
+```rust
+/// Pipe a patch (reconstructed from git's own diff output) to `git apply` via stdin.
+/// `cached` selects the target: true → `--cached` (the index, for stage/unstage),
+/// false → the WORKING TREE only (for discard). Never uses a temp file or shell.
+fn git_apply(repo: &Path, patch: &str, reverse: bool, cached: bool) -> Result<(), String> {
+    let mut c = Command::new("git");
+    c.current_dir(repo).arg("apply");
+    if cached {
+        c.arg("--cached");
+    }
+    if reverse {
+        c.arg("--reverse");
+    }
+```
+
+The rest of the function body (from `c.arg("-")` onward) is unchanged.
+
+- [ ] **Step 4: Update the four existing call sites to pass `cached: true`**
+
+| Location | Before | After |
+|---|---|---|
+| `stage_hunk` (`:301`) | `git_apply(repo, &format!("{}{}", header, h), false)` | `git_apply(repo, &format!("{}{}", header, h), false, true)` |
+| `unstage_hunk` (`:315`) | `git_apply(repo, &format!("{}{}", header, h), true)` | `git_apply(repo, &format!("{}{}", header, h), true, true)` |
+| `stage_lines` (`:462`) | `git_apply(repo, &format!("{}{}", header, partial), false)` | `git_apply(repo, &format!("{}{}", header, partial), false, true)` |
+| `unstage_lines` (`:475`) | `git_apply(repo, &format!("{}{}", header, partial), true)` | `git_apply(repo, &format!("{}{}", header, partial), true, true)` |
+
+- [ ] **Step 5: Add the two discard functions**
+
+Append after `unstage_lines` (i.e. after `:476`), before `stash_push`:
+
+```rust
+/// Discard one hunk (by index) of `path`'s UNSTAGED diff: reverse-apply it to the
+/// WORKING TREE only (no `--cached`). Because the unstaged diff's old side is the
+/// INDEX, the lines revert to their staged state — staged changes to the same file
+/// are untouched. DESTRUCTIVE / not undoable.
+///
+/// Hunk indices refer to the CURRENT live diff; after a successful op the remaining
+/// diff re-indexes, so callers must re-fetch before issuing another.
+pub fn discard_hunk(repo: &Path, path: &str, hunk_index: usize, context: u32) -> Result<(), String> {
+    let d = diff(repo, Some(path), false, context)?;
+    let (header, hunks) = split_hunks(&d);
+    let h = hunks.get(hunk_index).ok_or("hunk index out of range")?;
+    git_apply(repo, &format!("{}{}", header, h), true, false)
+}
+
+/// Discard selected change-line ordinals of one hunk of `path`'s UNSTAGED diff.
+/// `build_partial_hunk(.., reverse: true)` emits a patch whose NEW side matches the
+/// working file (unselected `+` become context because they ARE present there;
+/// unselected `-` are dropped because they are not) — exactly what a worktree
+/// reverse-apply needs. DESTRUCTIVE / not undoable.
+pub fn discard_lines(repo: &Path, path: &str, hunk_index: usize, selected: &[usize], context: u32) -> Result<(), String> {
+    let d = diff(repo, Some(path), false, context)?;
+    let (header, hunks) = split_hunks(&d);
+    let h = hunks.get(hunk_index).ok_or("hunk index out of range")?;
+    let set: std::collections::HashSet<usize> = selected.iter().copied().collect();
+    let partial = build_partial_hunk(h, &set, true).ok_or("no lines selected to discard")?;
+    git_apply(repo, &format!("{}{}", header, partial), true, false)
+}
+```
+
+- [ ] **Step 6: Run the new tests**
+
+```bash
+cargo test -p git-core discard_
+```
+
+Expected: PASS — including the three new tests.
+
+- [ ] **Step 7: Run the whole crate to prove the `git_apply` change broke nothing**
+
+```bash
+cargo test -p git-core
+```
+
+Expected: PASS — all staging round-trip tests still green.
+
+- [ ] **Step 8: Commit**
+
+```bash
+git add crates/git-core/src/ops_worktree.rs
+git commit -m "feat: add hunk and line discard to the working-copy ops"
+```
+
+---
+
+### Task 3: Plumb discard through Tauri, api, and gitActions
+
+**Files:**
+- Modify: `src-tauri/src/commands.rs` (append after `unstage_lines`, `:463`)
+- Modify: `src-tauri/src/lib.rs:202` (after `commands::unstage_lines,`)
+- Modify: `src/lib/api.ts:200` (after `unstageLines`)
+- Modify: `src/lib/gitActions.ts:872` (after `unstageLines`)
+
+**Interfaces:**
+- Consumes: `ops_worktree::discard_hunk` / `discard_lines` (Task 2); `runWorktree(label, fn)` (`gitActions.ts:522`, already guards `isTauri()` and `appState.repo`); `dialogs.confirm({ title, message, confirmLabel, danger })`; `appState.effectiveDiffContext`.
+- Produces:
+  - `api.discardHunk(repo, path, hunkIndex, context?) => Promise<void>`
+  - `api.discardLines(repo, path, hunkIndex, selected, context?) => Promise<void>`
+  - `gitActions.discardHunk(path: string, hunkIndex: number) => Promise<boolean>`
+  - `gitActions.discardLines(path: string, hunkIndex: number, selected: number[]) => Promise<boolean>`
+
+  There is no unit test at this layer — it is `invoke` glue. The gate is that both toolchains compile and the existing suites stay green.
+
+- [ ] **Step 1: Add the Tauri commands**
+
+In `src-tauri/src/commands.rs`, append immediately after the `unstage_lines` command:
+
+```rust
+#[tauri::command]
+pub fn discard_hunk(repo: String, path: String, hunk_index: usize, context: u32) -> Result<(), String> {
+    ops_worktree::discard_hunk(&PathBuf::from(repo), &path, hunk_index, context)
+}
+
+#[tauri::command]
+pub fn discard_lines(repo: String, path: String, hunk_index: usize, selected: Vec<usize>, context: u32) -> Result<(), String> {
+    ops_worktree::discard_lines(&PathBuf::from(repo), &path, hunk_index, &selected, context)
+}
+```
+
+These are deliberately **synchronous**, matching the neighbouring staging commands: `git apply` on a local repo is fast, and the `#[tauri::command(async)]` rule targets slow external processes (`gh`, network `git`).
+
+- [ ] **Step 2: Register them**
+
+In `src-tauri/src/lib.rs`, in the `generate_handler!` list, add after `commands::unstage_lines,`:
+
+```rust
+            commands::discard_hunk,
+            commands::discard_lines,
+```
+
+- [ ] **Step 3: Verify the Rust side compiles**
+
+```bash
+cargo check -p git-it
+```
+
+Expected: finishes with no errors.
+
+- [ ] **Step 4: Add the api bindings**
+
+In `src/lib/api.ts`, after the `unstageLines` entry:
+
+```ts
+  discardHunk: (repo: string, path: string, hunkIndex: number, context = 3) =>
+    invoke<void>("discard_hunk", { repo, path, hunkIndex, context }),
+  discardLines: (repo: string, path: string, hunkIndex: number, selected: number[], context = 3) =>
+    invoke<void>("discard_lines", { repo, path, hunkIndex, selected, context }),
+```
+
+- [ ] **Step 5: Add the gitActions wrappers**
+
+In `src/lib/gitActions.ts`, after the `unstageLines` entry:
+
+```ts
+  // Hunk/line discard is DESTRUCTIVE and NOT undoable — same reasoning as the
+  // file-level `discard` below: uncommitted work is not in the reflog, so there is
+  // no backup bundle to take. Guard BEFORE confirming so the browser preview never
+  // shows a dialog it cannot honour.
+  discardHunk: async (path: string, hunkIndex: number): Promise<boolean> => {
+    if (!isTauri()) {
+      appState.status = "That action needs the desktop app (not the browser preview).";
+      return false;
+    }
+    if (!appState.repo) {
+      appState.status = "Open a repository first.";
+      return false;
+    }
+    const confirmed = await dialogs.confirm({
+      title: "Discard hunk",
+      message: `Permanently discard this hunk of ${path}. This cannot be undone. (Stash instead to keep it.)`,
+      confirmLabel: "Discard",
+      danger: true,
+    });
+    if (!confirmed) return false;
+    return runWorktree(`Discard hunk in ${path}`, () =>
+      api.discardHunk(appState.repo, path, hunkIndex, appState.effectiveDiffContext),
+    );
+  },
+  discardLines: async (path: string, hunkIndex: number, selected: number[]): Promise<boolean> => {
+    if (!isTauri()) {
+      appState.status = "That action needs the desktop app (not the browser preview).";
+      return false;
+    }
+    if (!appState.repo) {
+      appState.status = "Open a repository first.";
+      return false;
+    }
+    const n = selected.length;
+    const confirmed = await dialogs.confirm({
+      title: "Discard lines",
+      message: `Permanently discard ${n} line${n === 1 ? "" : "s"} in ${path}. This cannot be undone. (Stash instead to keep them.)`,
+      confirmLabel: "Discard",
+      danger: true,
+    });
+    if (!confirmed) return false;
+    return runWorktree(`Discard ${n} line(s) in ${path}`, () =>
+      api.discardLines(appState.repo, path, hunkIndex, selected, appState.effectiveDiffContext),
+    );
+  },
+```
+
+- [ ] **Step 6: Verify the frontend type-checks and tests stay green**
+
+```bash
+npm run check && npm test
+```
+
+Expected: 0 errors; all existing tests pass.
+
+- [ ] **Step 7: Commit**
+
+```bash
+git add src-tauri/src/commands.rs src-tauri/src/lib.rs src/lib/api.ts src/lib/gitActions.ts
+git commit -m "feat: expose hunk and line discard to the frontend"
+```
+
+---
+
+### Task 4: Hunk + block hover rings in DiffView (unified view)
+
+**Files:**
+- Modify: `src/lib/components/DiffView.svelte` — script (imports, props, hover state, helpers), markup (`<tbody>` per hunk at `:435`, unified `{#each}` at `:486`), styles
+
+**Interfaces:**
+- Consumes: `blocksOf`, `blockAt` from `../diff/blocks` (Task 1)
+- Produces (used by Tasks 5–8):
+  - props `onDiscardHunk?: (i: number) => void`, `onDiscardLines?: (hunkIndex: number, selected: number[]) => void`
+  - `const hasActions: boolean` — true when any staging/discard callback was supplied
+  - `let hov: { fi: number; hi: number; block: number | null } | null`
+  - `function hoverRow(fi: number, hi: number, ri: number): void`
+  - `function ringRange(fi: number, hi: number): { from: number; to: number } | null`
+  - CSS classes `ring`, `ring-first`, `ring-last` on `<tr>`; `hunk-hover` on `<tbody>`
+
+- [ ] **Step 1: Add the imports, props, and hover state**
+
+In the `<script>` of `src/lib/components/DiffView.svelte`, add to the imports at the top:
+
+```ts
+  import { blocksOf, blockAt } from "../diff/blocks";
+```
+
+Add to the `Props` interface (after `onUnstageLines`):
+
+```ts
+    onDiscardHunk?: (i: number) => void;
+    onDiscardLines?: (hunkIndex: number, selected: number[]) => void;
+```
+
+Add both to the destructuring on the `let { ... }: Props = $props();` line, and after it add:
+
+```ts
+  // The whole hover/selection affordance only exists where actions do. Commit diffs
+  // (CommitFilesDiff) and PR review diffs (PrFilesTab) pass no callbacks and stay inert.
+  const hasActions = $derived(
+    !!(onStageHunk || onUnstageHunk || onStageLines || onUnstageLines || onDiscardHunk || onDiscardLines),
+  );
+
+  // Hovered unit. `block` is the index into blocksOf(hunk), or null on a context row
+  // (which targets the whole hunk instead).
+  let hov = $state<{ fi: number; hi: number; block: number | null } | null>(null);
+
+  function hoverRow(fi: number, hi: number, ri: number) {
+    if (!hasActions) return;
+    const h = parsed.files[fi]?.hunks[hi];
+    if (!h) return;
+    hov = { fi, hi, block: blockAt(h, ri) };
+  }
+
+  function clearHover() {
+    hov = null;
+  }
+
+  /**
+   * The row range the inner ring should cover for this hunk, or null for none.
+   * Only a hovered BLOCK gets the inner ring; a hovered context row gets the
+   * outer `<tbody>` outline instead (see the `hunk-hover` class).
+   */
+  function ringRange(fi: number, hi: number): { from: number; to: number } | null {
+    if (!hov || hov.fi !== fi || hov.hi !== hi || hov.block === null) return null;
+    const h = parsed.files[fi]?.hunks[hi];
+    if (!h) return null;
+    const b = blocksOf(h)[hov.block];
+    return b ? { from: b.rows[0], to: b.rows[b.rows.length - 1] } : null;
+  }
+```
+
+- [ ] **Step 2: Emit one `<tbody>` per hunk**
+
+In the markup, the table currently wraps everything in a single `<tbody>` (`:435`) with `{#each file.hunks ...}` inside it. Restructure so the `{#each}` is outside and each hunk gets its own `<tbody>`.
+
+Replace:
+
+```svelte
+            <tbody>
+              {#each file.hunks as hunk, hi (hi)}
+```
+
+with:
+
+```svelte
+            {#each file.hunks as hunk, hi (hi)}
+              {@const ring = ringRange(fi, hi)}
+              <tbody
+                class="hunk"
+                class:hunk-hover={hasActions && hov?.fi === fi && hov?.hi === hi}
+                onmouseleave={clearHover}
+              >
+```
+
+and replace the matching closing tags at the end of the loop:
+
+```svelte
+              {/each}
+            </tbody>
+```
+
+with:
+
+```svelte
+              </tbody>
+            {/each}
+```
+
+`{@const ring = ...}` must be the first child of the `{#each}` block — it is computed **once per hunk** rather than per row, which keeps this O(rows) rather than O(rows²).
+
+- [ ] **Step 3: Apply the ring classes to unified rows**
+
+In the unified branch, change the `{#each}` to expose the row index and add the ring classes plus the hover handler. Replace the opening of the row loop and the `<tr>`:
+
+```svelte
+                  {#each indexHunkLines(hunk) as { line, beforeIdx, afterIdx } (line.oldNo ?? `a${line.newNo}`)}
+                    {@const toks = lineTokens(fi, hi, line, beforeIdx, afterIdx)}
+                    {@const ord = line.kind !== "context" ? ords.get(line) : undefined}
+                    <!-- svelte-ignore a11y_no_static_element_interactions -->
+                    <tr
+                      class="diff-row {line.kind}"
+                      class:selected={ord !== undefined && isSelected(fi, hi, ord)}
+```
+
+with:
+
+```svelte
+                  {#each indexHunkLines(hunk) as { line, beforeIdx, afterIdx }, ri (ri)}
+                    {@const toks = lineTokens(fi, hi, line, beforeIdx, afterIdx)}
+                    {@const ord = line.kind !== "context" ? ords.get(line) : undefined}
+                    <!-- svelte-ignore a11y_no_static_element_interactions -->
+                    <tr
+                      class="diff-row {line.kind}"
+                      class:selected={ord !== undefined && isSelected(fi, hi, ord)}
+                      class:ring={ring !== null && ri >= ring.from && ri <= ring.to}
+                      class:ring-first={ring !== null && ri === ring.from}
+                      class:ring-last={ring !== null && ri === ring.to}
+                      onmouseenter={() => hoverRow(fi, hi, ri)}
+```
+
+Everything else on the `<tr>` (the `style`, `onclick`, `onkeydown`) stays for now — Task 6 replaces it.
+
+- [ ] **Step 4: Add the ring CSS**
+
+Add to the `<style>` block of `DiffView.svelte`, after the `.gutter` rules:
+
+```css
+  /* ── Hover / selection ring ──────────────────────────────────────────────────
+     A hunk is a <tbody> and takes a plain outline. A BLOCK is only a run of <tr>s
+     with no wrapping element, so its ring is built from four box-shadow insets
+     spread across the run's cells. They must be four SEPARATE custom properties
+     feeding one box-shadow: written as four rules on `box-shadow` directly, the
+     last would simply win. As custom properties they compose. */
+  .diff-table td {
+    box-shadow: var(--rt, 0 0 transparent), var(--rb, 0 0 transparent),
+                var(--rl, 0 0 transparent), var(--rr, 0 0 transparent);
+  }
+  tr.ring-first td { --rt: inset 0 1.5px 0 var(--diff-ring); }
+  tr.ring-last td { --rb: inset 0 -1.5px 0 var(--diff-ring); }
+  tr.ring td:first-child { --rl: inset 1.5px 0 0 var(--diff-ring); }
+  tr.ring td:last-child { --rr: inset -1.5px 0 0 var(--diff-ring); }
+
+  /* Outer ring — subtler than the block ring, and drawn on the hunk's own element. */
+  tbody.hunk.hunk-hover {
+    outline: 1px solid color-mix(in srgb, var(--diff-ring) 34%, transparent);
+    outline-offset: -1px;
+  }
+```
+
+- [ ] **Step 5: Add the `--diff-ring` token**
+
+In `src/routes/+page.svelte`, add to the Classic `:global(:root)` block, next to the other diff tokens (after the `--diff-add-fg` / `--diff-del-fg` line):
+
+```css
+    --diff-ring: var(--accent);
+```
+
+NERV inherits this through its own `--accent` and needs no separate declaration; the token exists so `nerv.css` can retune a colliding scheme later without touching component markup.
+
+- [ ] **Step 6: Verify types and tests**
+
+```bash
+npm run check && npm test
+```
+
+Expected: 0 errors; all tests pass.
+
+- [ ] **Step 7: Verify by hand in the desktop app**
+
+```bash
+npm run tauri dev
+```
+
+Open a repo with uncommitted changes → Local Changes → select a modified file. Confirm:
+1. Hovering a **changed** line draws a solid ring around that contiguous block *and* a fainter outline around the whole hunk.
+2. Hovering a **context** line draws only the faint hunk outline.
+3. Moving the pointer out of the diff clears both.
+4. The ring's left/right edges follow the block when you scroll horizontally on a long line.
+5. Open a commit from the graph — its diff shows **no** rings at all.
+
+- [ ] **Step 8: Commit**
+
+```bash
+git add src/lib/components/DiffView.svelte src/routes/+page.svelte
+git commit -m "feat: add nested hunk and block hover rings to the diff view"
+```
+
+---
+
+### Task 5: Floating action toolbar + WorkingCopyView wiring
+
+**Files:**
+- Modify: `src/lib/components/DiffView.svelte` — script (target resolution, toolbar position, action dispatch), markup (wrap `.diff-table-wrap` in a positioned outer div; render the toolbar), styles
+- Modify: `src/lib/components/WorkingCopyView.svelte:549-564` (pass the discard callbacks)
+
+**Interfaces:**
+- Consumes: `hov`, `hasActions`, `ringRange` (Task 4); `blocksOf` (Task 1); `gitActions.discardHunk` / `discardLines` (Task 3)
+- Produces (used by Tasks 6–8):
+  - `interface ActionTarget { fi: number; hi: number; scope: "sel" | "blk" | "hunk"; ords: number[] | null; anchorRow: number }`
+  - `function activeTarget(): ActionTarget | null`
+  - `function runAction(kind: "stage" | "unstage" | "discard"): void`
+  - `let wrapEls: Record<number, HTMLDivElement | undefined>` and `let toolTop: number`
+
+- [ ] **Step 1: Add target resolution and action dispatch**
+
+In the `<script>` of `DiffView.svelte`, after `ringRange`:
+
+```ts
+  interface ActionTarget {
+    fi: number;
+    hi: number;
+    scope: "sel" | "blk" | "hunk";
+    /** null for a whole-hunk target — the hunk ops take no ordinals. */
+    ords: number[] | null;
+    /** Row the toolbar anchors to. */
+    anchorRow: number;
+  }
+
+  /** What the visible toolbar acts on right now. Task 6 adds the selection branch. */
+  function activeTarget(): ActionTarget | null {
+    if (!hasActions || !hov) return null;
+    const h = parsed.files[hov.fi]?.hunks[hov.hi];
+    if (!h) return null;
+    if (hov.block !== null) {
+      const b = blocksOf(h)[hov.block];
+      if (b) return { fi: hov.fi, hi: hov.hi, scope: "blk", ords: b.ords, anchorRow: b.rows[0] };
+    }
+    return { fi: hov.fi, hi: hov.hi, scope: "hunk", ords: null, anchorRow: 0 };
+  }
+
+  function runAction(kind: "stage" | "unstage" | "discard") {
+    const t = activeTarget();
+    if (!t) return;
+    if (t.scope === "hunk") {
+      if (kind === "stage") onStageHunk?.(t.hi);
+      else if (kind === "unstage") onUnstageHunk?.(t.hi);
+      else onDiscardHunk?.(t.hi);
+    } else {
+      const ords = t.ords ?? [];
+      if (!ords.length) return;
+      if (kind === "stage") onStageLines?.(t.hi, ords);
+      else if (kind === "unstage") onUnstageLines?.(t.hi, ords);
+      else onDiscardLines?.(t.hi, ords);
+    }
+    hov = null;
+  }
+```
+
+- [ ] **Step 2: Add toolbar positioning**
+
+Still in the `<script>`:
+
+```ts
+  // The toolbar lives OUTSIDE the horizontally-scrolling table wrap so `right` pins
+  // it to the visible edge. Only its vertical offset needs measuring, and using
+  // getBoundingClientRect differences means scrollTop needs no separate arithmetic.
+  let wrapEls = $state<Record<number, HTMLDivElement | undefined>>({});
+  let toolTop = $state(0);
+  let toolVisible = $state(false);
+
+  function measureTool() {
+    const t = activeTarget();
+    const wrap = t ? wrapEls[t.fi] : undefined;
+    if (!t || !wrap) {
+      toolVisible = false;
+      return;
+    }
+    const row = wrap.querySelector<HTMLElement>(
+      `tr[data-h="${t.hi}"][data-i="${t.anchorRow}"]`,
+    );
+    if (!row) {
+      toolVisible = false;
+      return;
+    }
+    const top = row.getBoundingClientRect().top - wrap.getBoundingClientRect().top;
+    // Hide rather than float a toolbar pointing at a row scrolled out of view.
+    if (top < 0 || top > wrap.clientHeight - 8) {
+      toolVisible = false;
+      return;
+    }
+    toolTop = top;
+    toolVisible = true;
+  }
+
+  // Runs after the DOM settles, so the anchor row is guaranteed to exist.
+  $effect(() => {
+    hov;
+    measureTool();
+  });
+```
+
+- [ ] **Step 3: Add `data-h` / `data-i` to unified rows**
+
+`measureTool` finds its anchor by attribute. On the unified `<tr>` edited in Task 4, add:
+
+```svelte
+                      data-h={hi}
+                      data-i={ri}
+```
+
+- [ ] **Step 4: Wrap the table and render the toolbar**
+
+Replace:
+
+```svelte
+        <div class="diff-table-wrap">
+          <table class="diff-table mono" class:split={appState.diffSplit}>
+```
+
+with:
+
+```svelte
+        <div class="diff-table-outer">
+        <div
+          class="diff-table-wrap"
+          bind:this={wrapEls[fi]}
+          onscroll={measureTool}
+        >
+          <table class="diff-table mono" class:split={appState.diffSplit}>
+```
+
+and replace the matching close:
+
+```svelte
+          </table>
+        </div>
+```
+
+with:
+
+```svelte
+          </table>
+        </div>
+        {#if hasActions && toolVisible}
+          {@const t = activeTarget()}
+          {#if t && t.fi === fi}
+            {@const label = t.scope === "hunk" ? "hunk" : String((t.ords ?? []).length)}
+            <div class="diff-tools" style="top: {toolTop}px">
+              {#if !staged && onStageHunk}
+                <button onclick={() => runAction("stage")}>Stage {label}</button>
+              {/if}
+              {#if !staged && onDiscardHunk}
+                <button class="danger" onclick={() => runAction("discard")}>Discard {label}</button>
+              {/if}
+              {#if staged && onUnstageHunk}
+                <button onclick={() => runAction("unstage")}>Unstage {label}</button>
+              {/if}
+            </div>
+          {/if}
+        {/if}
+        </div>
+```
+
+- [ ] **Step 5: Add the toolbar CSS**
+
+Add to `DiffView.svelte`'s `<style>`:
+
+```css
+  /* Positioning context for the floating toolbar. It must NOT be the scroll
+     container: an absolutely-positioned child of a scroller is laid out against
+     the content, so `right` would drift as the diff scrolls sideways. */
+  .diff-table-outer {
+    position: relative;
+    display: flex;
+    flex: 1 1 auto;
+    min-height: 0;
+  }
+
+  .diff-tools {
+    position: absolute;
+    right: 14px;
+    z-index: 6;
+    display: flex;
+    gap: 4px;
+    padding: 3px;
+    background: var(--header-bg);
+    border: 1px solid var(--border);
+    border-radius: var(--radius-sm);
+  }
+  .diff-tools button {
+    padding: 2px 8px;
+    border-radius: var(--radius-sm);
+    border: 1px solid var(--accent);
+    background: var(--btn-bg);
+    color: var(--accent);
+    font-family: var(--font-mono);
+    font-size: 10px;
+    letter-spacing: 0.05em;
+    text-transform: uppercase;
+    white-space: nowrap;
+    cursor: pointer;
+  }
+  .diff-tools button:hover {
+    background: var(--accent);
+    color: var(--on-accent);
+  }
+  .diff-tools button.danger {
+    border-color: var(--danger);
+    color: var(--danger);
+  }
+  .diff-tools button.danger:hover {
+    background: var(--danger);
+    color: var(--on-accent);
+  }
+```
+
+Also add `flex: 1 1 auto; min-height: 0;` to the existing `.diff-table-wrap` rule if not already effective — it now sits inside `.diff-table-outer`:
+
+```css
+  .diff-table-wrap {
+    overflow: auto;
+    flex: 1 1 auto;
+    min-width: 0;
+  }
+```
+
+- [ ] **Step 6: Pass the discard callbacks from WorkingCopyView**
+
+In `src/lib/components/WorkingCopyView.svelte`, in the `<DiffView ... />` call, add after `onUnstageLines`:
+
+```svelte
+            onDiscardHunk={selectedIsStaged || selectedIsUntracked
+              ? undefined
+              : (i) => gitActions.discardHunk(selectedFile!, i)}
+            onDiscardLines={selectedIsStaged || selectedIsUntracked
+              ? undefined
+              : (hi, sel) => gitActions.discardLines(selectedFile!, hi, sel)}
+```
+
+Discard is unstaged-and-tracked only: on the staged side it would mean unstage-and-revert, and untracked files have no index entry to revert to.
+
+- [ ] **Step 7: Verify types and tests**
+
+```bash
+npm run check && npm test
+```
+
+Expected: 0 errors; all tests pass.
+
+- [ ] **Step 8: Verify by hand**
+
+```bash
+npm run tauri dev
+```
+
+1. Hover a changed line in an **unstaged** file → toolbar shows `Stage N` + `Discard N` pinned to the right edge of the diff pane, level with the block.
+2. Hover a context line → toolbar shows `Stage hunk` + `Discard hunk`.
+3. Select a **staged** file → toolbar shows `Unstage N` only, no Discard.
+4. Click `Discard N` → confirm dialog appears; confirming reverts exactly those lines in the file and leaves the rest.
+5. Stage some lines of a file, then discard *different* lines of the same file → the staged lines are still staged.
+6. Scroll the diff horizontally → the toolbar stays pinned to the right edge. Scroll vertically until the block leaves view → the toolbar disappears rather than floating.
+
+- [ ] **Step 9: Commit**
+
+```bash
+git add src/lib/components/DiffView.svelte src/lib/components/WorkingCopyView.svelte
+git commit -m "feat: add floating stage/discard toolbar to the diff view"
+```
+
+---
+
+### Task 6: Replace the line-selection model
+
+**Files:**
+- Modify: `src/lib/components/DiffView.svelte` — remove the `selected` Map, `toggleLine`, `isSelected`, `selCount`, `applyLines`, `hunkOrdinals`; add the range selection; remove the hunk-header buttons and the old selection CSS
+
+**Interfaces:**
+- Consumes: `ordsInRange` (Task 1); `activeTarget`, `runAction`, `measureTool` (Task 5)
+- Produces (used by Tasks 7–8):
+  - `let sel: { fi: number; hi: number; anchor: number; from: number; to: number } | null`
+  - `function lockSelection(fi: number, hi: number, ri: number): void`
+  - `function extendSelection(fi: number, hi: number, ri: number): void`
+  - `function clearSelection(): void`
+
+- [ ] **Step 1: Delete the old selection machinery**
+
+In the `<script>`, delete this whole block (currently `:207-246`) — the `selected` state, its clearing `$effect`, `hunkOrdinals`, `keyOf`, `isSelected`, `toggleLine`, `selCount`, and `applyLines`:
+
+```ts
+  // ─── Line-level selection ─────────────────────────────────────────────────────
+
+  // Map keyed by "${fi}:${hi}" → Set of change-line ordinals (0-based among +/- lines).
+  let selected = $state<Map<string, Set<number>>>(new Map());
+  ...
+  function applyLines(fi: number, hi: number) { ... }
+```
+
+Also update the import of `ordsInRange`:
+
+```ts
+  import { blocksOf, blockAt, ordsInRange } from "../diff/blocks";
+```
+
+- [ ] **Step 2: Add the range selection**
+
+In its place:
+
+```ts
+  // ─── Line selection ───────────────────────────────────────────────────────────
+  // A contiguous row range inside ONE hunk. `anchor` is the row the range grew
+  // from, so extending down and then back up pivots correctly. Ranges may span
+  // context rows; `ordsInRange` keeps only the change lines.
+  let sel = $state<{ fi: number; hi: number; anchor: number; from: number; to: number } | null>(null);
+
+  // A new patch re-indexes every hunk, so any range we were holding is meaningless.
+  $effect(() => {
+    patch;
+    sel = null;
+  });
+
+  function lockSelection(fi: number, hi: number, ri: number) {
+    if (!hasActions) return;
+    const h = parsed.files[fi]?.hunks[hi];
+    if (!h || h.lines[ri]?.kind === "context") return;
+    sel = { fi, hi, anchor: ri, from: ri, to: ri };
+    hov = null;
+    // A double-click is also the browser's select-word gesture, and `.diff-cell`
+    // deliberately opts back into user-select so diff code stays copyable.
+    window.getSelection()?.removeAllRanges();
+  }
+
+  function extendSelection(fi: number, hi: number, ri: number) {
+    if (!sel || sel.fi !== fi || sel.hi !== hi) return;
+    const h = parsed.files[fi]?.hunks[hi];
+    if (!h) return;
+    const from = Math.min(sel.anchor, ri);
+    const to = Math.max(sel.anchor, ri);
+    if (!ordsInRange(h, from, to).length) return;
+    sel = { fi, hi, anchor: sel.anchor, from, to };
+    window.getSelection()?.removeAllRanges();
+  }
+
+  function clearSelection() {
+    sel = null;
+  }
+
+  function onRowClick(e: MouseEvent, fi: number, hi: number, ri: number) {
+    if (!hasActions) return;
+    if (e.shiftKey) {
+      extendSelection(fi, hi, ri);
+      return;
+    }
+    clearSelection();
+  }
+```
+
+- [ ] **Step 3: Make hover, ring, and target respect the lock**
+
+Replace the three functions so a locked selection outranks hover absolutely.
+
+`hoverRow` — add the guard as its first line:
+
+```ts
+  function hoverRow(fi: number, hi: number, ri: number) {
+    if (!hasActions || sel) return;   // locked: hover is dead
+    const h = parsed.files[fi]?.hunks[hi];
+    if (!h) return;
+    hov = { fi, hi, block: blockAt(h, ri) };
+  }
+```
+
+`clearHover`:
+
+```ts
+  function clearHover() {
+    if (sel) return;
+    hov = null;
+  }
+```
+
+`ringRange` — the selection draws the ring when one exists:
+
+```ts
+  function ringRange(fi: number, hi: number): { from: number; to: number } | null {
+    if (sel) {
+      return sel.fi === fi && sel.hi === hi ? { from: sel.from, to: sel.to } : null;
+    }
+    if (!hov || hov.fi !== fi || hov.hi !== hi || hov.block === null) return null;
+    const h = parsed.files[fi]?.hunks[hi];
+    if (!h) return null;
+    const b = blocksOf(h)[hov.block];
+    return b ? { from: b.rows[0], to: b.rows[b.rows.length - 1] } : null;
+  }
+```
+
+`activeTarget` — add the selection branch at the top:
+
+```ts
+  function activeTarget(): ActionTarget | null {
+    if (!hasActions) return null;
+    if (sel) {
+      const h = parsed.files[sel.fi]?.hunks[sel.hi];
+      if (!h) return null;
+      const ords = ordsInRange(h, sel.from, sel.to);
+      return ords.length
+        ? { fi: sel.fi, hi: sel.hi, scope: "sel", ords, anchorRow: sel.from }
+        : null;
+    }
+    if (!hov) return null;
+    const h = parsed.files[hov.fi]?.hunks[hov.hi];
+    if (!h) return null;
+    if (hov.block !== null) {
+      const b = blocksOf(h)[hov.block];
+      if (b) return { fi: hov.fi, hi: hov.hi, scope: "blk", ords: b.ords, anchorRow: b.rows[0] };
+    }
+    return { fi: hov.fi, hi: hov.hi, scope: "hunk", ords: null, anchorRow: 0 };
+  }
+```
+
+`runAction` — clear the selection too, and label the selection scope. Change its last line from `hov = null;` to:
+
+```ts
+    hov = null;
+    sel = null;
+```
+
+The `measureTool` `$effect` must also track `sel`:
+
+```ts
+  $effect(() => {
+    hov;
+    sel;
+    measureTool();
+  });
+```
+
+And the `hunk-hover` outer ring must not draw while locked. In the `<tbody>`:
+
+```svelte
+                class:hunk-hover={hasActions && !sel && hov?.fi === fi && hov?.hi === hi}
+```
+
+- [ ] **Step 4: Swap the row handlers**
+
+On the unified `<tr>`, replace the old selection handlers:
+
+```svelte
+                      style={line.kind !== "context" ? "cursor: pointer" : ""}
+                      onclick={() => { if (ord !== undefined) toggleLine(fi, hi, ord); }}
+                      onkeydown={(e) => { if (ord !== undefined && (e.key === "Enter" || e.key === " ")) { e.preventDefault(); toggleLine(fi, hi, ord); } }}
+```
+
+with:
+
+```svelte
+                      style={hasActions && line.kind !== "context" ? "cursor: pointer" : ""}
+                      onclick={(e) => onRowClick(e, fi, hi, ri)}
+                      ondblclick={() => lockSelection(fi, hi, ri)}
+```
+
+Also delete the now-unused `class:selected={...}` attribute and the `{@const ord = ...}` line above the `<tr>`, plus the `{@const ords = hunkOrdinals(hunk)}` line that precedes the unified `{#each}`.
+
+- [ ] **Step 5: Add the Escape handler**
+
+Add near the top of the markup, before `<div class="diff-view">`:
+
+```svelte
+<svelte:window
+  onkeydown={(e) => {
+    if (e.key === "Escape" && sel) clearSelection();
+  }}
+/>
+```
+
+- [ ] **Step 6: Remove the hunk-header buttons**
+
+The floating toolbar supersedes them; leaving both would be two live paths to the same action. In **both** the split and unified branches of the hunk-header row, delete every `{#if onStageHunk || onUnstageHunk}` / `{#if selCount(fi, hi) > 0}` block and their buttons, leaving only:
+
+```svelte
+                    <td class="hunk-header-cell">
+                      <span class="hunk-range">{hunk.header}</span>
+                    </td>
+```
+
+(and the `colspan="4"` variant for split). The `.hunk-btn` CSS rules become dead — delete them too.
+
+- [ ] **Step 7: Remove the old selection CSS**
+
+Delete this block from `<style>`:
+
+```css
+  /* ── Line-level selection highlight ─────────────────────────────────────────── */
+  .diff-row.selected {
+    box-shadow: inset 2px 0 0 var(--accent);
+    background: color-mix(in srgb, var(--accent) 15%, transparent);
+  }
+  .split-cell.selected {
+    box-shadow: inset 2px 0 0 var(--accent);
+    background: color-mix(in srgb, var(--accent) 15%, transparent);
+  }
+```
+
+This is the rule that was invisible in NERV. Note `.diff-row.selected` also set `background`, which would have fought the new `box-shadow` ring on the same cells.
+
+- [ ] **Step 8: Verify types and tests**
+
+```bash
+npm run check && npm test
+```
+
+Expected: 0 errors (no references left to `toggleLine`, `selCount`, `applyLines`, `isSelected`, `hunkOrdinals`); all tests pass.
+
+- [ ] **Step 9: Verify by hand**
+
+```bash
+npm run tauri dev
+```
+
+1. Double-click a changed line → ring locks around that one line; toolbar reads `Stage 1` / `Discard 1` and stays put when the pointer moves away.
+2. Shift+click a line further down the same hunk → ring grows; count updates.
+3. Shift+click *above* the anchor → the range pivots around the original anchor.
+4. Extend across context rows → the ring covers them but the count only rises for changed lines.
+5. Move the pointer over another block → **nothing happens**; no second ring, no hunk outline.
+6. `Esc`, or a single click anywhere → selection clears and hover resumes.
+7. Double-click no longer leaves a blue word-selection behind.
+8. Switch to the NERV theme → the locked ring is clearly visible on both added and deleted lines.
+
+- [ ] **Step 10: Commit**
+
+```bash
+git add src/lib/components/DiffView.svelte
+git commit -m "feat: replace diff line selection with a contiguous range and ring"
+```
+
+---
+
+### Task 7: Split view support
+
+**Files:**
+- Modify: `src/lib/components/DiffView.svelte` — `SplitRow` interface and `toSplitRows` (`:250-310`), split-view markup (`:523-589`)
+
+**Interfaces:**
+- Consumes: everything from Tasks 4–6
+- Produces: `SplitRow` gains `rows: number[]` — the hunk line indices that split row represents (one for a context row, one or two for a paired change row)
+
+- [ ] **Step 1: Track hunk line indices in `toSplitRows`**
+
+A split row is a *pairing* of hunk lines, so its index is not a hunk line index. Everything in Tasks 4–6 speaks hunk line indices, so each split row must carry the ones it represents.
+
+Add to the `SplitRow` interface:
+
+```ts
+    /** Hunk line indices this row represents: 1 for context, 1-2 for a change pair. */
+    rows: number[];
+```
+
+In `toSplitRows`, the context branch becomes:
+
+```ts
+      if (line.kind === "context") {
+        rows.push({ oldLine: line, newLine: line, oldBeforeIdx: bi, oldAfterIdx: ai, newBeforeIdx: bi, newAfterIdx: ai, rows: [i] });
+        bi++;
+        ai++;
+        i++;
+        continue;
+      }
+```
+
+The change-run collection records each line's index:
+
+```ts
+      const dels: Array<{ line: DiffLine; bi: number; idx: number }> = [];
+      const adds: Array<{ line: DiffLine; ai: number; idx: number }> = [];
+
+      while (i < lines.length && (lines[i].kind === "del" || lines[i].kind === "add")) {
+        if (lines[i].kind === "del") {
+          dels.push({ line: lines[i], bi, idx: i });
+          bi++;
+        } else {
+          adds.push({ line: lines[i], ai, idx: i });
+          ai++;
+        }
+        i++;
+      }
+
+      const maxLen = Math.max(dels.length, adds.length);
+      for (let j = 0; j < maxLen; j++) {
+        const d = dels[j] ?? null;
+        const a = adds[j] ?? null;
+        rows.push({
+          oldLine: d?.line ?? null,
+          newLine: a?.line ?? null,
+          oldBeforeIdx: d?.bi ?? 0,
+          oldAfterIdx: 0,
+          newBeforeIdx: 0,
+          newAfterIdx: a?.ai ?? 0,
+          rows: [d?.idx, a?.idx].filter((x): x is number => x !== undefined),
+        });
+      }
+```
+
+- [ ] **Step 2: Apply ring classes and handlers to split rows**
+
+Replace the split `{#each}` opening and its `<tr>`:
+
+```svelte
+                  {#each toSplitRows(hunk) as row, ri (ri)}
+                    {@const oldOrd = row.oldLine?.kind === "del" ? ords.get(row.oldLine) : undefined}
+                    {@const newOrd = row.newLine?.kind === "add" ? ords.get(row.newLine) : undefined}
+                    <tr class="diff-row split-row">
+```
+
+with:
+
+```svelte
+                  {#each toSplitRows(hunk) as row, ri (ri)}
+                    {@const head = row.rows[0] ?? 0}
+                    <!-- svelte-ignore a11y_no_static_element_interactions -->
+                    <tr
+                      class="diff-row split-row"
+                      class:ring={ring !== null && row.rows.some((r) => r >= ring.from && r <= ring.to)}
+                      class:ring-first={ring !== null && row.rows.includes(ring.from)}
+                      class:ring-last={ring !== null && row.rows.includes(ring.to)}
+                      data-h={hi}
+                      data-i={head}
+                      style={hasActions && row.rows.length > 0 && (row.oldLine?.kind === "del" || row.newLine?.kind === "add") ? "cursor: pointer" : ""}
+                      onmouseenter={() => hoverRow(fi, hi, head)}
+                      onclick={(e) => onRowClick(e, fi, hi, head)}
+                      ondblclick={() => lockSelection(fi, hi, head)}
+                    >
+```
+
+A paired row selects as a unit — `head` is its first hunk line, and `lockSelection` anchors there. Selecting the addition without its deletion remains possible in Unified view.
+
+- [ ] **Step 3: Remove the old per-cell selection from split cells**
+
+On both split `<td class="diff-cell split-cell">` elements, delete these attributes:
+
+```svelte
+                        class:selected={oldOrd !== undefined && isSelected(fi, hi, oldOrd)}
+                        style={row.oldLine?.kind === "del" ? "cursor: pointer" : ""}
+                        onclick={() => { if (oldOrd !== undefined) toggleLine(fi, hi, oldOrd); }}
+                        onkeydown={(e) => { if (oldOrd !== undefined && (e.key === "Enter" || e.key === " ")) { e.preventDefault(); toggleLine(fi, hi, oldOrd); } }}
+```
+
+(and the `newOrd` equivalents on the new-side cell). Also delete the now-unused `{@const ords = hunkOrdinals(hunk)}` above the split `{#each}` and the two `svelte-ignore` comments that preceded the cells.
+
+- [ ] **Step 4: Make the ring reach the gutters in split view**
+
+The split table has four columns; `td:first-child` / `td:last-child` already resolve to the outer gutter and the new-side cell, so the ring spans the full row without extra CSS. Confirm no rule scopes the ring to `.diff-table:not(.split)`.
+
+- [ ] **Step 5: Verify types and tests**
+
+```bash
+npm run check && npm test
+```
+
+Expected: 0 errors; all tests pass.
+
+- [ ] **Step 6: Verify by hand**
+
+```bash
+npm run tauri dev
+```
+
+Switch the diff toolbar to **Split**, then:
+1. Hover a paired change row → ring spans **both** columns.
+2. Hover a context row → hunk outline only.
+3. Double-click + shift+click → range locks across paired rows; count matches the changed lines covered.
+4. `Stage N` / `Discard N` act on exactly those lines; flip to Unified and confirm the result.
+5. Column widths are unchanged from before this task (the `<colgroup>` still governs sizing under `<tbody>`-per-hunk).
+
+- [ ] **Step 7: Commit**
+
+```bash
+git add src/lib/components/DiffView.svelte
+git commit -m "feat: support hunk and block rings in split diff view"
+```
+
+---
+
+### Task 8: Keyboard parity and final gate
+
+**Files:**
+- Modify: `src/lib/components/DiffView.svelte` — focus handling on rows, arrow-key extension
+
+**Interfaces:**
+- Consumes: `hoverRow`, `lockSelection`, `extendSelection`, `clearSelection`, `hasActions` (Tasks 4–6)
+- Produces: nothing consumed downstream — this is the last task.
+
+- [ ] **Step 1: Make focus behave as hover**
+
+Task 6 removed the rows' `onkeydown`, which is what made the old selection keyboard-reachable. Restore parity for the new model. On the unified `<tr>` (and the split `<tr>`), add:
+
+```svelte
+                      tabindex={hasActions ? 0 : undefined}
+                      onfocus={() => hoverRow(fi, hi, ri)}
+                      onkeydown={(e) => onRowKeydown(e, fi, hi, ri)}
+```
+
+For the split `<tr>`, use `head` in place of `ri` in both handlers, matching Task 7.
+
+- [ ] **Step 2: Add the key handler**
+
+In the `<script>`, after `onRowClick`:
+
+```ts
+  function onRowKeydown(e: KeyboardEvent, fi: number, hi: number, ri: number) {
+    if (!hasActions) return;
+    if (e.key === "Enter" || e.key === " ") {
+      e.preventDefault();
+      lockSelection(fi, hi, ri);
+      return;
+    }
+    if (e.shiftKey && (e.key === "ArrowDown" || e.key === "ArrowUp") && sel) {
+      e.preventDefault();
+      const delta = e.key === "ArrowDown" ? 1 : -1;
+      const edge = sel.to === sel.anchor ? sel.from : sel.to;
+      const h = parsed.files[fi]?.hunks[hi];
+      if (!h) return;
+      const next = Math.max(0, Math.min(h.lines.length - 1, edge + delta));
+      extendSelection(fi, hi, next);
+    }
+  }
+```
+
+- [ ] **Step 3: Verify types and tests**
+
+```bash
+npm run check && npm test
+```
+
+Expected: 0 errors; all tests pass.
+
+- [ ] **Step 4: Run the full gate**
+
+```bash
+npm run check && npm test && cargo test
+```
+
+Expected: 0 type errors; all frontend tests pass; all Rust tests pass across `git-core`, `git-it`, and `git-it-agent`.
+
+- [ ] **Step 5: Final manual sweep**
+
+```bash
+npm run tauri dev
+```
+
+1. **Keyboard:** Tab into the diff → the focused row raises its ring and toolbar. `Enter` locks it. `Shift`+`↓` extends. `Esc` clears. Tab reaches the toolbar buttons while they are visible.
+2. **Themes:** Classic light, Classic dark, and NERV in **all six** schemes (orange, phosphor, steel, amber, violet, crimson). The ring must stay legible on both added and deleted rows. If crimson or phosphor collides, override `--diff-ring` in `src/lib/theme/nerv.css` using a bare `:root[data-theme="nerv"][data-scheme="crimson"]` selector — **never `:global()`**.
+3. **Inert hosts:** a commit diff and a PR Files diff show no rings, no toolbar, and no pointer cursor.
+4. **Untracked file:** no rings (no staging callbacks are passed).
+5. **Re-index safety:** discard a block, then immediately act on another block in the same file — the second op must hit the right lines, proving the refresh re-fetched the diff.
+
+- [ ] **Step 6: Commit**
+
+```bash
+git add src/lib/components/DiffView.svelte
+git commit -m "feat: add keyboard parity for diff ring selection"
+```
+
+---
+
+## Notes for the implementer
+
+- **Why four custom properties for one ring.** `box-shadow` does not merge across rules — a later `box-shadow` declaration replaces an earlier one entirely. Setting `--rt`/`--rb`/`--rl`/`--rr` from four *different* selectors and composing them in one `box-shadow` on `td` is what lets a top edge, a bottom edge, and two side edges coexist on the same cell. If you refactor this into direct `box-shadow` rules, the ring will silently lose edges.
+- **Why the toolbar sits outside the scroll container.** An absolutely-positioned child of an `overflow: auto` element is positioned against that element's padding box but *scrolls with its content*. Putting the toolbar in `.diff-table-outer` (which does not scroll) is what keeps `right: 14px` pinned to the visible edge on a horizontally scrolling diff.
+- **Hunk indices are live.** Every op re-indexes the remaining diff, which is why `runAction` clears both `hov` and `sel` and the `$effect` on `patch` clears `sel` again when the refresh lands. Do not cache hunk indices across an operation.
+- **`ordsInRange` is deliberately lossy about context.** A range that spans unchanged rows yields only the changed ordinals. The ring covering more rows than the count suggests is intended, not a bug.
diff --git a/docs/superpowers/specs/2026-08-06-diff-hunk-affordance-design.md b/docs/superpowers/specs/2026-08-06-diff-hunk-affordance-design.md
index 95295bc..862cf1a 100644
--- a/docs/superpowers/specs/2026-08-06-diff-hunk-affordance-design.md
+++ b/docs/superpowers/specs/2026-08-06-diff-hunk-affordance-design.md
@@ -122,21 +122,30 @@ export function ordsInRange(hunk: DiffHunk, from: number, to: number): number[]
 - Emit **one `<tbody class="hunk">` per hunk** instead of the single wrapping `<tbody>` at `:435`. This is the
   whole reason the hunk ring is free: a `<tbody>` is a real element and takes a CSS `outline`. A run of `<tr>`s
   is not, which is why the block ring cannot use the same mechanism.
-- Add **one overlay `<div class="diff-ring">` and one `<div class="diff-tools">`** inside `.diff-table-wrap`,
-  which gains `position: relative`. Both are positioned in JS from the first/last row of the target range.
-- `pointer-events: none` on the ring. The toolbar is interactive and must sit above the rows.
+- **The block/selection ring needs no JS.** `box-shadow` does not merge across CSS rules — a later declaration
+  replaces an earlier one wholesale — but *custom properties* do compose. Every `<td>` carries
+  `box-shadow: var(--rt,…), var(--rb,…), var(--rl,…), var(--rr,…)`, and four separate selectors
+  (`tr.ring-first td`, `tr.ring-last td`, `tr.ring td:first-child`, `tr.ring td:last-child`) each set one edge.
+  A ring around a run of `<tr>`s falls out with no measurement, no overlay, and no scroll listener.
+- **Only the toolbar needs JS**, and only for its vertical offset.
 
 **State:**
 ```ts
-let sel = $state<{ fi: number; hi: number; from: number; to: number } | null>(null);
+let sel = $state<{ fi: number; hi: number; anchor: number; from: number; to: number } | null>(null);
 let hov = $state<{ fi: number; hi: number; block: number | null } | null>(null);
 ```
-`sel` replaces `Map<string, Set<number>>` — contiguity makes a set unnecessary. The existing `$effect` that
-clears selection on `patch` change (`:213`) keeps working and stays.
-
-**Positioning:** the ring and toolbar are absolutely positioned against `.diff-table-wrap`, offset by both
-`scrollTop` **and `scrollLeft`** — the table is `width: max-content` and scrolls horizontally. A `scroll` listener
-on the wrap repaints. The prototype validated this approach including the horizontal case.
+`sel` replaces `Map<string, Set<number>>` — contiguity makes a set unnecessary. `anchor` is the row the range
+grew from, kept distinct from `from`/`to` so extending down and then back up pivots on the original
+double-clicked row rather than on whichever edge moved last. The existing `$effect` that clears selection on
+`patch` change (`:213`) keeps working and stays.
+
+**Toolbar positioning:** the toolbar is absolutely positioned inside a **new non-scrolling**
+`.diff-table-outer` that wraps `.diff-table-wrap`. This matters: an absolutely-positioned child of an
+`overflow: auto` element scrolls with its content, so a toolbar inside the wrap would drift sideways on a
+horizontally scrolling diff. From outside it, `right: 14px` stays pinned. Its vertical offset is measured as a
+`getBoundingClientRect()` difference against the wrap — already relative to the visible box, so `scrollTop`
+needs no separate arithmetic — and is recomputed on hover/selection change and on scroll. When the anchor row
+scrolls out of view the toolbar hides rather than floating.
 
 **Split view:** the ring spans the **full row width**, covering both columns. A paired row's change ordinals are
 the same set as in Unified, so `stage_lines` / `discard_lines` receive identical arguments in both modes and no

From 2a98f31312935c4b65cda098adffeb09cd8c6000 Mon Sep 17 00:00:00 2001
From: Ash Shah <494shah@gmail.com>
Date: Thu, 6 Aug 2026 18:19:08 -0700
Subject: [PATCH 03/41] feat: add pure block/ordinal helpers for diff hunks

---
 src/lib/diff/blocks.test.ts | 88 +++++++++++++++++++++++++++++++++++++
 src/lib/diff/blocks.ts      | 62 ++++++++++++++++++++++++++
 2 files changed, 150 insertions(+)
 create mode 100644 src/lib/diff/blocks.test.ts
 create mode 100644 src/lib/diff/blocks.ts

diff --git a/src/lib/diff/blocks.test.ts b/src/lib/diff/blocks.test.ts
new file mode 100644
index 0000000..24fd5c4
--- /dev/null
+++ b/src/lib/diff/blocks.test.ts
@@ -0,0 +1,88 @@
+import { describe, it, expect } from "vitest";
+import { blocksOf, ordinalsOf, blockAt, ordsInRange } from "./blocks";
+import type { DiffHunk, DiffLineKind } from "./types";
+
+/**
+ * Build a hunk from a compact spec string, one char per line:
+ * " " context, "+" add, "-" del.  e.g. "  -+  -++ "
+ */
+const hunk = (spec: string): DiffHunk => ({
+  header: "@@ -1,1 +1,1 @@",
+  lines: [...spec].map((ch, i) => ({
+    kind: (ch === "+" ? "add" : ch === "-" ? "del" : "context") as DiffLineKind,
+    text: `line${i}`,
+    oldNo: ch === "+" ? null : i,
+    newNo: ch === "-" ? null : i,
+  })),
+});
+
+// Two blocks: rows 2-3 (ords 0,1) and rows 6-8 (ords 2,3,4).
+const TWO_BLOCKS = hunk("  -+  -++ ");
+
+describe("ordinalsOf", () => {
+  it("numbers only changed lines, in order, leaving context null", () => {
+    expect(ordinalsOf(hunk("  -+ "))).toEqual([null, null, 0, 1, null]);
+  });
+
+  it("returns all-null for a hunk of pure context", () => {
+    expect(ordinalsOf(hunk("   "))).toEqual([null, null, null]);
+  });
+});
+
+describe("blocksOf", () => {
+  it("groups an adjacent del/add pair into ONE block", () => {
+    expect(blocksOf(hunk(" -+ "))).toEqual([{ rows: [1, 2], ords: [0, 1] }]);
+  });
+
+  it("splits blocks on context lines and keeps ordinals continuous across them", () => {
+    expect(blocksOf(TWO_BLOCKS)).toEqual([
+      { rows: [2, 3], ords: [0, 1] },
+      { rows: [6, 7, 8], ords: [2, 3, 4] },
+    ]);
+  });
+
+  it("handles blocks touching the first and last row of the hunk", () => {
+    expect(blocksOf(hunk("+  +"))).toEqual([
+      { rows: [0], ords: [0] },
+      { rows: [3], ords: [1] },
+    ]);
+  });
+
+  it("returns no blocks for a hunk of pure context", () => {
+    expect(blocksOf(hunk("   "))).toEqual([]);
+  });
+});
+
+describe("blockAt", () => {
+  it("returns the index of the block containing the row", () => {
+    expect(blockAt(TWO_BLOCKS, 3)).toBe(0);
+    expect(blockAt(TWO_BLOCKS, 7)).toBe(1);
+  });
+
+  it("returns null for a context row", () => {
+    expect(blockAt(TWO_BLOCKS, 5)).toBeNull();
+  });
+});
+
+describe("ordsInRange", () => {
+  it("collects only changed lines when the range spans context rows", () => {
+    // rows 2..8 covers both blocks AND the context rows 4,5 between them
+    expect(ordsInRange(TWO_BLOCKS, 2, 8)).toEqual([0, 1, 2, 3, 4]);
+  });
+
+  it("handles a single-row range", () => {
+    expect(ordsInRange(TWO_BLOCKS, 2, 2)).toEqual([0]);
+  });
+
+  it("normalizes a reversed range", () => {
+    expect(ordsInRange(TWO_BLOCKS, 8, 2)).toEqual([0, 1, 2, 3, 4]);
+  });
+
+  it("returns empty when the range covers only context", () => {
+    expect(ordsInRange(TWO_BLOCKS, 4, 5)).toEqual([]);
+  });
+
+  it("covers every ordinal when given the whole hunk", () => {
+    expect(ordsInRange(TWO_BLOCKS, 0, 9)).toEqual([0, 1, 2, 3, 4]);
+  });
+});
diff --git a/src/lib/diff/blocks.ts b/src/lib/diff/blocks.ts
new file mode 100644
index 0000000..d64d417
--- /dev/null
+++ b/src/lib/diff/blocks.ts
@@ -0,0 +1,62 @@
+import type { DiffHunk } from "./types";
+
+/** A contiguous run of changed (+/-) lines within one hunk. */
+export interface Block {
+  /** Indices into `hunk.lines`, ascending and contiguous. */
+  rows: number[];
+  /** The change-line ordinals for those rows — what the staging backend takes. */
+  ords: number[];
+}
+
+/**
+ * Per row of the hunk: its 0-based change-line ordinal, or null for a context row.
+ * Ordinals count ONLY +/- lines, in order — the vocabulary `stage_lines`,
+ * `unstage_lines` and `discard_lines` expect.
+ */
+export function ordinalsOf(hunk: DiffHunk): (number | null)[] {
+  let n = 0;
+  return hunk.lines.map((l) => (l.kind === "context" ? null : n++));
+}
+
+/** Contiguous runs of changed lines. A context line breaks a run. */
+export function blocksOf(hunk: DiffHunk): Block[] {
+  const out: Block[] = [];
+  let cur: Block | null = null;
+  let ord = 0;
+  for (let i = 0; i < hunk.lines.length; i++) {
+    if (hunk.lines[i].kind === "context") {
+      cur = null;
+      continue;
+    }
+    if (cur === null) {
+      cur = { rows: [], ords: [] };
+      out.push(cur);
+    }
+    cur.rows.push(i);
+    cur.ords.push(ord++);
+  }
+  return out;
+}
+
+/** Index of the block containing `row`, or null when `row` is a context line. */
+export function blockAt(hunk: DiffHunk, row: number): number | null {
+  const i = blocksOf(hunk).findIndex((b) => b.rows.includes(row));
+  return i === -1 ? null : i;
+}
+
+/**
+ * Change-line ordinals inside an inclusive row range (either order). Context rows
+ * inside the range are skipped, so a range may span unchanged rows and still be
+ * contiguous in the only sense the backend cares about.
+ */
+export function ordsInRange(hunk: DiffHunk, from: number, to: number): number[] {
+  const ords = ordinalsOf(hunk);
+  const lo = Math.min(from, to);
+  const hi = Math.max(from, to);
+  const out: number[] = [];
+  for (let i = lo; i <= hi; i++) {
+    const o = ords[i];
+    if (o !== null && o !== undefined) out.push(o);
+  }
+  return out;
+}

From 2a6144ab7f68497ed9572b5c00b3bd4a7888e3dd Mon Sep 17 00:00:00 2001
From: Ash Shah <494shah@gmail.com>
Date: Thu, 6 Aug 2026 18:24:43 -0700
Subject: [PATCH 04/41] feat: add hunk and line discard to the working-copy ops

---
 crates/git-core/src/ops_worktree.rs | 114 ++++++++++++++++++++++++++--
 1 file changed, 106 insertions(+), 8 deletions(-)

diff --git a/crates/git-core/src/ops_worktree.rs b/crates/git-core/src/ops_worktree.rs
index 0d8f5b1..9fe9832 100644
--- a/crates/git-core/src/ops_worktree.rs
+++ b/crates/git-core/src/ops_worktree.rs
@@ -259,11 +259,15 @@ pub fn split_hunks(diff: &str) -> (String, Vec<String>) {
     (header, hunks)
 }
 
-/// Pipe a patch (reconstructed from git's own diff output) to `git apply --cached [--reverse]`
-/// via stdin. Never uses a temp file or shell.
-fn git_apply(repo: &Path, patch: &str, reverse: bool) -> Result<(), String> {
+/// Pipe a patch (reconstructed from git's own diff output) to `git apply` via stdin.
+/// `cached` selects the target: true → `--cached` (the index, for stage/unstage),
+/// false → the WORKING TREE only (for discard). Never uses a temp file or shell.
+fn git_apply(repo: &Path, patch: &str, reverse: bool, cached: bool) -> Result<(), String> {
     let mut c = Command::new("git");
-    c.current_dir(repo).arg("apply").arg("--cached");
+    c.current_dir(repo).arg("apply");
+    if cached {
+        c.arg("--cached");
+    }
     if reverse {
         c.arg("--reverse");
     }
@@ -298,7 +302,7 @@ pub fn stage_hunk(repo: &Path, path: &str, hunk_index: usize, context: u32) -> R
     let d = diff(repo, Some(path), false, context)?;
     let (header, hunks) = split_hunks(&d);
     let h = hunks.get(hunk_index).ok_or("hunk index out of range")?;
-    git_apply(repo, &format!("{}{}", header, h), false)
+    git_apply(repo, &format!("{}{}", header, h), false, true)
 }
 
 /// Unstage one hunk (by index) of `path`'s STAGED diff.
@@ -312,7 +316,7 @@ pub fn unstage_hunk(repo: &Path, path: &str, hunk_index: usize, context: u32) ->
     let d = diff(repo, Some(path), true, context)?;
     let (header, hunks) = split_hunks(&d);
     let h = hunks.get(hunk_index).ok_or("hunk index out of range")?;
-    git_apply(repo, &format!("{}{}", header, h), true)
+    git_apply(repo, &format!("{}{}", header, h), true, true)
 }
 
 // ---------------------------------------------------------------------------
@@ -459,7 +463,7 @@ pub fn stage_lines(repo: &Path, path: &str, hunk_index: usize, selected: &[usize
     let h = hunks.get(hunk_index).ok_or("hunk index out of range")?;
     let set: std::collections::HashSet<usize> = selected.iter().copied().collect();
     let partial = build_partial_hunk(h, &set, false).ok_or("no lines selected to stage")?;
-    git_apply(repo, &format!("{}{}", header, partial), false)
+    git_apply(repo, &format!("{}{}", header, partial), false, true)
 }
 
 /// Unstage selected lines (change-line ordinals) of one hunk of `path`'s STAGED diff.
@@ -472,7 +476,35 @@ pub fn unstage_lines(repo: &Path, path: &str, hunk_index: usize, selected: &[usi
     let h = hunks.get(hunk_index).ok_or("hunk index out of range")?;
     let set: std::collections::HashSet<usize> = selected.iter().copied().collect();
     let partial = build_partial_hunk(h, &set, true).ok_or("no lines selected to unstage")?;
-    git_apply(repo, &format!("{}{}", header, partial), true)
+    git_apply(repo, &format!("{}{}", header, partial), true, true)
+}
+
+/// Discard one hunk (by index) of `path`'s UNSTAGED diff: reverse-apply it to the
+/// WORKING TREE only (no `--cached`). Because the unstaged diff's old side is the
+/// INDEX, the lines revert to their staged state — staged changes to the same file
+/// are untouched. DESTRUCTIVE / not undoable.
+///
+/// Hunk indices refer to the CURRENT live diff; after a successful op the remaining
+/// diff re-indexes, so callers must re-fetch before issuing another.
+pub fn discard_hunk(repo: &Path, path: &str, hunk_index: usize, context: u32) -> Result<(), String> {
+    let d = diff(repo, Some(path), false, context)?;
+    let (header, hunks) = split_hunks(&d);
+    let h = hunks.get(hunk_index).ok_or("hunk index out of range")?;
+    git_apply(repo, &format!("{}{}", header, h), true, false)
+}
+
+/// Discard selected change-line ordinals of one hunk of `path`'s UNSTAGED diff.
+/// `build_partial_hunk(.., reverse: true)` emits a patch whose NEW side matches the
+/// working file (unselected `+` become context because they ARE present there;
+/// unselected `-` are dropped because they are not) — exactly what a worktree
+/// reverse-apply needs. DESTRUCTIVE / not undoable.
+pub fn discard_lines(repo: &Path, path: &str, hunk_index: usize, selected: &[usize], context: u32) -> Result<(), String> {
+    let d = diff(repo, Some(path), false, context)?;
+    let (header, hunks) = split_hunks(&d);
+    let h = hunks.get(hunk_index).ok_or("hunk index out of range")?;
+    let set: std::collections::HashSet<usize> = selected.iter().copied().collect();
+    let partial = build_partial_hunk(h, &set, true).ok_or("no lines selected to discard")?;
+    git_apply(repo, &format!("{}{}", header, partial), true, false)
 }
 
 /// Stash current changes (staged + unstaged). Message is optional.
@@ -909,6 +941,72 @@ mod tests {
         assert!(unstaged.contains("+line3"), "line3 still unstaged");
     }
 
+    // ── discard (worktree reverse-apply) ─────────────────────────────────────
+
+    #[test]
+    fn discard_hunk_reverts_only_that_hunk() {
+        let r = TempRepo::new();
+        // 20 lines so two separated edits land in two hunks at -U3.
+        let base: String = (1..=20).map(|i| format!("line{}\n", i)).collect();
+        r.commit_file("f.txt", &base, "init");
+
+        let mut edited: Vec<String> = (1..=20).map(|i| format!("line{}\n", i)).collect();
+        edited[1] = "CHANGED2\n".to_string();
+        edited[17] = "CHANGED18\n".to_string();
+        r.write("f.txt", &edited.concat());
+
+        let d = diff(&r.path, Some("f.txt"), false, 3).unwrap();
+        let (_h, hunks) = split_hunks(&d);
+        assert_eq!(hunks.len(), 2, "expected two hunks, diff was:\n{}", d);
+
+        discard_hunk(&r.path, "f.txt", 0, 3).unwrap();
+
+        let now = fs::read_to_string(r.path.join("f.txt")).unwrap();
+        assert!(now.contains("line2\n"), "hunk 0 should be reverted");
+        assert!(!now.contains("CHANGED2"), "hunk 0's change should be gone");
+        assert!(now.contains("CHANGED18"), "hunk 1 must be untouched");
+    }
+
+    #[test]
+    fn discard_lines_reverts_only_selected() {
+        let r = TempRepo::new();
+        r.commit_file("f.txt", "base\n", "init");
+        r.write("f.txt", "base\nline1\nline2\nline3\n");
+        // ordinals 0,1,2 == +line1,+line2,+line3 — discard only line2.
+        discard_lines(&r.path, "f.txt", 0, &[1], 3).unwrap();
+        assert_eq!(
+            fs::read_to_string(r.path.join("f.txt")).unwrap(),
+            "base\nline1\nline3\n",
+            "only the selected line should be reverted"
+        );
+    }
+
+    /// The load-bearing one: discarding UNSTAGED lines reverts them to the INDEX
+    /// state, not to HEAD, so staged work on the same file survives. This is what
+    /// makes Discard safe to sit beside Stage.
+    #[test]
+    fn discard_lines_leaves_staged_changes_intact() {
+        let r = TempRepo::new();
+        r.commit_file("f.txt", "base\n", "init");
+        r.write("f.txt", "base\nkeep\ndrop\n");
+
+        // Stage only `keep` (ordinal 0); `drop` stays unstaged.
+        stage_lines(&r.path, "f.txt", 0, &[0], 3).unwrap();
+        let staged = diff(&r.path, Some("f.txt"), true, 3).unwrap();
+        assert!(staged.contains("+keep"), "precondition: keep must be staged");
+
+        // The unstaged diff now holds exactly one change line (`+drop`) at ordinal 0.
+        discard_lines(&r.path, "f.txt", 0, &[0], 3).unwrap();
+
+        assert_eq!(
+            fs::read_to_string(r.path.join("f.txt")).unwrap(),
+            "base\nkeep\n",
+            "drop reverted to the INDEX state, not HEAD"
+        );
+        let still = diff(&r.path, Some("f.txt"), true, 3).unwrap();
+        assert!(still.contains("+keep"), "staged work must survive the discard");
+    }
+
     #[test]
     fn working_changes_handles_space_in_path() {
         let r = TempRepo::new();

From 907a6c0a6c6cdaaeb489ff6626985a5cf8e6d9ca Mon Sep 17 00:00:00 2001
From: Ash Shah <494shah@gmail.com>
Date: Thu, 6 Aug 2026 18:32:24 -0700
Subject: [PATCH 05/41] feat: expose hunk and line discard to the frontend

---
 src-tauri/src/commands.rs | 10 +++++++++
 src-tauri/src/lib.rs      |  2 ++
 src/lib/api.ts            |  4 ++++
 src/lib/gitActions.ts     | 45 +++++++++++++++++++++++++++++++++++++++
 4 files changed, 61 insertions(+)

diff --git a/src-tauri/src/commands.rs b/src-tauri/src/commands.rs
index 97bbe89..b95a36d 100644
--- a/src-tauri/src/commands.rs
+++ b/src-tauri/src/commands.rs
@@ -462,6 +462,16 @@ pub fn unstage_lines(repo: String, path: String, hunk_index: usize, selected: Ve
     ops_worktree::unstage_lines(&PathBuf::from(repo), &path, hunk_index, &selected, context)
 }
 
+#[tauri::command]
+pub fn discard_hunk(repo: String, path: String, hunk_index: usize, context: u32) -> Result<(), String> {
+    ops_worktree::discard_hunk(&PathBuf::from(repo), &path, hunk_index, context)
+}
+
+#[tauri::command]
+pub fn discard_lines(repo: String, path: String, hunk_index: usize, selected: Vec<usize>, context: u32) -> Result<(), String> {
+    ops_worktree::discard_lines(&PathBuf::from(repo), &path, hunk_index, &selected, context)
+}
+
 #[tauri::command]
 pub fn stash_push(repo: String, message: Option<String>) -> Result<(), String> {
     ops_worktree::stash_push(&PathBuf::from(repo), message.as_deref())
diff --git a/src-tauri/src/lib.rs b/src-tauri/src/lib.rs
index 1a630e8..e414969 100644
--- a/src-tauri/src/lib.rs
+++ b/src-tauri/src/lib.rs
@@ -200,6 +200,8 @@ pub fn run() {
             commands::unstage_hunk,
             commands::stage_lines,
             commands::unstage_lines,
+            commands::discard_hunk,
+            commands::discard_lines,
             commands::stash_push,
             commands::stash_list,
             commands::stash_apply,
diff --git a/src/lib/api.ts b/src/lib/api.ts
index 7729629..2e48a38 100644
--- a/src/lib/api.ts
+++ b/src/lib/api.ts
@@ -198,6 +198,10 @@ export const api = {
     invoke<void>("stage_lines", { repo, path, hunkIndex, selected, context }),
   unstageLines: (repo: string, path: string, hunkIndex: number, selected: number[], context = 3) =>
     invoke<void>("unstage_lines", { repo, path, hunkIndex, selected, context }),
+  discardHunk: (repo: string, path: string, hunkIndex: number, context = 3) =>
+    invoke<void>("discard_hunk", { repo, path, hunkIndex, context }),
+  discardLines: (repo: string, path: string, hunkIndex: number, selected: number[], context = 3) =>
+    invoke<void>("discard_lines", { repo, path, hunkIndex, selected, context }),
   stashPush: (repo: string, message: string | null) =>
     invoke<void>("stash_push", { repo, message }),
   stashList: (repo: string) => invoke<StashEntry[]>("stash_list", { repo }),
diff --git a/src/lib/gitActions.ts b/src/lib/gitActions.ts
index 5440ea3..abda2e9 100644
--- a/src/lib/gitActions.ts
+++ b/src/lib/gitActions.ts
@@ -870,6 +870,51 @@ export const gitActions = {
     runWorktree(`Stage ${selected.length} line(s) in ${path}`, () => api.stageLines(appState.repo, path, hunkIndex, selected, appState.effectiveDiffContext)),
   unstageLines: (path: string, hunkIndex: number, selected: number[]) =>
     runWorktree(`Unstage ${selected.length} line(s) in ${path}`, () => api.unstageLines(appState.repo, path, hunkIndex, selected, appState.effectiveDiffContext)),
+  // Hunk/line discard is DESTRUCTIVE and NOT undoable — same reasoning as the
+  // file-level `discard` below: uncommitted work is not in the reflog, so there is
+  // no backup bundle to take. Guard BEFORE confirming so the browser preview never
+  // shows a dialog it cannot honour.
+  discardHunk: async (path: string, hunkIndex: number): Promise<boolean> => {
+    if (!isTauri()) {
+      appState.status = "That action needs the desktop app (not the browser preview).";
+      return false;
+    }
+    if (!appState.repo) {
+      appState.status = "Open a repository first.";
+      return false;
+    }
+    const confirmed = await dialogs.confirm({
+      title: "Discard hunk",
+      message: `Permanently discard this hunk of ${path}. This cannot be undone. (Stash instead to keep it.)`,
+      confirmLabel: "Discard",
+      danger: true,
+    });
+    if (!confirmed) return false;
+    return runWorktree(`Discard hunk in ${path}`, () =>
+      api.discardHunk(appState.repo, path, hunkIndex, appState.effectiveDiffContext),
+    );
+  },
+  discardLines: async (path: string, hunkIndex: number, selected: number[]): Promise<boolean> => {
+    if (!isTauri()) {
+      appState.status = "That action needs the desktop app (not the browser preview).";
+      return false;
+    }
+    if (!appState.repo) {
+      appState.status = "Open a repository first.";
+      return false;
+    }
+    const n = selected.length;
+    const confirmed = await dialogs.confirm({
+      title: "Discard lines",
+      message: `Permanently discard ${n} line${n === 1 ? "" : "s"} in ${path}. This cannot be undone. (Stash instead to keep them.)`,
+      confirmLabel: "Discard",
+      danger: true,
+    });
+    if (!confirmed) return false;
+    return runWorktree(`Discard ${n} line(s) in ${path}`, () =>
+      api.discardLines(appState.repo, path, hunkIndex, selected, appState.effectiveDiffContext),
+    );
+  },
   commitChanges: (message: string, signoff = false) =>
     runWorktree("Commit", () => api.commit(appState.repo, message, signoff)),
   // Seamless composer amend (Fork-style): folds the currently-staged changes into

From 93b5e27136bda91295246335099c0fb156e3f3fc Mon Sep 17 00:00:00 2001
From: Ash Shah <494shah@gmail.com>
Date: Thu, 6 Aug 2026 18:38:42 -0700
Subject: [PATCH 06/41] feat: add nested hunk and block hover rings to the diff
 view

---
 src/lib/components/DiffView.svelte | 79 +++++++++++++++++++++++++++---
 src/routes/+page.svelte            |  1 +
 2 files changed, 74 insertions(+), 6 deletions(-)

diff --git a/src/lib/components/DiffView.svelte b/src/lib/components/DiffView.svelte
index 39ff34d..796555c 100644
--- a/src/lib/components/DiffView.svelte
+++ b/src/lib/components/DiffView.svelte
@@ -1,6 +1,7 @@
 <script lang="ts">
   import { parseDiff } from "../diff/parse";
   import { getHighlighter, LANGS } from "../diff/highlight";
+  import { blocksOf, blockAt } from "../diff/blocks";
   import { appState } from "../store.svelte";
   import type { DiffFile, DiffHunk, DiffLine } from "../diff/types";
   import type { Highlighter, ThemedToken } from "shiki";
@@ -15,6 +16,8 @@
     onUnstageHunk?: (i: number) => void;
     onStageLines?: (hunkIndex: number, selected: number[]) => void;
     onUnstageLines?: (hunkIndex: number, selected: number[]) => void;
+    onDiscardHunk?: (i: number) => void;
+    onDiscardLines?: (hunkIndex: number, selected: number[]) => void;
     // PR-review comment affordance (GitHub line/side semantics: RIGHT = new-file
     // line number for context + added rows, LEFT = old-file line number for
     // deleted rows). Purely additive — when absent, nothing changes.
@@ -22,7 +25,41 @@
     hasComment?: (line: number, side: "LEFT" | "RIGHT") => boolean;
   }
 
-  let { patch, language, staged = false, onStageHunk, onUnstageHunk, onStageLines, onUnstageLines, onLineComment, hasComment }: Props = $props();
+  let { patch, language, staged = false, onStageHunk, onUnstageHunk, onStageLines, onUnstageLines, onDiscardHunk, onDiscardLines, onLineComment, hasComment }: Props = $props();
+
+  // The whole hover/selection affordance only exists where actions do. Commit diffs
+  // (CommitFilesDiff) and PR review diffs (PrFilesTab) pass no callbacks and stay inert.
+  const hasActions = $derived(
+    !!(onStageHunk || onUnstageHunk || onStageLines || onUnstageLines || onDiscardHunk || onDiscardLines),
+  );
+
+  // Hovered unit. `block` is the index into blocksOf(hunk), or null on a context row
+  // (which targets the whole hunk instead).
+  let hov = $state<{ fi: number; hi: number; block: number | null } | null>(null);
+
+  function hoverRow(fi: number, hi: number, ri: number) {
+    if (!hasActions) return;
+    const h = parsed.files[fi]?.hunks[hi];
+    if (!h) return;
+    hov = { fi, hi, block: blockAt(h, ri) };
+  }
+
+  function clearHover() {
+    hov = null;
+  }
+
+  /**
+   * The row range the inner ring should cover for this hunk, or null for none.
+   * Only a hovered BLOCK gets the inner ring; a hovered context row gets the
+   * outer `<tbody>` outline instead (see the `hunk-hover` class).
+   */
+  function ringRange(fi: number, hi: number): { from: number; to: number } | null {
+    if (!hov || hov.fi !== fi || hov.hi !== hi || hov.block === null) return null;
+    const h = parsed.files[fi]?.hunks[hi];
+    if (!h) return null;
+    const b = blocksOf(h)[hov.block];
+    return b ? { from: b.rows[0], to: b.rows[b.rows.length - 1] } : null;
+  }
 
   // ─── Theme detection ──────────────────────────────────────────────────────────
 
@@ -432,8 +469,13 @@
                 <col class="dt-side" />
               </colgroup>
             {/if}
-            <tbody>
-              {#each file.hunks as hunk, hi (hi)}
+            {#each file.hunks as hunk, hi (hi)}
+              {@const ring = ringRange(fi, hi)}
+              <tbody
+                class="hunk"
+                class:hunk-hover={hasActions && hov?.fi === fi && hov?.hi === hi}
+                onmouseleave={clearHover}
+              >
                 <!-- Hunk header row -->
                 <tr class="hunk-header-row">
                   {#if appState.diffSplit}
@@ -483,13 +525,17 @@
                 {#if !appState.diffSplit}
                   <!-- ── UNIFIED view ── -->
                   {@const ords = hunkOrdinals(hunk)}
-                  {#each indexHunkLines(hunk) as { line, beforeIdx, afterIdx } (line.oldNo ?? `a${line.newNo}`)}
+                  {#each indexHunkLines(hunk) as { line, beforeIdx, afterIdx }, ri (ri)}
                     {@const toks = lineTokens(fi, hi, line, beforeIdx, afterIdx)}
                     {@const ord = line.kind !== "context" ? ords.get(line) : undefined}
                     <!-- svelte-ignore a11y_no_static_element_interactions -->
                     <tr
                       class="diff-row {line.kind}"
                       class:selected={ord !== undefined && isSelected(fi, hi, ord)}
+                      class:ring={ring !== null && ri >= ring.from && ri <= ring.to}
+                      class:ring-first={ring !== null && ri === ring.from}
+                      class:ring-last={ring !== null && ri === ring.to}
+                      onmouseenter={() => hoverRow(fi, hi, ri)}
                       style={line.kind !== "context" ? "cursor: pointer" : ""}
                       onclick={() => { if (ord !== undefined) toggleLine(fi, hi, ord); }}
                       onkeydown={(e) => { if (ord !== undefined && (e.key === "Enter" || e.key === " ")) { e.preventDefault(); toggleLine(fi, hi, ord); } }}
@@ -588,8 +634,8 @@
                     </tr>
                   {/each}
                 {/if}
-              {/each}
-            </tbody>
+              </tbody>
+            {/each}
           </table>
         </div>
       {/if}
@@ -756,6 +802,27 @@
     background: var(--header-bg);
   }
 
+  /* ── Hover / selection ring ──────────────────────────────────────────────────
+     A hunk is a <tbody> and takes a plain outline. A BLOCK is only a run of <tr>s
+     with no wrapping element, so its ring is built from four box-shadow insets
+     spread across the run's cells. They must be four SEPARATE custom properties
+     feeding one box-shadow: written as four rules on `box-shadow` directly, the
+     last would simply win. As custom properties they compose. */
+  .diff-table td {
+    box-shadow: var(--rt, 0 0 transparent), var(--rb, 0 0 transparent),
+                var(--rl, 0 0 transparent), var(--rr, 0 0 transparent);
+  }
+  tr.ring-first td { --rt: inset 0 1.5px 0 var(--diff-ring); }
+  tr.ring-last td { --rb: inset 0 -1.5px 0 var(--diff-ring); }
+  tr.ring td:first-child { --rl: inset 1.5px 0 0 var(--diff-ring); }
+  tr.ring td:last-child { --rr: inset -1.5px 0 0 var(--diff-ring); }
+
+  /* Outer ring — subtler than the block ring, and drawn on the hunk's own element. */
+  tbody.hunk.hunk-hover {
+    outline: 1px solid color-mix(in srgb, var(--diff-ring) 34%, transparent);
+    outline-offset: -1px;
+  }
+
   /* ── Diff rows ─────────────────────────────────────────────────────────────── */
 
   .diff-cell {
diff --git a/src/routes/+page.svelte b/src/routes/+page.svelte
index e57db74..6fd0b5e 100644
--- a/src/routes/+page.svelte
+++ b/src/routes/+page.svelte
@@ -668,6 +668,7 @@
     --diff-add-bg: rgba(46, 160, 67, 0.18);      --diff-del-bg: rgba(210, 35, 35, 0.18);
     --diff-add-bg-dark: rgba(46, 160, 67, 0.24); --diff-del-bg-dark: rgba(210, 35, 35, 0.24);
     --diff-add-fg: #2da44e;                      --diff-del-fg: #cf222e;
+    --diff-ring: var(--accent);
     /* File-status glyph colours (A/M/D…), keyed by what the change MEANS:
        add = green, modify = yellow/amber (a legible gold on white), remove = red. */
     --status-add: #2da44e;

From 6020aa03bedf9f906622a69a529915c9e0be6009 Mon Sep 17 00:00:00 2001
From: Ash Shah <494shah@gmail.com>
Date: Thu, 6 Aug 2026 18:49:43 -0700
Subject: [PATCH 07/41] feat: add floating stage/discard toolbar to the diff
 view

---
 src/lib/components/DiffView.svelte        | 152 +++++++++++++++++++++-
 src/lib/components/WorkingCopyView.svelte |   6 +
 2 files changed, 157 insertions(+), 1 deletion(-)

diff --git a/src/lib/components/DiffView.svelte b/src/lib/components/DiffView.svelte
index 796555c..411d24e 100644
--- a/src/lib/components/DiffView.svelte
+++ b/src/lib/components/DiffView.svelte
@@ -61,6 +61,82 @@
     return b ? { from: b.rows[0], to: b.rows[b.rows.length - 1] } : null;
   }
 
+  interface ActionTarget {
+    fi: number;
+    hi: number;
+    scope: "sel" | "blk" | "hunk";
+    /** null for a whole-hunk target — the hunk ops take no ordinals. */
+    ords: number[] | null;
+    /** Row the toolbar anchors to. */
+    anchorRow: number;
+  }
+
+  /** What the visible toolbar acts on right now. Task 6 adds the selection branch. */
+  function activeTarget(): ActionTarget | null {
+    if (!hasActions || !hov) return null;
+    const h = parsed.files[hov.fi]?.hunks[hov.hi];
+    if (!h) return null;
+    if (hov.block !== null) {
+      const b = blocksOf(h)[hov.block];
+      if (b) return { fi: hov.fi, hi: hov.hi, scope: "blk", ords: b.ords, anchorRow: b.rows[0] };
+    }
+    return { fi: hov.fi, hi: hov.hi, scope: "hunk", ords: null, anchorRow: 0 };
+  }
+
+  function runAction(kind: "stage" | "unstage" | "discard") {
+    const t = activeTarget();
+    if (!t) return;
+    if (t.scope === "hunk") {
+      if (kind === "stage") onStageHunk?.(t.hi);
+      else if (kind === "unstage") onUnstageHunk?.(t.hi);
+      else onDiscardHunk?.(t.hi);
+    } else {
+      const ords = t.ords ?? [];
+      if (!ords.length) return;
+      if (kind === "stage") onStageLines?.(t.hi, ords);
+      else if (kind === "unstage") onUnstageLines?.(t.hi, ords);
+      else onDiscardLines?.(t.hi, ords);
+    }
+    hov = null;
+  }
+
+  // The toolbar lives OUTSIDE the horizontally-scrolling table wrap so `right` pins
+  // it to the visible edge. Only its vertical offset needs measuring, and using
+  // getBoundingClientRect differences means scrollTop needs no separate arithmetic.
+  let wrapEls = $state<Record<number, HTMLDivElement | undefined>>({});
+  let toolTop = $state(0);
+  let toolVisible = $state(false);
+
+  function measureTool() {
+    const t = activeTarget();
+    const wrap = t ? wrapEls[t.fi] : undefined;
+    if (!t || !wrap) {
+      toolVisible = false;
+      return;
+    }
+    const row = wrap.querySelector<HTMLElement>(
+      `tr[data-h="${t.hi}"][data-i="${t.anchorRow}"]`,
+    );
+    if (!row) {
+      toolVisible = false;
+      return;
+    }
+    const top = row.getBoundingClientRect().top - wrap.getBoundingClientRect().top;
+    // Hide rather than float a toolbar pointing at a row scrolled out of view.
+    if (top < 0 || top > wrap.clientHeight - 8) {
+      toolVisible = false;
+      return;
+    }
+    toolTop = top;
+    toolVisible = true;
+  }
+
+  // Runs after the DOM settles, so the anchor row is guaranteed to exist.
+  $effect(() => {
+    hov;
+    measureTool();
+  });
+
   // ─── Theme detection ──────────────────────────────────────────────────────────
 
   function prefersDark(): boolean {
@@ -455,7 +531,12 @@
       {:else if file.hunks.length === 0}
         <div class="empty-hunk">No textual changes.</div>
       {:else}
-        <div class="diff-table-wrap">
+        <div class="diff-table-outer">
+        <div
+          class="diff-table-wrap"
+          bind:this={wrapEls[fi]}
+          onscroll={measureTool}
+        >
           <table class="diff-table mono" class:split={appState.diffSplit}>
             {#if appState.diffSplit}
               <!-- Fixed column widths. Without this, the colspan hunk-header row is the
@@ -530,6 +611,8 @@
                     {@const ord = line.kind !== "context" ? ords.get(line) : undefined}
                     <!-- svelte-ignore a11y_no_static_element_interactions -->
                     <tr
+                      data-h={hi}
+                      data-i={ri}
                       class="diff-row {line.kind}"
                       class:selected={ord !== undefined && isSelected(fi, hi, ord)}
                       class:ring={ring !== null && ri >= ring.from && ri <= ring.to}
@@ -638,6 +721,24 @@
             {/each}
           </table>
         </div>
+        {#if hasActions && toolVisible}
+          {@const t = activeTarget()}
+          {#if t && t.fi === fi}
+            {@const label = t.scope === "hunk" ? "hunk" : String((t.ords ?? []).length)}
+            <div class="diff-tools" style="top: {toolTop}px">
+              {#if !staged && onStageHunk}
+                <button onclick={() => runAction("stage")}>Stage {label}</button>
+              {/if}
+              {#if !staged && onDiscardHunk}
+                <button class="danger" onclick={() => runAction("discard")}>Discard {label}</button>
+              {/if}
+              {#if staged && onUnstageHunk}
+                <button onclick={() => runAction("unstage")}>Unstage {label}</button>
+              {/if}
+            </div>
+          {/if}
+        {/if}
+        </div>
       {/if}
     {/each}
   {/if}
@@ -764,9 +865,58 @@
   }
 
   /* ── Diff table ─────────────────────────────────────────────────────────────── */
+
+  /* Positioning context for the floating toolbar. It must NOT be the scroll
+     container: an absolutely-positioned child of a scroller is laid out against
+     the content, so `right` would drift as the diff scrolls sideways. */
+  .diff-table-outer {
+    position: relative;
+    display: flex;
+    flex: 1 1 auto;
+    min-height: 0;
+  }
+
   .diff-table-wrap {
     overflow: auto;
     flex: 1 1 auto;
+    min-width: 0;
+  }
+
+  .diff-tools {
+    position: absolute;
+    right: 14px;
+    z-index: 6;
+    display: flex;
+    gap: 4px;
+    padding: 3px;
+    background: var(--header-bg);
+    border: 1px solid var(--border);
+    border-radius: var(--radius-sm);
+  }
+  .diff-tools button {
+    padding: 2px 8px;
+    border-radius: var(--radius-sm);
+    border: 1px solid var(--accent);
+    background: var(--btn-bg);
+    color: var(--accent);
+    font-family: var(--font-mono);
+    font-size: 10px;
+    letter-spacing: 0.05em;
+    text-transform: uppercase;
+    white-space: nowrap;
+    cursor: pointer;
+  }
+  .diff-tools button:hover {
+    background: var(--accent);
+    color: var(--on-accent);
+  }
+  .diff-tools button.danger {
+    border-color: var(--danger);
+    color: var(--danger);
+  }
+  .diff-tools button.danger:hover {
+    background: var(--danger);
+    color: var(--on-accent);
   }
 
   .diff-table {
diff --git a/src/lib/components/WorkingCopyView.svelte b/src/lib/components/WorkingCopyView.svelte
index 2596ba4..c380865 100644
--- a/src/lib/components/WorkingCopyView.svelte
+++ b/src/lib/components/WorkingCopyView.svelte
@@ -561,6 +561,12 @@
             onUnstageLines={selectedIsStaged
               ? (hi, sel) => gitActions.unstageLines(selectedFile!, hi, sel)
               : undefined}
+            onDiscardHunk={selectedIsStaged || selectedIsUntracked
+              ? undefined
+              : (i) => gitActions.discardHunk(selectedFile!, i)}
+            onDiscardLines={selectedIsStaged || selectedIsUntracked
+              ? undefined
+              : (hi, sel) => gitActions.discardLines(selectedFile!, hi, sel)}
           />
         {/if}
       </div>

From b4abb4c554a9ac74cf4438bba7ad8be82ef8919c Mon Sep 17 00:00:00 2001
From: Ash Shah <494shah@gmail.com>
Date: Thu, 6 Aug 2026 18:52:35 -0700
Subject: [PATCH 08/41] fix: keep the diff toolbar reachable by clearing hover
 on the outer wrapper

---
 src/lib/components/DiffView.svelte | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/lib/components/DiffView.svelte b/src/lib/components/DiffView.svelte
index 411d24e..c4dc014 100644
--- a/src/lib/components/DiffView.svelte
+++ b/src/lib/components/DiffView.svelte
@@ -531,7 +531,8 @@
       {:else if file.hunks.length === 0}
         <div class="empty-hunk">No textual changes.</div>
       {:else}
-        <div class="diff-table-outer">
+        <!-- svelte-ignore a11y_no_static_element_interactions -->
+        <div class="diff-table-outer" onmouseleave={clearHover}>
         <div
           class="diff-table-wrap"
           bind:this={wrapEls[fi]}
@@ -555,7 +556,6 @@
               <tbody
                 class="hunk"
                 class:hunk-hover={hasActions && hov?.fi === fi && hov?.hi === hi}
-                onmouseleave={clearHover}
               >
                 <!-- Hunk header row -->
                 <tr class="hunk-header-row">

From f1419ffa2a917689bf9a015f86fdc4fe08276965 Mon Sep 17 00:00:00 2001
From: Ash Shah <494shah@gmail.com>
Date: Thu, 6 Aug 2026 19:04:36 -0700
Subject: [PATCH 09/41] feat: replace diff line selection with a contiguous
 range and ring

---
 src/lib/components/DiffView.svelte | 188 ++++++++++-------------------
 1 file changed, 67 insertions(+), 121 deletions(-)

diff --git a/src/lib/components/DiffView.svelte b/src/lib/components/DiffView.svelte
index c4dc014..717b74a 100644
--- a/src/lib/components/DiffView.svelte
+++ b/src/lib/components/DiffView.svelte
@@ -1,7 +1,7 @@
 <script lang="ts">
   import { parseDiff } from "../diff/parse";
   import { getHighlighter, LANGS } from "../diff/highlight";
-  import { blocksOf, blockAt } from "../diff/blocks";
+  import { blocksOf, blockAt, ordsInRange } from "../diff/blocks";
   import { appState } from "../store.svelte";
   import type { DiffFile, DiffHunk, DiffLine } from "../diff/types";
   import type { Highlighter, ThemedToken } from "shiki";
@@ -38,22 +38,26 @@
   let hov = $state<{ fi: number; hi: number; block: number | null } | null>(null);
 
   function hoverRow(fi: number, hi: number, ri: number) {
-    if (!hasActions) return;
+    if (!hasActions || sel) return; // locked: hover is dead
     const h = parsed.files[fi]?.hunks[hi];
     if (!h) return;
     hov = { fi, hi, block: blockAt(h, ri) };
   }
 
   function clearHover() {
+    if (sel) return;
     hov = null;
   }
 
   /**
-   * The row range the inner ring should cover for this hunk, or null for none.
-   * Only a hovered BLOCK gets the inner ring; a hovered context row gets the
-   * outer `<tbody>` outline instead (see the `hunk-hover` class).
+   * The row range the ring should cover for this hunk, or null for none. A locked
+   * selection owns the ring outright; otherwise only a hovered BLOCK gets it and a
+   * hovered context row gets the outer `<tbody>` outline instead (`hunk-hover`).
    */
   function ringRange(fi: number, hi: number): { from: number; to: number } | null {
+    if (sel) {
+      return sel.fi === fi && sel.hi === hi ? { from: sel.from, to: sel.to } : null;
+    }
     if (!hov || hov.fi !== fi || hov.hi !== hi || hov.block === null) return null;
     const h = parsed.files[fi]?.hunks[hi];
     if (!h) return null;
@@ -71,9 +75,18 @@
     anchorRow: number;
   }
 
-  /** What the visible toolbar acts on right now. Task 6 adds the selection branch. */
+  /** What the visible toolbar acts on right now. A locked selection outranks hover. */
   function activeTarget(): ActionTarget | null {
-    if (!hasActions || !hov) return null;
+    if (!hasActions) return null;
+    if (sel) {
+      const h = parsed.files[sel.fi]?.hunks[sel.hi];
+      if (!h) return null;
+      const ords = ordsInRange(h, sel.from, sel.to);
+      return ords.length
+        ? { fi: sel.fi, hi: sel.hi, scope: "sel", ords, anchorRow: sel.from }
+        : null;
+    }
+    if (!hov) return null;
     const h = parsed.files[hov.fi]?.hunks[hov.hi];
     if (!h) return null;
     if (hov.block !== null) {
@@ -98,6 +111,7 @@
       else onDiscardLines?.(t.hi, ords);
     }
     hov = null;
+    sel = null;
   }
 
   // The toolbar lives OUTSIDE the horizontally-scrolling table wrap so `right` pins
@@ -134,6 +148,7 @@
   // Runs after the DOM settles, so the anchor row is guaranteed to exist.
   $effect(() => {
     hov;
+    sel;
     measureTool();
   });
 
@@ -317,45 +332,52 @@
     });
   }
 
-  // ─── Line-level selection ─────────────────────────────────────────────────────
+  // ─── Line selection ───────────────────────────────────────────────────────────
+  // A contiguous row range inside ONE hunk. `anchor` is the row the range grew
+  // from, so extending down and then back up pivots correctly. Ranges may span
+  // context rows; `ordsInRange` keeps only the change lines.
+  let sel = $state<{ fi: number; hi: number; anchor: number; from: number; to: number } | null>(null);
 
-  // Map keyed by "${fi}:${hi}" → Set of change-line ordinals (0-based among +/- lines).
-  let selected = $state<Map<string, Set<number>>>(new Map());
-
-  // Clear selection whenever the patch changes (file/diff switch).
+  // A new patch re-indexes every hunk, so any range we were holding is meaningless.
   $effect(() => {
     // eslint-disable-next-line @typescript-eslint/no-unused-expressions
     patch;
-    selected = new Map();
+    sel = null;
   });
 
-  /** Map each +/- line of a hunk to its 0-based change ordinal (context lines excluded). */
-  function hunkOrdinals(hunk: DiffHunk): Map<DiffLine, number> {
-    const m = new Map<DiffLine, number>();
-    let ord = 0;
-    for (const line of hunk.lines) if (line.kind !== "context") m.set(line, ord++);
-    return m;
+  function lockSelection(fi: number, hi: number, ri: number) {
+    if (!hasActions) return;
+    const h = parsed.files[fi]?.hunks[hi];
+    if (!h || h.lines[ri]?.kind === "context") return;
+    sel = { fi, hi, anchor: ri, from: ri, to: ri };
+    hov = null;
+    // A double-click is also the browser's select-word gesture, and `.diff-cell`
+    // deliberately opts back into user-select so diff code stays copyable.
+    window.getSelection()?.removeAllRanges();
   }
 
-  function keyOf(fi: number, hi: number) { return `${fi}:${hi}`; }
-  function isSelected(fi: number, hi: number, ord: number) { return selected.get(keyOf(fi, hi))?.has(ord) ?? false; }
-
-  function toggleLine(fi: number, hi: number, ord: number) {
-    const k = keyOf(fi, hi);
-    const next = new Map(selected);
-    const s = new Set(next.get(k) ?? []);
-    if (s.has(ord)) s.delete(ord); else s.add(ord);
-    if (s.size) next.set(k, s); else next.delete(k);
-    selected = next;
+  function extendSelection(fi: number, hi: number, ri: number) {
+    if (!sel || sel.fi !== fi || sel.hi !== hi) return;
+    const h = parsed.files[fi]?.hunks[hi];
+    if (!h) return;
+    const from = Math.min(sel.anchor, ri);
+    const to = Math.max(sel.anchor, ri);
+    if (!ordsInRange(h, from, to).length) return;
+    sel = { fi, hi, anchor: sel.anchor, from, to };
+    window.getSelection()?.removeAllRanges();
   }
 
-  function selCount(fi: number, hi: number) { return selected.get(keyOf(fi, hi))?.size ?? 0; }
+  function clearSelection() {
+    sel = null;
+  }
 
-  function applyLines(fi: number, hi: number) {
-    const ords = [...(selected.get(keyOf(fi, hi)) ?? [])].sort((a, b) => a - b);
-    if (!ords.length) return;
-    if (staged) onUnstageLines?.(hi, ords); else onStageLines?.(hi, ords);
-    const next = new Map(selected); next.delete(keyOf(fi, hi)); selected = next;
+  function onRowClick(e: MouseEvent, fi: number, hi: number, ri: number) {
+    if (!hasActions) return;
+    if (e.shiftKey) {
+      extendSelection(fi, hi, ri);
+      return;
+    }
+    clearSelection();
   }
 
   // ─── Split view helpers ───────────────────────────────────────────────────────
@@ -461,6 +483,12 @@
   >{marked ? "💬" : "＋"}</button>
 {/snippet}
 
+<svelte:window
+  onkeydown={(e) => {
+    if (e.key === "Escape" && sel) clearSelection();
+  }}
+/>
+
 <div class="diff-view">
   <!-- Header: split/unified toggle + totals + context controls -->
   <div class="diff-toolbar">
@@ -555,73 +583,38 @@
               {@const ring = ringRange(fi, hi)}
               <tbody
                 class="hunk"
-                class:hunk-hover={hasActions && hov?.fi === fi && hov?.hi === hi}
+                class:hunk-hover={hasActions && !sel && hov?.fi === fi && hov?.hi === hi}
               >
                 <!-- Hunk header row -->
                 <tr class="hunk-header-row">
                   {#if appState.diffSplit}
                     <td class="hunk-header-cell" colspan="4">
                       <span class="hunk-range">{hunk.header}</span>
-                      {#if onStageHunk || onUnstageHunk}
-                        {#if onStageHunk && !staged}
-                          <button class="hunk-btn" onclick={() => onStageHunk!(hi)}>Stage hunk</button>
-                        {/if}
-                        {#if onUnstageHunk && staged}
-                          <button class="hunk-btn" onclick={() => onUnstageHunk!(hi)}>Unstage hunk</button>
-                        {/if}
-                      {/if}
-                      {#if selCount(fi, hi) > 0}
-                        {#if !staged && onStageLines}
-                          <button class="hunk-btn primary" onclick={() => applyLines(fi, hi)}>Stage {selCount(fi, hi)} line(s)</button>
-                        {/if}
-                        {#if staged && onUnstageLines}
-                          <button class="hunk-btn primary" onclick={() => applyLines(fi, hi)}>Unstage {selCount(fi, hi)} line(s)</button>
-                        {/if}
-                      {/if}
                     </td>
                   {:else}
                     <td class="gutter" colspan="2"></td>
                     <td class="hunk-header-cell">
                       <span class="hunk-range">{hunk.header}</span>
-                      {#if onStageHunk || onUnstageHunk}
-                        {#if onStageHunk && !staged}
-                          <button class="hunk-btn" onclick={() => onStageHunk!(hi)}>Stage hunk</button>
-                        {/if}
-                        {#if onUnstageHunk && staged}
-                          <button class="hunk-btn" onclick={() => onUnstageHunk!(hi)}>Unstage hunk</button>
-                        {/if}
-                      {/if}
-                      {#if selCount(fi, hi) > 0}
-                        {#if !staged && onStageLines}
-                          <button class="hunk-btn primary" onclick={() => applyLines(fi, hi)}>Stage {selCount(fi, hi)} line(s)</button>
-                        {/if}
-                        {#if staged && onUnstageLines}
-                          <button class="hunk-btn primary" onclick={() => applyLines(fi, hi)}>Unstage {selCount(fi, hi)} line(s)</button>
-                        {/if}
-                      {/if}
                     </td>
                   {/if}
                 </tr>
 
                 {#if !appState.diffSplit}
                   <!-- ── UNIFIED view ── -->
-                  {@const ords = hunkOrdinals(hunk)}
                   {#each indexHunkLines(hunk) as { line, beforeIdx, afterIdx }, ri (ri)}
                     {@const toks = lineTokens(fi, hi, line, beforeIdx, afterIdx)}
-                    {@const ord = line.kind !== "context" ? ords.get(line) : undefined}
                     <!-- svelte-ignore a11y_no_static_element_interactions -->
                     <tr
                       data-h={hi}
                       data-i={ri}
                       class="diff-row {line.kind}"
-                      class:selected={ord !== undefined && isSelected(fi, hi, ord)}
                       class:ring={ring !== null && ri >= ring.from && ri <= ring.to}
                       class:ring-first={ring !== null && ri === ring.from}
                       class:ring-last={ring !== null && ri === ring.to}
                       onmouseenter={() => hoverRow(fi, hi, ri)}
-                      style={line.kind !== "context" ? "cursor: pointer" : ""}
-                      onclick={() => { if (ord !== undefined) toggleLine(fi, hi, ord); }}
-                      onkeydown={(e) => { if (ord !== undefined && (e.key === "Enter" || e.key === " ")) { e.preventDefault(); toggleLine(fi, hi, ord); } }}
+                      style={hasActions && line.kind !== "context" ? "cursor: pointer" : ""}
+                      onclick={(e) => onRowClick(e, fi, hi, ri)}
+                      ondblclick={() => lockSelection(fi, hi, ri)}
                     >
                       <td class="gutter old-gutter" class:commentable={!!onLineComment}>
                         {line.oldNo ?? ""}
@@ -648,10 +641,7 @@
                   {/each}
                 {:else}
                   <!-- ── SPLIT view ── -->
-                  {@const ords = hunkOrdinals(hunk)}
                   {#each toSplitRows(hunk) as row, ri (ri)}
-                    {@const oldOrd = row.oldLine?.kind === "del" ? ords.get(row.oldLine) : undefined}
-                    {@const newOrd = row.newLine?.kind === "add" ? ords.get(row.newLine) : undefined}
                     <tr class="diff-row split-row">
                       <!-- Old side -->
                       <td class="gutter old-gutter" class:commentable={!!onLineComment}>
@@ -660,15 +650,10 @@
                           {@render commentBtn(row.oldLine.oldNo, "LEFT")}
                         {/if}
                       </td>
-                      <!-- svelte-ignore a11y_no_static_element_interactions -->
                       <td
                         class="diff-cell split-cell"
                         class:del={row.oldLine?.kind === "del"}
                         class:context={row.oldLine?.kind === "context"}
-                        class:selected={oldOrd !== undefined && isSelected(fi, hi, oldOrd)}
-                        style={row.oldLine?.kind === "del" ? "cursor: pointer" : ""}
-                        onclick={() => { if (oldOrd !== undefined) toggleLine(fi, hi, oldOrd); }}
-                        onkeydown={(e) => { if (oldOrd !== undefined && (e.key === "Enter" || e.key === " ")) { e.preventDefault(); toggleLine(fi, hi, oldOrd); } }}
                       >
                         {#if row.oldLine}
                           {@const toks = row.oldLine.kind === "del"
@@ -691,15 +676,10 @@
                           {@render commentBtn(row.newLine.newNo, "RIGHT")}
                         {/if}
                       </td>
-                      <!-- svelte-ignore a11y_no_static_element_interactions -->
                       <td
                         class="diff-cell split-cell"
                         class:add={row.newLine?.kind === "add"}
                         class:context={row.newLine?.kind === "context"}
-                        class:selected={newOrd !== undefined && isSelected(fi, hi, newOrd)}
-                        style={row.newLine?.kind === "add" ? "cursor: pointer" : ""}
-                        onclick={() => { if (newOrd !== undefined) toggleLine(fi, hi, newOrd); }}
-                        onkeydown={(e) => { if (newOrd !== undefined && (e.key === "Enter" || e.key === " ")) { e.preventDefault(); toggleLine(fi, hi, newOrd); } }}
                       >
                         {#if row.newLine}
                           {@const toks = row.newLine.kind === "add"
@@ -1078,40 +1058,6 @@
     margin-right: auto;
   }
 
-  /* ── Stage/unstage hunk buttons ─────────────────────────────────────────────── */
-  .hunk-btn {
-    padding: 1px 8px;
-    border-radius: var(--radius-sm);
-    border: 1px solid var(--border);
-    background: var(--btn-bg);
-    color: var(--text);
-    font-size: 11px;
-    cursor: pointer;
-    white-space: nowrap;
-    flex-shrink: 0;
-  }
-  .hunk-btn:hover {
-    background: var(--btn-hover);
-  }
-  .hunk-btn.primary {
-    background: var(--accent);
-    border-color: var(--accent);
-    color: var(--on-accent);
-  }
-  .hunk-btn.primary:hover {
-    opacity: 0.88;
-  }
-
-  /* ── Line-level selection highlight ─────────────────────────────────────────── */
-  .diff-row.selected {
-    box-shadow: inset 2px 0 0 var(--accent);
-    background: color-mix(in srgb, var(--accent) 15%, transparent);
-  }
-  .split-cell.selected {
-    box-shadow: inset 2px 0 0 var(--accent);
-    background: color-mix(in srgb, var(--accent) 15%, transparent);
-  }
-
   /* ── Line-comment affordance (only present when onLineComment is passed) ────── */
   /* Anchor for the absolutely-positioned button; position:relative on a td with
      no offsets is layout-neutral, and the class only exists in comment mode. */

From 539796b040af2c87f67aebf58a4d891a69950b96 Mon Sep 17 00:00:00 2001
From: Ash Shah <494shah@gmail.com>
Date: Thu, 6 Aug 2026 19:15:36 -0700
Subject: [PATCH 10/41] feat: support hunk and block rings in split diff view

---
 src/lib/components/DiffView.svelte | 47 +++++++++++++++++++++++++-----
 1 file changed, 40 insertions(+), 7 deletions(-)

diff --git a/src/lib/components/DiffView.svelte b/src/lib/components/DiffView.svelte
index 717b74a..b2a3f2c 100644
--- a/src/lib/components/DiffView.svelte
+++ b/src/lib/components/DiffView.svelte
@@ -146,9 +146,12 @@
   }
 
   // Runs after the DOM settles, so the anchor row is guaranteed to exist.
+  // diffSplit is tracked too: toggling Unified/Split unmounts the anchor row out
+  // from under a toolbar that would otherwise keep floating at a stale offset.
   $effect(() => {
     hov;
     sel;
+    appState.diffSplit;
     measureTool();
   });
 
@@ -389,6 +392,8 @@
     oldAfterIdx: number;
     newBeforeIdx: number;
     newAfterIdx: number;
+    /** Hunk line indices this row represents: 1 for context, 1-2 for a change pair. */
+    rows: number[];
   }
 
   /** Pair up del/add lines into side-by-side rows, with context lines spanning both. */
@@ -404,7 +409,7 @@
       const line = lines[i];
 
       if (line.kind === "context") {
-        rows.push({ oldLine: line, newLine: line, oldBeforeIdx: bi, oldAfterIdx: ai, newBeforeIdx: bi, newAfterIdx: ai });
+        rows.push({ oldLine: line, newLine: line, oldBeforeIdx: bi, oldAfterIdx: ai, newBeforeIdx: bi, newAfterIdx: ai, rows: [i] });
         bi++;
         ai++;
         i++;
@@ -412,15 +417,15 @@
       }
 
       // Collect a contiguous run of del/add lines and pair them up.
-      const dels: Array<{ line: DiffLine; bi: number }> = [];
-      const adds: Array<{ line: DiffLine; ai: number }> = [];
+      const dels: Array<{ line: DiffLine; bi: number; idx: number }> = [];
+      const adds: Array<{ line: DiffLine; ai: number; idx: number }> = [];
 
       while (i < lines.length && (lines[i].kind === "del" || lines[i].kind === "add")) {
         if (lines[i].kind === "del") {
-          dels.push({ line: lines[i], bi });
+          dels.push({ line: lines[i], bi, idx: i });
           bi++;
         } else {
-          adds.push({ line: lines[i], ai });
+          adds.push({ line: lines[i], ai, idx: i });
           ai++;
         }
         i++;
@@ -437,6 +442,7 @@
           oldAfterIdx: 0,      // dels use before-tokens, index not used for after
           newBeforeIdx: 0,
           newAfterIdx: a?.ai ?? 0,
+          rows: [d?.idx, a?.idx].filter((x): x is number => x !== undefined),
         });
       }
     }
@@ -444,6 +450,18 @@
     return rows;
   }
 
+  /**
+   * Does this split row show any hunk line the ring covers? The ring's edges are
+   * decided by comparing neighbours with this, not by testing whether a row holds
+   * `ring.from` / `ring.to`: a pair puts a deletion and an addition on one row, so
+   * with more deletions than additions the run's LAST hunk line sits on an early
+   * visual row and the bottom edge would be drawn mid-block.
+   */
+  function rowInRing(row: SplitRow | undefined, ring: { from: number; to: number } | null): boolean {
+    if (!row || !ring) return false;
+    return row.rows.some((r) => r >= ring.from && r <= ring.to);
+  }
+
   // ─── Rendering helper: tokens → HTML string (safe; tokens contain raw highlighted text) ──
 
   function renderTokens(tokens: ThemedToken[]): string {
@@ -640,9 +658,24 @@
                     </tr>
                   {/each}
                 {:else}
+                  {@const splitRows = toSplitRows(hunk)}
                   <!-- ── SPLIT view ── -->
-                  {#each toSplitRows(hunk) as row, ri (ri)}
-                    <tr class="diff-row split-row">
+                  {#each splitRows as row, ri (ri)}
+                    {@const head = row.rows[0] ?? 0}
+                    {@const inRing = rowInRing(row, ring)}
+                    <!-- svelte-ignore a11y_no_static_element_interactions -->
+                    <tr
+                      class="diff-row split-row"
+                      class:ring={inRing}
+                      class:ring-first={inRing && !rowInRing(splitRows[ri - 1], ring)}
+                      class:ring-last={inRing && !rowInRing(splitRows[ri + 1], ring)}
+                      data-h={hi}
+                      data-i={head}
+                      style={hasActions && (row.oldLine?.kind === "del" || row.newLine?.kind === "add") ? "cursor: pointer" : ""}
+                      onmouseenter={() => hoverRow(fi, hi, head)}
+                      onclick={(e) => onRowClick(e, fi, hi, head)}
+                      ondblclick={() => lockSelection(fi, hi, head)}
+                    >
                       <!-- Old side -->
                       <td class="gutter old-gutter" class:commentable={!!onLineComment}>
                         {row.oldLine?.oldNo ?? ""}

From 0cfa1449926a7aafeaca6fc556f9d176804bceaa Mon Sep 17 00:00:00 2001
From: Ash Shah <494shah@gmail.com>
Date: Thu, 6 Aug 2026 21:03:53 -0700
Subject: [PATCH 11/41] fix: select paired split-view rows as a unit

---
 src/lib/components/DiffView.svelte | 163 ++++++++++-------------------
 src/lib/diff/splitRows.test.ts     | 117 +++++++++++++++++++++
 src/lib/diff/splitRows.ts          | 142 +++++++++++++++++++++++++
 3 files changed, 317 insertions(+), 105 deletions(-)
 create mode 100644 src/lib/diff/splitRows.test.ts
 create mode 100644 src/lib/diff/splitRows.ts

diff --git a/src/lib/components/DiffView.svelte b/src/lib/components/DiffView.svelte
index b2a3f2c..7f396ad 100644
--- a/src/lib/components/DiffView.svelte
+++ b/src/lib/components/DiffView.svelte
@@ -1,7 +1,14 @@
 <script lang="ts">
   import { parseDiff } from "../diff/parse";
   import { getHighlighter, LANGS } from "../diff/highlight";
-  import { blocksOf, blockAt, ordsInRange } from "../diff/blocks";
+  import { blocksOf, blockAt, ordsInRange, type Block } from "../diff/blocks";
+  import {
+    toSplitRows,
+    isChangeRow,
+    splitBlocksOf,
+    splitBlockAt,
+    ordsInSplitRange,
+  } from "../diff/splitRows";
   import { appState } from "../store.svelte";
   import type { DiffFile, DiffHunk, DiffLine } from "../diff/types";
   import type { Highlighter, ThemedToken } from "shiki";
@@ -33,15 +40,32 @@
     !!(onStageHunk || onUnstageHunk || onStageLines || onUnstageLines || onDiscardHunk || onDiscardLines),
   );
 
-  // Hovered unit. `block` is the index into blocksOf(hunk), or null on a context row
-  // (which targets the whole hunk instead).
+  // Hovered unit. `block` is the index into blocksForView(hunk), or null on a context
+  // row (which targets the whole hunk instead).
   let hov = $state<{ fi: number; hi: number; block: number | null } | null>(null);
 
+  /**
+   * Row indices mean different things per view: in unified they index `hunk.lines`,
+   * in split they index the paired visual rows. Every hover/selection/ring value in
+   * this component is in the CURRENT view's space; these two helpers are the only
+   * places that translate.
+   */
+  function selectionOrds(h: DiffHunk, from: number, to: number): number[] {
+    return appState.diffSplit
+      ? ordsInSplitRange(h, toSplitRows(h), from, to)
+      : ordsInRange(h, from, to);
+  }
+
+  function blocksForView(h: DiffHunk): Block[] {
+    return appState.diffSplit ? splitBlocksOf(h, toSplitRows(h)) : blocksOf(h);
+  }
+
   function hoverRow(fi: number, hi: number, ri: number) {
     if (!hasActions || sel) return; // locked: hover is dead
     const h = parsed.files[fi]?.hunks[hi];
     if (!h) return;
-    hov = { fi, hi, block: blockAt(h, ri) };
+    const block = appState.diffSplit ? splitBlockAt(toSplitRows(h), ri) : blockAt(h, ri);
+    hov = { fi, hi, block };
   }
 
   function clearHover() {
@@ -61,7 +85,7 @@
     if (!hov || hov.fi !== fi || hov.hi !== hi || hov.block === null) return null;
     const h = parsed.files[fi]?.hunks[hi];
     if (!h) return null;
-    const b = blocksOf(h)[hov.block];
+    const b = blocksForView(h)[hov.block];
     return b ? { from: b.rows[0], to: b.rows[b.rows.length - 1] } : null;
   }
 
@@ -71,7 +95,7 @@
     scope: "sel" | "blk" | "hunk";
     /** null for a whole-hunk target — the hunk ops take no ordinals. */
     ords: number[] | null;
-    /** Row the toolbar anchors to. */
+    /** Row the toolbar anchors to, in the current view's index space (see `selectionOrds`). */
     anchorRow: number;
   }
 
@@ -81,7 +105,7 @@
     if (sel) {
       const h = parsed.files[sel.fi]?.hunks[sel.hi];
       if (!h) return null;
-      const ords = ordsInRange(h, sel.from, sel.to);
+      const ords = selectionOrds(h, sel.from, sel.to);
       return ords.length
         ? { fi: sel.fi, hi: sel.hi, scope: "sel", ords, anchorRow: sel.from }
         : null;
@@ -90,7 +114,7 @@
     const h = parsed.files[hov.fi]?.hunks[hov.hi];
     if (!h) return null;
     if (hov.block !== null) {
-      const b = blocksOf(h)[hov.block];
+      const b = blocksForView(h)[hov.block];
       if (b) return { fi: hov.fi, hi: hov.hi, scope: "blk", ords: b.ords, anchorRow: b.rows[0] };
     }
     return { fi: hov.fi, hi: hov.hi, scope: "hunk", ords: null, anchorRow: 0 };
@@ -336,22 +360,33 @@
   }
 
   // ─── Line selection ───────────────────────────────────────────────────────────
-  // A contiguous row range inside ONE hunk. `anchor` is the row the range grew
-  // from, so extending down and then back up pivots correctly. Ranges may span
-  // context rows; `ordsInRange` keeps only the change lines.
+  // A contiguous row range inside ONE hunk, in the current view's index space.
+  // `anchor` is the row the range grew from, so extending down and then back up
+  // pivots correctly. Ranges may span context rows; `selectionOrds` keeps only the
+  // change lines.
   let sel = $state<{ fi: number; hi: number; anchor: number; from: number; to: number } | null>(null);
 
-  // A new patch re-indexes every hunk, so any range we were holding is meaningless.
+  // A new patch re-indexes every hunk, and flipping Unified/Split re-indexes the rows
+  // themselves — a range held across either is meaningless.
   $effect(() => {
     // eslint-disable-next-line @typescript-eslint/no-unused-expressions
     patch;
+    // eslint-disable-next-line @typescript-eslint/no-unused-expressions
+    appState.diffSplit;
     sel = null;
+    hov = null;
   });
 
   function lockSelection(fi: number, hi: number, ri: number) {
     if (!hasActions) return;
     const h = parsed.files[fi]?.hunks[hi];
-    if (!h || h.lines[ri]?.kind === "context") return;
+    if (!h) return;
+    if (appState.diffSplit) {
+      const srows = toSplitRows(h);
+      if (!srows[ri] || !isChangeRow(srows[ri])) return;
+    } else if (h.lines[ri]?.kind === "context") {
+      return;
+    }
     sel = { fi, hi, anchor: ri, from: ri, to: ri };
     hov = null;
     // A double-click is also the browser's select-word gesture, and `.diff-cell`
@@ -365,7 +400,7 @@
     if (!h) return;
     const from = Math.min(sel.anchor, ri);
     const to = Math.max(sel.anchor, ri);
-    if (!ordsInRange(h, from, to).length) return;
+    if (!selectionOrds(h, from, to).length) return;
     sel = { fi, hi, anchor: sel.anchor, from, to };
     window.getSelection()?.removeAllRanges();
   }
@@ -383,85 +418,6 @@
     clearSelection();
   }
 
-  // ─── Split view helpers ───────────────────────────────────────────────────────
-
-  interface SplitRow {
-    oldLine: DiffLine | null;
-    newLine: DiffLine | null;
-    oldBeforeIdx: number;
-    oldAfterIdx: number;
-    newBeforeIdx: number;
-    newAfterIdx: number;
-    /** Hunk line indices this row represents: 1 for context, 1-2 for a change pair. */
-    rows: number[];
-  }
-
-  /** Pair up del/add lines into side-by-side rows, with context lines spanning both. */
-  function toSplitRows(hunk: DiffHunk): SplitRow[] {
-    const rows: SplitRow[] = [];
-    let bi = 0;
-    let ai = 0;
-
-    let i = 0;
-    const lines = hunk.lines;
-
-    while (i < lines.length) {
-      const line = lines[i];
-
-      if (line.kind === "context") {
-        rows.push({ oldLine: line, newLine: line, oldBeforeIdx: bi, oldAfterIdx: ai, newBeforeIdx: bi, newAfterIdx: ai, rows: [i] });
-        bi++;
-        ai++;
-        i++;
-        continue;
-      }
-
-      // Collect a contiguous run of del/add lines and pair them up.
-      const dels: Array<{ line: DiffLine; bi: number; idx: number }> = [];
-      const adds: Array<{ line: DiffLine; ai: number; idx: number }> = [];
-
-      while (i < lines.length && (lines[i].kind === "del" || lines[i].kind === "add")) {
-        if (lines[i].kind === "del") {
-          dels.push({ line: lines[i], bi, idx: i });
-          bi++;
-        } else {
-          adds.push({ line: lines[i], ai, idx: i });
-          ai++;
-        }
-        i++;
-      }
-
-      const maxLen = Math.max(dels.length, adds.length);
-      for (let j = 0; j < maxLen; j++) {
-        const d = dels[j] ?? null;
-        const a = adds[j] ?? null;
-        rows.push({
-          oldLine: d?.line ?? null,
-          newLine: a?.line ?? null,
-          oldBeforeIdx: d?.bi ?? 0,
-          oldAfterIdx: 0,      // dels use before-tokens, index not used for after
-          newBeforeIdx: 0,
-          newAfterIdx: a?.ai ?? 0,
-          rows: [d?.idx, a?.idx].filter((x): x is number => x !== undefined),
-        });
-      }
-    }
-
-    return rows;
-  }
-
-  /**
-   * Does this split row show any hunk line the ring covers? The ring's edges are
-   * decided by comparing neighbours with this, not by testing whether a row holds
-   * `ring.from` / `ring.to`: a pair puts a deletion and an addition on one row, so
-   * with more deletions than additions the run's LAST hunk line sits on an early
-   * visual row and the bottom edge would be drawn mid-block.
-   */
-  function rowInRing(row: SplitRow | undefined, ring: { from: number; to: number } | null): boolean {
-    if (!row || !ring) return false;
-    return row.rows.some((r) => r >= ring.from && r <= ring.to);
-  }
-
   // ─── Rendering helper: tokens → HTML string (safe; tokens contain raw highlighted text) ──
 
   function renderTokens(tokens: ThemedToken[]): string {
@@ -658,23 +614,20 @@
                     </tr>
                   {/each}
                 {:else}
-                  {@const splitRows = toSplitRows(hunk)}
                   <!-- ── SPLIT view ── -->
-                  {#each splitRows as row, ri (ri)}
-                    {@const head = row.rows[0] ?? 0}
-                    {@const inRing = rowInRing(row, ring)}
+                  {#each toSplitRows(hunk) as row, ri (ri)}
                     <!-- svelte-ignore a11y_no_static_element_interactions -->
                     <tr
                       class="diff-row split-row"
-                      class:ring={inRing}
-                      class:ring-first={inRing && !rowInRing(splitRows[ri - 1], ring)}
-                      class:ring-last={inRing && !rowInRing(splitRows[ri + 1], ring)}
+                      class:ring={ring !== null && ri >= ring.from && ri <= ring.to}
+                      class:ring-first={ring !== null && ri === ring.from}
+                      class:ring-last={ring !== null && ri === ring.to}
                       data-h={hi}
-                      data-i={head}
-                      style={hasActions && (row.oldLine?.kind === "del" || row.newLine?.kind === "add") ? "cursor: pointer" : ""}
-                      onmouseenter={() => hoverRow(fi, hi, head)}
-                      onclick={(e) => onRowClick(e, fi, hi, head)}
-                      ondblclick={() => lockSelection(fi, hi, head)}
+                      data-i={ri}
+                      style={hasActions && isChangeRow(row) ? "cursor: pointer" : ""}
+                      onmouseenter={() => hoverRow(fi, hi, ri)}
+                      onclick={(e) => onRowClick(e, fi, hi, ri)}
+                      ondblclick={() => lockSelection(fi, hi, ri)}
                     >
                       <!-- Old side -->
                       <td class="gutter old-gutter" class:commentable={!!onLineComment}>
diff --git a/src/lib/diff/splitRows.test.ts b/src/lib/diff/splitRows.test.ts
new file mode 100644
index 0000000..45a24e0
--- /dev/null
+++ b/src/lib/diff/splitRows.test.ts
@@ -0,0 +1,117 @@
+import { describe, it, expect } from "vitest";
+import { toSplitRows, isChangeRow, splitBlocksOf, splitBlockAt, ordsInSplitRange } from "./splitRows";
+import type { DiffHunk, DiffLineKind } from "./types";
+
+/** Build a hunk from a compact spec: " " context, "+" add, "-" del. */
+const hunk = (spec: string): DiffHunk => ({
+  header: "@@ -1,1 +1,1 @@",
+  lines: [...spec].map((ch, i) => ({
+    kind: (ch === "+" ? "add" : ch === "-" ? "del" : "context") as DiffLineKind,
+    text: `line${i}`,
+    oldNo: ch === "+" ? null : i,
+    newNo: ch === "-" ? null : i,
+  })),
+});
+
+const rowsOf = (spec: string) => toSplitRows(hunk(spec)).map((r) => r.rows);
+
+describe("toSplitRows", () => {
+  it("gives a context row the single hunk line it shows", () => {
+    expect(rowsOf("   ")).toEqual([[0], [1], [2]]);
+  });
+
+  it("pairs equal runs of deletions and additions onto shared rows", () => {
+    // lines 1,2 are del; 3,4 are add → row0 = (1,3), row1 = (2,4)
+    expect(rowsOf(" --++ ")).toEqual([[0], [1, 3], [2, 4], [5]]);
+  });
+
+  it("leaves the surplus deletion alone when there are more deletions than additions", () => {
+    // lines 0,1 del; 2 add → row0 = (0,2), row1 = (1)
+    expect(rowsOf("--+")).toEqual([[0, 2], [1]]);
+  });
+
+  it("leaves the surplus addition alone when there are more additions than deletions", () => {
+    // line 0 del; 1,2 add → row0 = (0,1), row1 = (2)
+    expect(rowsOf("-++")).toEqual([[0, 1], [2]]);
+  });
+
+  it("handles a pure-addition run with no deletions to pair against", () => {
+    expect(rowsOf("++")).toEqual([[0], [1]]);
+  });
+});
+
+describe("isChangeRow", () => {
+  it("is true for a row carrying a deletion or an addition, false for context", () => {
+    const rows = toSplitRows(hunk(" -+ "));
+    expect(rows.map(isChangeRow)).toEqual([false, true, false]);
+  });
+});
+
+describe("splitBlocksOf", () => {
+  it("collects a paired run into ONE split block covering both sides", () => {
+    const h = hunk(" --++ ");
+    const b = splitBlocksOf(h, toSplitRows(h));
+    // split rows 1 and 2 carry hunk lines 1,3 and 2,4 → ordinals 0,1,2,3
+    expect(b).toEqual([{ rows: [1, 2], ords: [0, 1, 2, 3] }]);
+  });
+
+  it("returns ordinals in ascending order even though pairing interleaves them", () => {
+    const h = hunk("--++");
+    const b = splitBlocksOf(h, toSplitRows(h));
+    // row0 = lines 0,2 (ords 0,2); row1 = lines 1,3 (ords 1,3) → must sort
+    expect(b[0].ords).toEqual([0, 1, 2, 3]);
+  });
+
+  it("breaks blocks on context rows", () => {
+    const h = hunk("-+ -+");
+    const b = splitBlocksOf(h, toSplitRows(h));
+    expect(b.map((x) => x.rows)).toEqual([[0], [2]]);
+  });
+
+  it("returns no blocks for a hunk of pure context", () => {
+    const h = hunk("   ");
+    expect(splitBlocksOf(h, toSplitRows(h))).toEqual([]);
+  });
+});
+
+describe("splitBlockAt", () => {
+  it("finds the block containing a split row, and null for context", () => {
+    const rows = toSplitRows(hunk("-+ -+"));
+    expect(splitBlockAt(rows, 0)).toBe(0);
+    expect(splitBlockAt(rows, 1)).toBeNull();
+    expect(splitBlockAt(rows, 2)).toBe(1);
+  });
+});
+
+describe("ordsInSplitRange", () => {
+  it("returns BOTH sides of a single paired row — the unit-selection guarantee", () => {
+    const h = hunk(" --++ ");
+    const rows = toSplitRows(h);
+    // split row 1 shows hunk lines 1 (del, ord 0) and 3 (add, ord 2)
+    expect(ordsInSplitRange(h, rows, 1, 1)).toEqual([0, 2]);
+  });
+
+  it("unions and sorts across a multi-row range", () => {
+    const h = hunk(" --++ ");
+    const rows = toSplitRows(h);
+    expect(ordsInSplitRange(h, rows, 1, 2)).toEqual([0, 1, 2, 3]);
+  });
+
+  it("skips context rows inside the range", () => {
+    const h = hunk("-+ -+");
+    const rows = toSplitRows(h);
+    expect(ordsInSplitRange(h, rows, 0, 2)).toEqual([0, 1, 2, 3]);
+  });
+
+  it("normalizes a reversed range", () => {
+    const h = hunk("-+ -+");
+    const rows = toSplitRows(h);
+    expect(ordsInSplitRange(h, rows, 2, 0)).toEqual([0, 1, 2, 3]);
+  });
+
+  it("returns empty for a context-only range", () => {
+    const h = hunk("-+ -+");
+    const rows = toSplitRows(h);
+    expect(ordsInSplitRange(h, rows, 1, 1)).toEqual([]);
+  });
+});
diff --git a/src/lib/diff/splitRows.ts b/src/lib/diff/splitRows.ts
new file mode 100644
index 0000000..c5b31b1
--- /dev/null
+++ b/src/lib/diff/splitRows.ts
@@ -0,0 +1,142 @@
+import type { DiffHunk, DiffLine } from "./types";
+import { ordinalsOf, type Block } from "./blocks";
+
+/** One visual row of the side-by-side view: a deletion and its paired addition, or a context line. */
+export interface SplitRow {
+  oldLine: DiffLine | null;
+  newLine: DiffLine | null;
+  oldBeforeIdx: number;
+  oldAfterIdx: number;
+  newBeforeIdx: number;
+  newAfterIdx: number;
+  /** Hunk line indices this row represents: 1 for context, 1-2 for a change pair. */
+  rows: number[];
+}
+
+/** Pair up del/add lines into side-by-side rows, with context lines spanning both. */
+export function toSplitRows(hunk: DiffHunk): SplitRow[] {
+  const rows: SplitRow[] = [];
+  let bi = 0;
+  let ai = 0;
+
+  let i = 0;
+  const lines = hunk.lines;
+
+  while (i < lines.length) {
+    const line = lines[i];
+
+    if (line.kind === "context") {
+      rows.push({ oldLine: line, newLine: line, oldBeforeIdx: bi, oldAfterIdx: ai, newBeforeIdx: bi, newAfterIdx: ai, rows: [i] });
+      bi++;
+      ai++;
+      i++;
+      continue;
+    }
+
+    // Collect a contiguous run of del/add lines and pair them up.
+    const dels: Array<{ line: DiffLine; bi: number; idx: number }> = [];
+    const adds: Array<{ line: DiffLine; ai: number; idx: number }> = [];
+
+    while (i < lines.length && (lines[i].kind === "del" || lines[i].kind === "add")) {
+      if (lines[i].kind === "del") {
+        dels.push({ line: lines[i], bi, idx: i });
+        bi++;
+      } else {
+        adds.push({ line: lines[i], ai, idx: i });
+        ai++;
+      }
+      i++;
+    }
+
+    const maxLen = Math.max(dels.length, adds.length);
+    for (let j = 0; j < maxLen; j++) {
+      const d = dels[j] ?? null;
+      const a = adds[j] ?? null;
+      rows.push({
+        oldLine: d?.line ?? null,
+        newLine: a?.line ?? null,
+        oldBeforeIdx: d?.bi ?? 0,
+        oldAfterIdx: 0,      // dels use before-tokens, index not used for after
+        newBeforeIdx: 0,
+        newAfterIdx: a?.ai ?? 0,
+        rows: [d?.idx, a?.idx].filter((x): x is number => x !== undefined),
+      });
+    }
+  }
+
+  return rows;
+}
+
+/** True when this visual row carries any changed line on either side. */
+export function isChangeRow(r: SplitRow): boolean {
+  return r.oldLine?.kind === "del" || r.newLine?.kind === "add";
+}
+
+/**
+ * Contiguous runs of change rows, in SPLIT-ROW index space.
+ *
+ * NOTE the deliberate asymmetry: the returned `Block.rows` holds **split-row**
+ * indices (so it can be compared against the `{#each}` index that renders them),
+ * while `Block.ords` holds ordinary hunk change ordinals (what the staging backend
+ * takes). Pairing interleaves the two sides, so the ordinals are sorted before
+ * being returned.
+ */
+export function splitBlocksOf(hunk: DiffHunk, rows: SplitRow[]): Block[] {
+  const ordinals = ordinalsOf(hunk);
+  const out: Block[] = [];
+  let cur: Block | null = null;
+  for (let ri = 0; ri < rows.length; ri++) {
+    if (!isChangeRow(rows[ri])) {
+      cur = null;
+      continue;
+    }
+    if (cur === null) {
+      cur = { rows: [], ords: [] };
+      out.push(cur);
+    }
+    cur.rows.push(ri);
+    for (const line of rows[ri].rows) {
+      const o = ordinals[line];
+      if (o !== null && o !== undefined) cur.ords.push(o);
+    }
+  }
+  for (const b of out) b.ords.sort((x, y) => x - y);
+  return out;
+}
+
+/** Index of the split block containing split-row `ri`, or null for a context row. */
+export function splitBlockAt(rows: SplitRow[], ri: number): number | null {
+  if (!rows[ri] || !isChangeRow(rows[ri])) return null;
+  let block = -1;
+  let open = false;
+  for (let i = 0; i <= ri; i++) {
+    if (isChangeRow(rows[i])) {
+      if (!open) {
+        block++;
+        open = true;
+      }
+    } else {
+      open = false;
+    }
+  }
+  return block;
+}
+
+/**
+ * Change-line ordinals covered by an inclusive SPLIT-ROW range (either order).
+ * Both sides of every paired row in the range are included — this is what makes
+ * "a paired row selects as a unit" true rather than aspirational.
+ */
+export function ordsInSplitRange(hunk: DiffHunk, rows: SplitRow[], from: number, to: number): number[] {
+  const ordinals = ordinalsOf(hunk);
+  const lo = Math.max(0, Math.min(from, to));
+  const hi = Math.min(rows.length - 1, Math.max(from, to));
+  const out: number[] = [];
+  for (let ri = lo; ri <= hi; ri++) {
+    for (const line of rows[ri]?.rows ?? []) {
+      const o = ordinals[line];
+      if (o !== null && o !== undefined) out.push(o);
+    }
+  }
+  return out.sort((x, y) => x - y);
+}

From cd5b9dc90f06ff7c750f06e5acab91c60fe90396 Mon Sep 17 00:00:00 2001
From: Ash Shah <494shah@gmail.com>
Date: Thu, 6 Aug 2026 21:19:17 -0700
Subject: [PATCH 12/41] docs: clarify Block.rows index space and cover unpaired
 addition rows

---
 src/lib/diff/blocks.ts         |  8 +++++++-
 src/lib/diff/splitRows.test.ts | 15 +++++++++++++++
 2 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/src/lib/diff/blocks.ts b/src/lib/diff/blocks.ts
index d64d417..630bcf9 100644
--- a/src/lib/diff/blocks.ts
+++ b/src/lib/diff/blocks.ts
@@ -2,7 +2,13 @@ import type { DiffHunk } from "./types";
 
 /** A contiguous run of changed (+/-) lines within one hunk. */
 export interface Block {
-  /** Indices into `hunk.lines`, ascending and contiguous. */
+  /**
+   * Row indices in the PRODUCING VIEW's space, ascending and contiguous:
+   * indices into `hunk.lines` from `blocksOf` (unified), indices into the paired
+   * visual rows from `splitBlocksOf` (split). Never index `hunk.lines` with these
+   * without knowing which producer you got them from — `ords` is the only field
+   * that means the same thing in both.
+   */
   rows: number[];
   /** The change-line ordinals for those rows — what the staging backend takes. */
   ords: number[];
diff --git a/src/lib/diff/splitRows.test.ts b/src/lib/diff/splitRows.test.ts
index 45a24e0..be4297b 100644
--- a/src/lib/diff/splitRows.test.ts
+++ b/src/lib/diff/splitRows.test.ts
@@ -45,6 +45,13 @@ describe("isChangeRow", () => {
     const rows = toSplitRows(hunk(" -+ "));
     expect(rows.map(isChangeRow)).toEqual([false, true, false]);
   });
+
+  it("is true for an unpaired addition row (no deletion on that row)", () => {
+    // " ++ " has no deletions to pair against, so both add rows carry oldLine: null —
+    // isChangeRow must fall through to the newLine clause to catch these.
+    const rows = toSplitRows(hunk(" ++ "));
+    expect(rows.map(isChangeRow)).toEqual([false, true, true, false]);
+  });
 });
 
 describe("splitBlocksOf", () => {
@@ -72,6 +79,14 @@ describe("splitBlocksOf", () => {
     const h = hunk("   ");
     expect(splitBlocksOf(h, toSplitRows(h))).toEqual([]);
   });
+
+  it("collects a deletion-free (pure-addition) run into a block", () => {
+    // Unpaired addition rows have oldLine: null, so this exercises grouping and
+    // ordinal-collection for rows that only satisfy isChangeRow's newLine clause.
+    const h = hunk(" ++ ");
+    const b = splitBlocksOf(h, toSplitRows(h));
+    expect(b).toEqual([{ rows: [1, 2], ords: [0, 1] }]);
+  });
 });
 
 describe("splitBlockAt", () => {

From 8f5d3f88f0d9c2248cbeb2663d7ba725074b7bdf Mon Sep 17 00:00:00 2001
From: Ash Shah <494shah@gmail.com>
Date: Thu, 6 Aug 2026 21:24:14 -0700
Subject: [PATCH 13/41] feat: add keyboard parity for diff ring selection

---
 src/lib/components/DiffView.svelte | 33 ++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)

diff --git a/src/lib/components/DiffView.svelte b/src/lib/components/DiffView.svelte
index 7f396ad..fed028f 100644
--- a/src/lib/components/DiffView.svelte
+++ b/src/lib/components/DiffView.svelte
@@ -418,6 +418,33 @@
     clearSelection();
   }
 
+  /**
+   * Keyboard parity for the mouse affordance: Enter/Space is the double-click
+   * (lock), Shift+Arrow is the shift-click (extend). Focus itself is wired to
+   * `hoverRow` on the rows, which is what raises the ring and toolbar.
+   */
+  function onRowKeydown(e: KeyboardEvent, fi: number, hi: number, ri: number) {
+    if (!hasActions) return;
+    if (e.key === "Enter" || e.key === " ") {
+      e.preventDefault();
+      lockSelection(fi, hi, ri);
+      return;
+    }
+    if (e.shiftKey && (e.key === "ArrowDown" || e.key === "ArrowUp") && sel) {
+      e.preventDefault();
+      const delta = e.key === "ArrowDown" ? 1 : -1;
+      const edge = sel.to === sel.anchor ? sel.from : sel.to;
+      const h = parsed.files[fi]?.hunks[hi];
+      if (!h) return;
+      // Rows are counted in the CURRENT view's space: `hunk.lines` in unified,
+      // paired visual rows in split. The two lengths differ, so clamping against
+      // the wrong one walks the selection past the last row of the view.
+      const rowCount = appState.diffSplit ? toSplitRows(h).length : h.lines.length;
+      const next = Math.max(0, Math.min(rowCount - 1, edge + delta));
+      extendSelection(fi, hi, next);
+    }
+  }
+
   // ─── Rendering helper: tokens → HTML string (safe; tokens contain raw highlighted text) ──
 
   function renderTokens(tokens: ThemedToken[]): string {
@@ -587,6 +614,9 @@
                       class:ring-last={ring !== null && ri === ring.to}
                       onmouseenter={() => hoverRow(fi, hi, ri)}
                       style={hasActions && line.kind !== "context" ? "cursor: pointer" : ""}
+                      tabindex={hasActions ? 0 : undefined}
+                      onfocus={() => hoverRow(fi, hi, ri)}
+                      onkeydown={(e) => onRowKeydown(e, fi, hi, ri)}
                       onclick={(e) => onRowClick(e, fi, hi, ri)}
                       ondblclick={() => lockSelection(fi, hi, ri)}
                     >
@@ -626,6 +656,9 @@
                       data-i={ri}
                       style={hasActions && isChangeRow(row) ? "cursor: pointer" : ""}
                       onmouseenter={() => hoverRow(fi, hi, ri)}
+                      tabindex={hasActions ? 0 : undefined}
+                      onfocus={() => hoverRow(fi, hi, ri)}
+                      onkeydown={(e) => onRowKeydown(e, fi, hi, ri)}
                       onclick={(e) => onRowClick(e, fi, hi, ri)}
                       ondblclick={() => lockSelection(fi, hi, ri)}
                     >

From ad86a8d253acee8931729c6ec45f30781cda6ccd Mon Sep 17 00:00:00 2001
From: Ash Shah <494shah@gmail.com>
Date: Fri, 7 Aug 2026 10:16:42 -0700
Subject: [PATCH 14/41] fix: refuse non-contiguous line selections that would
 reorder the file

---
 crates/git-core/src/ops_worktree.rs | 91 +++++++++++++++++++++++++++++
 1 file changed, 91 insertions(+)

diff --git a/crates/git-core/src/ops_worktree.rs b/crates/git-core/src/ops_worktree.rs
index 9fe9832..4742638 100644
--- a/crates/git-core/src/ops_worktree.rs
+++ b/crates/git-core/src/ops_worktree.rs
@@ -323,6 +323,33 @@ pub fn unstage_hunk(repo: &Path, path: &str, hunk_index: usize, context: u32) ->
 // Line-level (intra-hunk) staging
 // ---------------------------------------------------------------------------
 
+/// Reject a selection whose change-line ordinals are not one contiguous run.
+///
+/// Callers select a contiguous RANGE of rows, so the ordinals they produce are always
+/// consecutive — context rows carry no ordinal and therefore open no gap. A gapped set
+/// means the caller grouped lines that are not adjacent in the hunk. `build_partial_hunk`
+/// emits in hunk source order, so such a patch applies cleanly while placing the kept and
+/// restored lines in the wrong order — silent corruption with no reflog to recover from.
+/// There is no position for the omitted lines that matches the caller's intent, so refusing
+/// is the only safe answer.
+fn require_contiguous(selected: &[usize]) -> Result<(), String> {
+    if selected.is_empty() {
+        return Ok(());
+    }
+    let mut s: Vec<usize> = selected.to_vec();
+    s.sort_unstable();
+    s.dedup();
+    let span = s[s.len() - 1] - s[0] + 1;
+    if span != s.len() {
+        return Err(format!(
+            "refusing a non-contiguous line selection {:?}: those change lines are not adjacent \
+             in the hunk, and applying them would reorder the file",
+            s
+        ));
+    }
+    Ok(())
+}
+
 /// Build a partial single-hunk patch keeping only the selected change lines.
 /// `selected` holds ORDINALS over the hunk's change lines (the +/- lines, counted
 /// in order starting at 0; context and `\ No newline` lines are NOT counted).
@@ -458,6 +485,7 @@ fn build_partial_hunk(hunk: &str, selected: &std::collections::HashSet<usize>, r
 /// change-line ordinals line up with the diff the user is viewing. `build_partial_hunk`
 /// recomputes the `@@` header from the emitted lines, so any context depth works.
 pub fn stage_lines(repo: &Path, path: &str, hunk_index: usize, selected: &[usize], context: u32) -> Result<(), String> {
+    require_contiguous(selected)?;
     let d = diff(repo, Some(path), false, context)?;
     let (header, hunks) = split_hunks(&d);
     let h = hunks.get(hunk_index).ok_or("hunk index out of range")?;
@@ -471,6 +499,7 @@ pub fn stage_lines(repo: &Path, path: &str, hunk_index: usize, selected: &[usize
 /// change-line ordinals line up with the diff the user is viewing. `build_partial_hunk`
 /// recomputes the `@@` header from the emitted lines, so any context depth works.
 pub fn unstage_lines(repo: &Path, path: &str, hunk_index: usize, selected: &[usize], context: u32) -> Result<(), String> {
+    require_contiguous(selected)?;
     let d = diff(repo, Some(path), true, context)?;
     let (header, hunks) = split_hunks(&d);
     let h = hunks.get(hunk_index).ok_or("hunk index out of range")?;
@@ -499,6 +528,7 @@ pub fn discard_hunk(repo: &Path, path: &str, hunk_index: usize, context: u32) ->
 /// unselected `-` are dropped because they are not) — exactly what a worktree
 /// reverse-apply needs. DESTRUCTIVE / not undoable.
 pub fn discard_lines(repo: &Path, path: &str, hunk_index: usize, selected: &[usize], context: u32) -> Result<(), String> {
+    require_contiguous(selected)?;
     let d = diff(repo, Some(path), false, context)?;
     let (header, hunks) = split_hunks(&d);
     let h = hunks.get(hunk_index).ok_or("hunk index out of range")?;
@@ -1007,6 +1037,67 @@ mod tests {
         assert!(still.contains("+keep"), "staged work must survive the discard");
     }
 
+    #[test]
+    fn rejects_a_non_contiguous_selection_instead_of_reordering() {
+        let r = TempRepo::new();
+        r.commit_file("f.txt", "ctx1\nctx2\naaa\nbbb\nccc\nctx3\nctx4\n", "init");
+        r.write("f.txt", "ctx1\nctx2\nXXX\nYYY\nZZZ\nctx3\nctx4\n");
+
+        // Ordinals: -aaa=0 -bbb=1 -ccc=2 +XXX=3 +YYY=4 +ZZZ=5.
+        // [2,5] is the shape split view's paired-row selection used to emit.
+        let err = discard_lines(&r.path, "f.txt", 0, &[2, 5], 3).unwrap_err();
+        assert!(err.contains("non-contiguous"), "unexpected error: {}", err);
+
+        // The refusal must be total — the worktree is untouched.
+        assert_eq!(
+            fs::read_to_string(r.path.join("f.txt")).unwrap(),
+            "ctx1\nctx2\nXXX\nYYY\nZZZ\nctx3\nctx4\n"
+        );
+
+        let err = stage_lines(&r.path, "f.txt", 0, &[0, 3], 3).unwrap_err();
+        assert!(err.contains("non-contiguous"), "unexpected error: {}", err);
+        assert!(r.staged_paths().is_empty(), "nothing may reach the index");
+    }
+
+    #[test]
+    fn contiguous_selections_are_still_accepted() {
+        let r = TempRepo::new();
+        r.commit_file("f.txt", "base\n", "init");
+        r.write("f.txt", "base\nl1\nl2\nl3\n");
+        // Out of order and with a duplicate — still one contiguous run once normalized.
+        discard_lines(&r.path, "f.txt", 0, &[2, 1, 1], 3).unwrap();
+        assert_eq!(
+            fs::read_to_string(r.path.join("f.txt")).unwrap(),
+            "base\nl1\n"
+        );
+    }
+
+    /// The `-` path: discard must put a line BACK, not just remove one. Every existing
+    /// discard test uses a pure-addition hunk, so this branch of `build_partial_hunk`
+    /// was only ever exercised against the INDEX by `unstage_lines`, never against the
+    /// working tree.
+    #[test]
+    fn discard_lines_restores_a_deleted_line() {
+        let r = TempRepo::new();
+        r.commit_file("f.txt", "a\nb\nc\n", "init");
+        r.write("f.txt", "a\nc\n");
+        discard_lines(&r.path, "f.txt", 0, &[0], 3).unwrap();
+        assert_eq!(fs::read_to_string(r.path.join("f.txt")).unwrap(), "a\nb\nc\n");
+    }
+
+    /// A mixed hunk where only the deletion is discarded: `b` comes back and the
+    /// addition `B2` stays. Asserts exact file content so an off-by-one in the
+    /// context anchoring is caught rather than passing a substring check.
+    #[test]
+    fn discard_lines_mixed_hunk_restores_only_the_deletion() {
+        let r = TempRepo::new();
+        r.commit_file("f.txt", "a\nb\nc\n", "init");
+        r.write("f.txt", "a\nB2\nc\n");
+        // Ordinals: -b=0, +B2=1. Discard only the deletion.
+        discard_lines(&r.path, "f.txt", 0, &[0], 3).unwrap();
+        assert_eq!(fs::read_to_string(r.path.join("f.txt")).unwrap(), "a\nb\nB2\nc\n");
+    }
+
     #[test]
     fn working_changes_handles_space_in_path() {
         let r = TempRepo::new();

From e11b9ef6f38b0dd90b57fac8bf12a62e778e5a50 Mon Sep 17 00:00:00 2001
From: Ash Shah <494shah@gmail.com>
Date: Fri, 7 Aug 2026 10:24:54 -0700
Subject: [PATCH 15/41] fix: snap split-view selection to whole blocks

---
 src/lib/components/DiffView.svelte | 28 ++++++---
 src/lib/diff/splitRows.test.ts     | 98 +++++++++++++++++++++++++++++-
 src/lib/diff/splitRows.ts          | 38 ++++++++++++
 3 files changed, 156 insertions(+), 8 deletions(-)

diff --git a/src/lib/components/DiffView.svelte b/src/lib/components/DiffView.svelte
index fed028f..db3f1f8 100644
--- a/src/lib/components/DiffView.svelte
+++ b/src/lib/components/DiffView.svelte
@@ -8,6 +8,7 @@
     splitBlocksOf,
     splitBlockAt,
     ordsInSplitRange,
+    splitRangeSnappedToBlocks,
   } from "../diff/splitRows";
   import { appState } from "../store.svelte";
   import type { DiffFile, DiffHunk, DiffLine } from "../diff/types";
@@ -382,12 +383,16 @@
     const h = parsed.files[fi]?.hunks[hi];
     if (!h) return;
     if (appState.diffSplit) {
-      const srows = toSplitRows(h);
-      if (!srows[ri] || !isChangeRow(srows[ri])) return;
-    } else if (h.lines[ri]?.kind === "context") {
-      return;
+      // Split view snaps to whole blocks: a paired row is a display artifact, and a
+      // partial selection of a mixed block yields non-contiguous ordinals, which
+      // reorder the file when applied.
+      const r = splitRangeSnappedToBlocks(toSplitRows(h), ri, ri);
+      if (!r) return;
+      sel = { fi, hi, anchor: ri, from: r.from, to: r.to };
+    } else {
+      if (h.lines[ri]?.kind === "context") return;
+      sel = { fi, hi, anchor: ri, from: ri, to: ri };
     }
-    sel = { fi, hi, anchor: ri, from: ri, to: ri };
     hov = null;
     // A double-click is also the browser's select-word gesture, and `.diff-cell`
     // deliberately opts back into user-select so diff code stays copyable.
@@ -398,8 +403,17 @@
     if (!sel || sel.fi !== fi || sel.hi !== hi) return;
     const h = parsed.files[fi]?.hunks[hi];
     if (!h) return;
-    const from = Math.min(sel.anchor, ri);
-    const to = Math.max(sel.anchor, ri);
+    let from: number;
+    let to: number;
+    if (appState.diffSplit) {
+      const r = splitRangeSnappedToBlocks(toSplitRows(h), sel.anchor, ri);
+      if (!r) return;
+      from = r.from;
+      to = r.to;
+    } else {
+      from = Math.min(sel.anchor, ri);
+      to = Math.max(sel.anchor, ri);
+    }
     if (!selectionOrds(h, from, to).length) return;
     sel = { fi, hi, anchor: sel.anchor, from, to };
     window.getSelection()?.removeAllRanges();
diff --git a/src/lib/diff/splitRows.test.ts b/src/lib/diff/splitRows.test.ts
index be4297b..dd83bfa 100644
--- a/src/lib/diff/splitRows.test.ts
+++ b/src/lib/diff/splitRows.test.ts
@@ -1,5 +1,13 @@
 import { describe, it, expect } from "vitest";
-import { toSplitRows, isChangeRow, splitBlocksOf, splitBlockAt, ordsInSplitRange } from "./splitRows";
+import {
+  toSplitRows,
+  isChangeRow,
+  splitBlocksOf,
+  splitBlockAt,
+  ordsInSplitRange,
+  splitRangeSnappedToBlocks,
+} from "./splitRows";
+import { blocksOf } from "./blocks";
 import type { DiffHunk, DiffLineKind } from "./types";
 
 /** Build a hunk from a compact spec: " " context, "+" add, "-" del. */
@@ -52,6 +60,10 @@ describe("isChangeRow", () => {
     const rows = toSplitRows(hunk(" ++ "));
     expect(rows.map(isChangeRow)).toEqual([false, true, true, false]);
   });
+
+  it("is true for an unpaired DELETION row", () => {
+    expect(toSplitRows(hunk(" -- ")).map(isChangeRow)).toEqual([false, true, true, false]);
+  });
 });
 
 describe("splitBlocksOf", () => {
@@ -87,6 +99,11 @@ describe("splitBlocksOf", () => {
     const b = splitBlocksOf(h, toSplitRows(h));
     expect(b).toEqual([{ rows: [1, 2], ords: [0, 1] }]);
   });
+
+  it("groups a pure-deletion run with no additions to pair against", () => {
+    const h = hunk(" -- ");
+    expect(splitBlocksOf(h, toSplitRows(h))).toEqual([{ rows: [1, 2], ords: [0, 1] }]);
+  });
 });
 
 describe("splitBlockAt", () => {
@@ -130,3 +147,82 @@ describe("ordsInSplitRange", () => {
     expect(ordsInSplitRange(h, rows, 1, 1)).toEqual([]);
   });
 });
+
+describe("splitRangeSnappedToBlocks", () => {
+  it("expands a single row inside a mixed block to the WHOLE block", () => {
+    // 3 deletions paired with 3 additions -> 3 visual rows, all one block
+    const rows = toSplitRows(hunk(" ---+++ "));
+    expect(splitRangeSnappedToBlocks(rows, 3, 3)).toEqual({ from: 1, to: 3 });
+  });
+
+  it("returns null for a context row with no block in range", () => {
+    const rows = toSplitRows(hunk(" -+ "));
+    expect(splitRangeSnappedToBlocks(rows, 0, 0)).toBeNull();
+  });
+
+  it("unions every block the range touches, including across context rows", () => {
+    const rows = toSplitRows(hunk("-+ -+"));
+    expect(splitRangeSnappedToBlocks(rows, 0, 2)).toEqual({ from: 0, to: 2 });
+  });
+
+  it("normalizes a reversed range", () => {
+    const rows = toSplitRows(hunk("-+ -+"));
+    expect(splitRangeSnappedToBlocks(rows, 2, 0)).toEqual({ from: 0, to: 2 });
+  });
+
+  it("leaves a pure-addition block row-exact, since each row is a single line", () => {
+    const rows = toSplitRows(hunk(" ++ "));
+    expect(splitRangeSnappedToBlocks(rows, 1, 1)).toEqual({ from: 1, to: 2 });
+  });
+});
+
+describe("contiguity invariant", () => {
+  const isContiguous = (o: number[]) => o.length === 0 || o[o.length - 1] - o[0] + 1 === o.length;
+
+  // Shapes chosen to cover: paired, deletion-surplus, addition-surplus, pure runs,
+  // and two blocks separated by context.
+  const SHAPES = [" ---+++ ", " ---+ ", " -+++ ", " ++ ", " -- ", "-+ -+", "-+++ --"];
+
+  it("every block's ordinals are contiguous", () => {
+    for (const spec of SHAPES) {
+      const h = hunk(spec);
+      for (const b of splitBlocksOf(h, toSplitRows(h))) {
+        expect(isContiguous(b.ords), `block ords for "${spec}": ${b.ords}`).toBe(true);
+      }
+    }
+  });
+
+  it("every snapped range yields contiguous ordinals — the property that prevents file reordering", () => {
+    for (const spec of SHAPES) {
+      const h = hunk(spec);
+      const rows = toSplitRows(h);
+      for (let a = 0; a < rows.length; a++) {
+        for (let b = 0; b < rows.length; b++) {
+          const r = splitRangeSnappedToBlocks(rows, a, b);
+          if (!r) continue;
+          const ords = ordsInSplitRange(h, rows, r.from, r.to);
+          expect(isContiguous(ords), `"${spec}" [${a},${b}] -> ${ords}`).toBe(true);
+        }
+      }
+    }
+  });
+
+  it("an UNSNAPPED single paired row can be non-contiguous — why snapping is required", () => {
+    const h = hunk(" ---+++ ");
+    const rows = toSplitRows(h);
+    // Third paired row alone: deletion ord 2 with addition ord 5.
+    expect(ordsInSplitRange(h, rows, 3, 3)).toEqual([2, 5]);
+    expect(isContiguous([2, 5])).toBe(false);
+  });
+});
+
+describe("cross-space invariant", () => {
+  it("split blocks and unified blocks cover the same ordinals for the same hunk", () => {
+    for (const spec of [" ---+++ ", " -+ ", " ++ ", " -- ", "-+ -+"]) {
+      const h = hunk(spec);
+      const unified = blocksOf(h).flatMap((b) => b.ords).sort((x, y) => x - y);
+      const split = splitBlocksOf(h, toSplitRows(h)).flatMap((b) => b.ords).sort((x, y) => x - y);
+      expect(split, `spec "${spec}"`).toEqual(unified);
+    }
+  });
+});
diff --git a/src/lib/diff/splitRows.ts b/src/lib/diff/splitRows.ts
index c5b31b1..0413c2c 100644
--- a/src/lib/diff/splitRows.ts
+++ b/src/lib/diff/splitRows.ts
@@ -122,6 +122,44 @@ export function splitBlockAt(rows: SplitRow[], ri: number): number | null {
   return block;
 }
 
+/**
+ * The split-row range covering every block the inclusive range [a, b] touches, or null
+ * when it touches none (a context-only range).
+ *
+ * Split-view selection snaps to whole blocks because a PARTIAL selection of a mixed
+ * deletion/addition block yields non-contiguous ordinals — and `build_partial_hunk`
+ * emits in hunk source order, so such a patch silently reorders the file. Whole blocks
+ * are always contiguous in ordinal space, as is any union of them, because ordinals run
+ * consecutively across the hunk.
+ */
+export function splitRangeSnappedToBlocks(
+  rows: SplitRow[],
+  a: number,
+  b: number,
+): { from: number; to: number } | null {
+  const lo = Math.min(a, b);
+  const hi = Math.max(a, b);
+  let from = Infinity;
+  let to = -Infinity;
+  let open = false;
+  let blockStart = 0;
+  for (let ri = 0; ri <= rows.length; ri++) {
+    const isChange = ri < rows.length && isChangeRow(rows[ri]);
+    if (isChange && !open) {
+      open = true;
+      blockStart = ri;
+    } else if (!isChange && open) {
+      open = false;
+      // The block spans [blockStart, ri - 1]; keep it if it overlaps [lo, hi].
+      if (ri - 1 >= lo && blockStart <= hi) {
+        from = Math.min(from, blockStart);
+        to = Math.max(to, ri - 1);
+      }
+    }
+  }
+  return from === Infinity ? null : { from, to };
+}
+
 /**
  * Change-line ordinals covered by an inclusive SPLIT-ROW range (either order).
  * Both sides of every paired row in the range are included — this is what makes

From 64e5f8ee727b1696b4db0ab82e0376d268904d41 Mon Sep 17 00:00:00 2001
From: Ash Shah <494shah@gmail.com>
Date: Fri, 7 Aug 2026 10:33:07 -0700
Subject: [PATCH 16/41] fix: address whole-branch review findings in the diff
 affordance

- Shift+Arrow steps by BLOCK in split view, where row-stepping was a no-op after
  selection snapping (new `splitBlockRanges`, which `splitRangeSnappedToBlocks` now reuses).
- The hunk-scope toolbar anchors to the hovered row, so hunks taller than the pane no
  longer hide it.
- The Discard confirm states the changed-line count instead of "this hunk", which
  understated Whole-file mode's single whole-file hunk.
- Roving tabindex: one tab stop per diff instead of one per row, with unshifted arrows
  moving between rows and Tab reaching the toolbar.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 src/lib/components/DiffView.svelte        | 86 ++++++++++++++++++-----
 src/lib/components/WorkingCopyView.svelte |  2 +-
 src/lib/diff/splitRows.test.ts            | 37 ++++++++++
 src/lib/diff/splitRows.ts                 | 46 +++++++-----
 src/lib/gitActions.ts                     |  8 ++-
 5 files changed, 139 insertions(+), 40 deletions(-)

diff --git a/src/lib/components/DiffView.svelte b/src/lib/components/DiffView.svelte
index db3f1f8..8524ed2 100644
--- a/src/lib/components/DiffView.svelte
+++ b/src/lib/components/DiffView.svelte
@@ -1,12 +1,13 @@
 <script lang="ts">
   import { parseDiff } from "../diff/parse";
   import { getHighlighter, LANGS } from "../diff/highlight";
-  import { blocksOf, blockAt, ordsInRange, type Block } from "../diff/blocks";
+  import { blocksOf, blockAt, ordinalsOf, ordsInRange, type Block } from "../diff/blocks";
   import {
     toSplitRows,
     isChangeRow,
     splitBlocksOf,
     splitBlockAt,
+    splitBlockRanges,
     ordsInSplitRange,
     splitRangeSnappedToBlocks,
   } from "../diff/splitRows";
@@ -24,7 +25,9 @@
     onUnstageHunk?: (i: number) => void;
     onStageLines?: (hunkIndex: number, selected: number[]) => void;
     onUnstageLines?: (hunkIndex: number, selected: number[]) => void;
-    onDiscardHunk?: (i: number) => void;
+    /** `changedLines` is how many +/- lines the hunk holds — the confirm dialog states it,
+        because in Whole-file mode one hunk covers the entire file. */
+    onDiscardHunk?: (i: number, changedLines: number) => void;
     onDiscardLines?: (hunkIndex: number, selected: number[]) => void;
     // PR-review comment affordance (GitHub line/side semantics: RIGHT = new-file
     // line number for context + added rows, LEFT = old-file line number for
@@ -42,8 +45,9 @@
   );
 
   // Hovered unit. `block` is the index into blocksForView(hunk), or null on a context
-  // row (which targets the whole hunk instead).
-  let hov = $state<{ fi: number; hi: number; block: number | null } | null>(null);
+  // row (which targets the whole hunk instead). `ri` is the row itself, kept so the
+  // hunk-scope toolbar can anchor to a row the user can actually see.
+  let hov = $state<{ fi: number; hi: number; ri: number; block: number | null } | null>(null);
 
   /**
    * Row indices mean different things per view: in unified they index `hunk.lines`,
@@ -66,7 +70,7 @@
     const h = parsed.files[fi]?.hunks[hi];
     if (!h) return;
     const block = appState.diffSplit ? splitBlockAt(toSplitRows(h), ri) : blockAt(h, ri);
-    hov = { fi, hi, block };
+    hov = { fi, hi, ri, block };
   }
 
   function clearHover() {
@@ -118,7 +122,9 @@
       const b = blocksForView(h)[hov.block];
       if (b) return { fi: hov.fi, hi: hov.hi, scope: "blk", ords: b.ords, anchorRow: b.rows[0] };
     }
-    return { fi: hov.fi, hi: hov.hi, scope: "hunk", ords: null, anchorRow: 0 };
+    // Anchor to the hovered row, not row 0: a hunk taller than the pane would otherwise
+    // put its anchor off-screen and `measureTool` would hide the toolbar entirely.
+    return { fi: hov.fi, hi: hov.hi, scope: "hunk", ords: null, anchorRow: hov.ri };
   }
 
   function runAction(kind: "stage" | "unstage" | "discard") {
@@ -127,7 +133,11 @@
     if (t.scope === "hunk") {
       if (kind === "stage") onStageHunk?.(t.hi);
       else if (kind === "unstage") onUnstageHunk?.(t.hi);
-      else onDiscardHunk?.(t.hi);
+      else {
+        const h = parsed.files[t.fi]?.hunks[t.hi];
+        const changed = h ? ordinalsOf(h).filter((o) => o !== null).length : 0;
+        onDiscardHunk?.(t.hi, changed);
+      }
     } else {
       const ords = t.ords ?? [];
       if (!ords.length) return;
@@ -367,8 +377,20 @@
   // change lines.
   let sel = $state<{ fi: number; hi: number; anchor: number; from: number; to: number } | null>(null);
 
+  // Roving tabindex: exactly ONE row per file is a tab stop, so the diff contributes a
+  // single stop to the app's tab order and Tab from it reaches `.diff-tools` directly.
+  // Unshifted arrows move between rows; every row stays programmatically focusable at -1.
+  let focusedRow = $state<{ fi: number; hi: number; ri: number } | null>(null);
+
+  function isTabStop(fi: number, hi: number, ri: number): boolean {
+    if (!hasActions) return false;
+    if (focusedRow) return focusedRow.fi === fi && focusedRow.hi === hi && focusedRow.ri === ri;
+    return hi === 0 && ri === 0; // nothing focused yet: the file's first row
+  }
+
   // A new patch re-indexes every hunk, and flipping Unified/Split re-indexes the rows
-  // themselves — a range held across either is meaningless.
+  // themselves — a range held across either is meaningless. `focusedRow` goes too: a
+  // stale one matches no rendered row, which would leave the diff with NO tab stop.
   $effect(() => {
     // eslint-disable-next-line @typescript-eslint/no-unused-expressions
     patch;
@@ -376,6 +398,7 @@
     appState.diffSplit;
     sel = null;
     hov = null;
+    focusedRow = null;
   });
 
   function lockSelection(fi: number, hi: number, ri: number) {
@@ -444,18 +467,39 @@
       lockSelection(fi, hi, ri);
       return;
     }
+    if (!e.shiftKey && (e.key === "ArrowDown" || e.key === "ArrowUp")) {
+      e.preventDefault();
+      const wrap = wrapEls[fi];
+      if (!wrap) return;
+      // Querying the DOM keeps this correct across hunk boundaries without duplicating
+      // the unified/split row-space logic — the rendered order IS the navigation order.
+      const rows = [...wrap.querySelectorAll<HTMLElement>("tr[data-h][data-i]")];
+      const cur = rows.findIndex(
+        (el) => el.dataset.h === String(hi) && el.dataset.i === String(ri),
+      );
+      const next = rows[cur + (e.key === "ArrowDown" ? 1 : -1)];
+      next?.focus();
+      return;
+    }
     if (e.shiftKey && (e.key === "ArrowDown" || e.key === "ArrowUp") && sel) {
       e.preventDefault();
       const delta = e.key === "ArrowDown" ? 1 : -1;
       const edge = sel.to === sel.anchor ? sel.from : sel.to;
       const h = parsed.files[fi]?.hunks[hi];
       if (!h) return;
-      // Rows are counted in the CURRENT view's space: `hunk.lines` in unified,
-      // paired visual rows in split. The two lengths differ, so clamping against
-      // the wrong one walks the selection past the last row of the view.
-      const rowCount = appState.diffSplit ? toSplitRows(h).length : h.lines.length;
-      const next = Math.max(0, Math.min(rowCount - 1, edge + delta));
-      extendSelection(fi, hi, next);
+      if (appState.diffSplit) {
+        // Split selections snap to whole blocks, so stepping one ROW would always land
+        // on the context between blocks and change nothing. Step one BLOCK instead.
+        const ranges = splitBlockRanges(toSplitRows(h));
+        const cur = ranges.findIndex((r) => edge >= r.from && edge <= r.to);
+        const target = ranges[cur + delta];
+        if (!target) return;
+        extendSelection(fi, hi, target.from);
+      } else {
+        const next = Math.max(0, Math.min(h.lines.length - 1, edge + delta));
+        extendSelection(fi, hi, next);
+      }
+      return;
     }
   }
 
@@ -628,8 +672,11 @@
                       class:ring-last={ring !== null && ri === ring.to}
                       onmouseenter={() => hoverRow(fi, hi, ri)}
                       style={hasActions && line.kind !== "context" ? "cursor: pointer" : ""}
-                      tabindex={hasActions ? 0 : undefined}
-                      onfocus={() => hoverRow(fi, hi, ri)}
+                      tabindex={hasActions ? (isTabStop(fi, hi, ri) ? 0 : -1) : undefined}
+                      onfocus={() => {
+                        focusedRow = { fi, hi, ri };
+                        hoverRow(fi, hi, ri);
+                      }}
                       onkeydown={(e) => onRowKeydown(e, fi, hi, ri)}
                       onclick={(e) => onRowClick(e, fi, hi, ri)}
                       ondblclick={() => lockSelection(fi, hi, ri)}
@@ -670,8 +717,11 @@
                       data-i={ri}
                       style={hasActions && isChangeRow(row) ? "cursor: pointer" : ""}
                       onmouseenter={() => hoverRow(fi, hi, ri)}
-                      tabindex={hasActions ? 0 : undefined}
-                      onfocus={() => hoverRow(fi, hi, ri)}
+                      tabindex={hasActions ? (isTabStop(fi, hi, ri) ? 0 : -1) : undefined}
+                      onfocus={() => {
+                        focusedRow = { fi, hi, ri };
+                        hoverRow(fi, hi, ri);
+                      }}
                       onkeydown={(e) => onRowKeydown(e, fi, hi, ri)}
                       onclick={(e) => onRowClick(e, fi, hi, ri)}
                       ondblclick={() => lockSelection(fi, hi, ri)}
diff --git a/src/lib/components/WorkingCopyView.svelte b/src/lib/components/WorkingCopyView.svelte
index c380865..b5ec616 100644
--- a/src/lib/components/WorkingCopyView.svelte
+++ b/src/lib/components/WorkingCopyView.svelte
@@ -563,7 +563,7 @@
               : undefined}
             onDiscardHunk={selectedIsStaged || selectedIsUntracked
               ? undefined
-              : (i) => gitActions.discardHunk(selectedFile!, i)}
+              : (i, n) => gitActions.discardHunk(selectedFile!, i, n)}
             onDiscardLines={selectedIsStaged || selectedIsUntracked
               ? undefined
               : (hi, sel) => gitActions.discardLines(selectedFile!, hi, sel)}
diff --git a/src/lib/diff/splitRows.test.ts b/src/lib/diff/splitRows.test.ts
index dd83bfa..020c163 100644
--- a/src/lib/diff/splitRows.test.ts
+++ b/src/lib/diff/splitRows.test.ts
@@ -4,6 +4,7 @@ import {
   isChangeRow,
   splitBlocksOf,
   splitBlockAt,
+  splitBlockRanges,
   ordsInSplitRange,
   splitRangeSnappedToBlocks,
 } from "./splitRows";
@@ -148,6 +149,42 @@ describe("ordsInSplitRange", () => {
   });
 });
 
+describe("splitBlockRanges", () => {
+  it("lists two blocks separated by context, in document order", () => {
+    const rows = toSplitRows(hunk(" -+ -+ "));
+    expect(splitBlockRanges(rows)).toEqual([
+      { from: 1, to: 1 },
+      { from: 3, to: 3 },
+    ]);
+  });
+
+  it("catches a block that starts on the FIRST row", () => {
+    // "--++ " pairs into rows 0,1 (change) then row 2 (context).
+    expect(splitBlockRanges(toSplitRows(hunk("--++ ")))).toEqual([{ from: 0, to: 1 }]);
+  });
+
+  it("closes a block that runs to the LAST row", () => {
+    // No trailing context, so the block is only flushed by the end-of-rows pass.
+    expect(splitBlockRanges(toSplitRows(hunk(" --++")))).toEqual([{ from: 1, to: 2 }]);
+  });
+
+  it("returns an empty array for a hunk of pure context", () => {
+    expect(splitBlockRanges(toSplitRows(hunk("   ")))).toEqual([]);
+  });
+
+  it("agrees with splitBlocksOf on where every block starts and ends", () => {
+    for (const spec of [" ---+++ ", " ---+ ", " -+++ ", " ++ ", " -- ", "-+ -+", "-+++ --"]) {
+      const h = hunk(spec);
+      const rows = toSplitRows(h);
+      const fromBlocks = splitBlocksOf(h, rows).map((b) => ({
+        from: b.rows[0],
+        to: b.rows[b.rows.length - 1],
+      }));
+      expect(splitBlockRanges(rows), `spec "${spec}"`).toEqual(fromBlocks);
+    }
+  });
+});
+
 describe("splitRangeSnappedToBlocks", () => {
   it("expands a single row inside a mixed block to the WHOLE block", () => {
     // 3 deletions paired with 3 additions -> 3 visual rows, all one block
diff --git a/src/lib/diff/splitRows.ts b/src/lib/diff/splitRows.ts
index 0413c2c..942affd 100644
--- a/src/lib/diff/splitRows.ts
+++ b/src/lib/diff/splitRows.ts
@@ -122,6 +122,27 @@ export function splitBlockAt(rows: SplitRow[], ri: number): number | null {
   return block;
 }
 
+/**
+ * Every change block's split-row range, in document order. The loop runs one past the
+ * last row so a block ending on the final row is still flushed.
+ */
+export function splitBlockRanges(rows: SplitRow[]): Array<{ from: number; to: number }> {
+  const out: Array<{ from: number; to: number }> = [];
+  let open = false;
+  let start = 0;
+  for (let ri = 0; ri <= rows.length; ri++) {
+    const isChange = ri < rows.length && isChangeRow(rows[ri]);
+    if (isChange && !open) {
+      open = true;
+      start = ri;
+    } else if (!isChange && open) {
+      open = false;
+      out.push({ from: start, to: ri - 1 });
+    }
+  }
+  return out;
+}
+
 /**
  * The split-row range covering every block the inclusive range [a, b] touches, or null
  * when it touches none (a context-only range).
@@ -139,25 +160,12 @@ export function splitRangeSnappedToBlocks(
 ): { from: number; to: number } | null {
   const lo = Math.min(a, b);
   const hi = Math.max(a, b);
-  let from = Infinity;
-  let to = -Infinity;
-  let open = false;
-  let blockStart = 0;
-  for (let ri = 0; ri <= rows.length; ri++) {
-    const isChange = ri < rows.length && isChangeRow(rows[ri]);
-    if (isChange && !open) {
-      open = true;
-      blockStart = ri;
-    } else if (!isChange && open) {
-      open = false;
-      // The block spans [blockStart, ri - 1]; keep it if it overlaps [lo, hi].
-      if (ri - 1 >= lo && blockStart <= hi) {
-        from = Math.min(from, blockStart);
-        to = Math.max(to, ri - 1);
-      }
-    }
-  }
-  return from === Infinity ? null : { from, to };
+  const hit = splitBlockRanges(rows).filter((r) => r.to >= lo && r.from <= hi);
+  if (!hit.length) return null;
+  return {
+    from: Math.min(...hit.map((r) => r.from)),
+    to: Math.max(...hit.map((r) => r.to)),
+  };
 }
 
 /**
diff --git a/src/lib/gitActions.ts b/src/lib/gitActions.ts
index abda2e9..6ad8532 100644
--- a/src/lib/gitActions.ts
+++ b/src/lib/gitActions.ts
@@ -874,7 +874,7 @@ export const gitActions = {
   // file-level `discard` below: uncommitted work is not in the reflog, so there is
   // no backup bundle to take. Guard BEFORE confirming so the browser preview never
   // shows a dialog it cannot honour.
-  discardHunk: async (path: string, hunkIndex: number): Promise<boolean> => {
+  discardHunk: async (path: string, hunkIndex: number, changedLines: number): Promise<boolean> => {
     if (!isTauri()) {
       appState.status = "That action needs the desktop app (not the browser preview).";
       return false;
@@ -883,9 +883,13 @@ export const gitActions = {
       appState.status = "Open a repository first.";
       return false;
     }
+    // State the LINE COUNT, not "this hunk": in Whole-file mode git emits one hunk
+    // spanning the entire file, so a hunk discard can revert every unstaged change in
+    // it — a boundary the user cannot see from the dialog.
+    const n = changedLines;
     const confirmed = await dialogs.confirm({
       title: "Discard hunk",
-      message: `Permanently discard this hunk of ${path}. This cannot be undone. (Stash instead to keep it.)`,
+      message: `Permanently discard ${n} changed line${n === 1 ? "" : "s"} in ${path}. This cannot be undone. (Stash instead to keep them.)`,
       confirmLabel: "Discard",
       danger: true,
     });

From d8b84c6ea24313e164e024f3c736244496b49669 Mon Sep 17 00:00:00 2001
From: Ash Shah <494shah@gmail.com>
Date: Fri, 7 Aug 2026 10:35:36 -0700
Subject: [PATCH 17/41] fix: keep the diff toolbar reachable for targets taller
 than the pane

---
 src/lib/components/DiffView.svelte | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/src/lib/components/DiffView.svelte b/src/lib/components/DiffView.svelte
index 8524ed2..715cb09 100644
--- a/src/lib/components/DiffView.svelte
+++ b/src/lib/components/DiffView.svelte
@@ -156,6 +156,9 @@
   let toolTop = $state(0);
   let toolVisible = $state(false);
 
+  // Enough room for the toolbar's own height so clamping never parks it half out of view.
+  const TOOLBAR_CLEARANCE = 30;
+
   function measureTool() {
     const t = activeTarget();
     const wrap = t ? wrapEls[t.fi] : undefined;
@@ -170,13 +173,13 @@
       toolVisible = false;
       return;
     }
-    const top = row.getBoundingClientRect().top - wrap.getBoundingClientRect().top;
-    // Hide rather than float a toolbar pointing at a row scrolled out of view.
-    if (top < 0 || top > wrap.clientHeight - 8) {
-      toolVisible = false;
-      return;
-    }
-    toolTop = top;
+    const raw = row.getBoundingClientRect().top - wrap.getBoundingClientRect().top;
+    // Clamp rather than hide. The ring stays drawn whenever a target is live, so hiding
+    // the toolbar would leave a visible target with no route to act on it — which happens
+    // routinely for a block or selection taller than the pane, and whenever the user
+    // scrolls with a selection locked.
+    const maxTop = Math.max(0, wrap.clientHeight - TOOLBAR_CLEARANCE);
+    toolTop = Math.min(Math.max(raw, 0), maxTop);
     toolVisible = true;
   }
 

From 32bd524dd0ec339e4b236364c17fd28b0a603cd2 Mon Sep 17 00:00:00 2001
From: Ash Shah <494shah@gmail.com>
Date: Fri, 7 Aug 2026 10:38:23 -0700
Subject: [PATCH 18/41] docs: correct the split-view selection design after
 implementation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Implementation disproved the spec's claim that a paired split row could
select "as a unit". A paired row is a display artifact, so selecting one
emits non-contiguous ordinals and build_partial_hunk — which emits in
hunk source order — silently reorders the file. Verified against real git.

Selection now snaps to whole change blocks, enforced in the frontend and
refused outright by git-core as a second line of defence.

Also folds in two plan corrections made during execution: hover must clear
on the outer wrapper rather than the tbody, and the min-height/min-width
discrepancy in Task 5.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .../plans/2026-08-06-diff-hunk-affordance.md  | 15 ++++++++----
 .../2026-08-06-diff-hunk-affordance-design.md | 24 +++++++++++++++----
 2 files changed, 31 insertions(+), 8 deletions(-)

diff --git a/docs/superpowers/plans/2026-08-06-diff-hunk-affordance.md b/docs/superpowers/plans/2026-08-06-diff-hunk-affordance.md
index a100ff6..e2e5faf 100644
--- a/docs/superpowers/plans/2026-08-06-diff-hunk-affordance.md
+++ b/docs/superpowers/plans/2026-08-06-diff-hunk-affordance.md
@@ -216,7 +216,7 @@ export function ordsInRange(hunk: DiffHunk, from: number, to: number): number[]
 npx vitest run src/lib/diff/blocks.test.ts
 ```
 
-Expected: PASS — 14 tests.
+Expected: PASS — 13 tests.
 
 - [ ] **Step 5: Run the type gate**
 
@@ -636,7 +636,6 @@ with:
               <tbody
                 class="hunk"
                 class:hunk-hover={hasActions && hov?.fi === fi && hov?.hi === hi}
-                onmouseleave={clearHover}
               >
 ```
 
@@ -878,7 +877,8 @@ Replace:
 with:
 
 ```svelte
-        <div class="diff-table-outer">
+        <!-- svelte-ignore a11y_no_static_element_interactions -->
+        <div class="diff-table-outer" onmouseleave={clearHover}>
         <div
           class="diff-table-wrap"
           bind:this={wrapEls[fi]}
@@ -887,6 +887,13 @@ with:
           <table class="diff-table mono" class:split={appState.diffSplit}>
 ```
 
+**Hover must clear on THIS element, not on the `<tbody>`.** The toolbar lives outside the
+table, so a `mouseleave` on the `<tbody>` fires the moment the pointer travels from a row
+toward the toolbar — clearing `hov`, unmounting the toolbar, and making it unclickable.
+`.diff-table-outer` contains both the table and the toolbar, so the pointer can reach the
+buttons without leaving it. Moving between hunks still retargets correctly, because each
+row's `onmouseenter` updates `hov` on entry.
+
 and replace the matching close:
 
 ```svelte
@@ -972,7 +979,7 @@ Add to `DiffView.svelte`'s `<style>`:
   }
 ```
 
-Also add `flex: 1 1 auto; min-height: 0;` to the existing `.diff-table-wrap` rule if not already effective — it now sits inside `.diff-table-outer`:
+Also confirm the existing `.diff-table-wrap` rule reads as below — it now sits inside `.diff-table-outer`, so it needs `min-width: 0` for the row axis (its main-axis minimum is already 0 by virtue of being a scroll container):
 
 ```css
   .diff-table-wrap {
diff --git a/docs/superpowers/specs/2026-08-06-diff-hunk-affordance-design.md b/docs/superpowers/specs/2026-08-06-diff-hunk-affordance-design.md
index 862cf1a..9aa7cbc 100644
--- a/docs/superpowers/specs/2026-08-06-diff-hunk-affordance-design.md
+++ b/docs/superpowers/specs/2026-08-06-diff-hunk-affordance-design.md
@@ -147,10 +147,26 @@ horizontally scrolling diff. From outside it, `right: 14px` stays pinned. Its ve
 needs no separate arithmetic — and is recomputed on hover/selection change and on scroll. When the anchor row
 scrolls out of view the toolbar hides rather than floating.
 
-**Split view:** the ring spans the **full row width**, covering both columns. A paired row's change ordinals are
-the same set as in Unified, so `stage_lines` / `discard_lines` receive identical arguments in both modes and no
-backend branching is needed. Accepted cost: a paired row selects as a unit, so Split loses "stage the addition
-but not its deletion" precision. Unified retains it and is one toolbar click away.
+**Split view:** the ring spans the **full row width**, covering both columns, and **selection snaps to whole
+change blocks**.
+
+The snapping is a correctness requirement, not a stylistic choice — it was discovered during implementation and
+this paragraph replaces an earlier, wrong claim that "a paired row selects as a unit". A paired row is a
+*display artifact*: `toSplitRows` puts the Nth deletion beside the Nth addition because they fit on a line
+together, not because they correspond. Selecting one pair therefore emits **non-contiguous** ordinals — `[2,5]`
+for the third pair of a 3-deletion/3-addition block — and `build_partial_hunk` emits in hunk source order, so the
+restored line lands above the lines the user kept. Verified against real git: discarding that pair produced
+`ccc XXX YYY` instead of `XXX YYY ccc`, and `git apply` accepted the patch silently. Discard has no reflog entry
+and no backup bundle, so that was unrecoverable.
+
+The invariant: **only contiguous ordinal sets are correct.** Unified ranges are always contiguous (context rows
+carry no ordinal, so they open no gap). A whole block is contiguous, and so is any union of whole blocks, because
+ordinals run consecutively across a hunk. Only *partial* coverage of a mixed deletion/addition block breaks it —
+even two of three pairs yields `{0,1,3,4}`.
+
+Accepted cost: Split operates at block granularity. Unified keeps per-line precision and is one toolbar click
+away. `splitRangeSnappedToBlocks` in `src/lib/diff/splitRows.ts` enforces this, and `require_contiguous` in
+git-core refuses a gapped selection outright as a second line of defence.
 
 **Removed:** `.diff-row.selected` / `.split-cell.selected` CSS (`:889-896`), the `toggleLine` single-click
 handler and its `onkeydown` twin, and the hunk-header selection buttons (`:450-457`, `:471-478`). The original

From 4480001d540d94838f950e4a9e564d2cd6408464 Mon Sep 17 00:00:00 2001
From: Ash Shah <494shah@gmail.com>
Date: Fri, 7 Aug 2026 11:22:50 -0700
Subject: [PATCH 19/41] fix: make the init-repo test fixture collision-proof
 under parallel threads

TempFolder::new() named its directory git-it-init-test-{pid}-{nanos}. The
four initialize_repository tests run on parallel threads in one process, so
the pid is shared and two threads could read the same nanosecond; fs::create_dir
then failed with AlreadyExists and the unwrap() panicked. A different one of
the four failed on each run, which is what made it look random.

Replace the wall-clock stamp with a process-wide AtomicU32 counter, matching
the TempRepo fixtures in ops.rs and ops_worktree.rs. pid + counter cannot
collide by construction, so create_dir is kept over create_dir_all: a
collision should now be impossible, and would be a real bug worth panicking on.

Verified with five consecutive full cargo test runs, all green.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 crates/git-core/src/git_ops.rs | 24 +++++++++++++++---------
 1 file changed, 15 insertions(+), 9 deletions(-)

diff --git a/crates/git-core/src/git_ops.rs b/crates/git-core/src/git_ops.rs
index 4261a24..d4ef536 100644
--- a/crates/git-core/src/git_ops.rs
+++ b/crates/git-core/src/git_ops.rs
@@ -339,20 +339,26 @@ pub fn check_prerequisites(filter_repo_argv: &[String]) -> PrerequisiteCheck {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use std::time::{SystemTime, UNIX_EPOCH};
+    use std::sync::atomic::{AtomicU32, Ordering};
+
+    // These tests run on parallel threads within ONE process, so the pid alone does not
+    // make a path unique. A wall-clock stamp did not either: two threads could read the
+    // same nanosecond, `fs::create_dir` then failed with AlreadyExists, and the `unwrap()`
+    // panicked — a flake that hit a different test on each run. A process-wide counter is
+    // collision-proof by construction, and is the pattern the TempRepo fixtures in ops.rs
+    // and ops_worktree.rs already use.
+    static COUNTER: AtomicU32 = AtomicU32::new(0);
 
     struct TempFolder(PathBuf);
 
     impl TempFolder {
         fn new() -> Self {
-            let stamp = SystemTime::now()
-                .duration_since(UNIX_EPOCH)
-                .unwrap()
-                .as_nanos();
-            let path = std::env::temp_dir().join(format!(
-                "git-it-init-test-{}-{stamp}",
-                std::process::id()
-            ));
+            let id = COUNTER.fetch_add(1, Ordering::SeqCst);
+            let path = std::env::temp_dir()
+                .join(format!("git-it-init-test-{}-{}", std::process::id(), id));
+            // Deliberately `create_dir`, not `create_dir_all`: with pid + counter a
+            // collision is impossible, so if one ever happens it should panic loudly
+            // rather than be silently absorbed.
             fs::create_dir(&path).unwrap();
             Self(path)
         }

From 41ec3b554fa89484aa6d75b78504ec339d136012 Mon Sep 17 00:00:00 2001
From: Ash Shah <494shah@gmail.com>
Date: Fri, 7 Aug 2026 11:31:01 -0700
Subject: [PATCH 20/41] fix: track which list a working-copy file was selected
 in
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

selectedIsStaged asked "does this file have any staged content", so a
partially-staged (MM) file always showed its STAGED diff even when the user
clicked its Unstaged row. Every action gated on that flag was therefore
unavailable on the unstaged half: not just the new hunk/line Discard, but
hunk/line Stage too — both sides of the workflow the feature exists for.

Selection now records the section the row was clicked in, the same
discriminator onRowContext already used for its menu. resolveSection() picks
the section to display, falling back to wherever the file went if it has left
the clicked one (staging all of it, say) rather than stranding an empty diff.
Row highlight follows the resolved section, so an MM file highlights only the
row being diffed instead of both.

Discarding unstaged lines of a partially-staged file reverts them to the
staged version rather than to HEAD, so the confirm dialog now says that
instead of claiming the change is permanently lost.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 src/lib/components/WorkingCopyView.svelte | 115 +++++++++++++---------
 src/lib/gitActions.ts                     |  29 +++++-
 src/lib/store.svelte.ts                   |  20 ++--
 src/lib/workingSection.test.ts            |  66 +++++++++++++
 src/lib/workingSection.ts                 |  46 +++++++++
 5 files changed, 222 insertions(+), 54 deletions(-)
 create mode 100644 src/lib/workingSection.test.ts
 create mode 100644 src/lib/workingSection.ts

diff --git a/src/lib/components/WorkingCopyView.svelte b/src/lib/components/WorkingCopyView.svelte
index b5ec616..ccd668d 100644
--- a/src/lib/components/WorkingCopyView.svelte
+++ b/src/lib/components/WorkingCopyView.svelte
@@ -8,6 +8,7 @@
   import CommitComposer from "./CommitComposer.svelte";
   import FileTree from "./FileTree.svelte";
   import { buildFileTree } from "../fileTree";
+  import { resolveSection, type WorkingSection } from "../workingSection";
   import type { WorkingFile } from "../types";
   import { crossfade, fade } from "svelte/transition";
   import { flip } from "svelte/animate";
@@ -59,29 +60,40 @@
 
   const selectedFile = $derived(appState.selectedFile);
 
-  // Determine whether the selected file is in the staged section (governs which
-  // diff half to fetch and which hunk callbacks to wire).
-  const selectedIsStaged = $derived(
-    selectedFile !== null && stagedFiles.some((f) => f.path === selectedFile),
-  );
+  // Which sections currently hold the selected path. A partially-staged file is in two
+  // of them at once — which is precisely why the clicked section has to be recorded.
+  const presence = $derived({
+    staged: selectedFile !== null && stagedFiles.some((f) => f.path === selectedFile),
+    unstaged: selectedFile !== null && unstagedFiles.some((f) => f.path === selectedFile),
+    untracked: selectedFile !== null && untrackedFiles.some((f) => f.path === selectedFile),
+  });
 
-  // Untracked files have no index entry, so the regular diff is empty — they need
-  // the `git diff --no-index` path (and hunk/line staging doesn't apply to them).
-  const selectedIsUntracked = $derived(
-    selectedFile !== null && untrackedFiles.some((f) => f.path === selectedFile),
+  // The section the pane actually shows: the one the user clicked, or — if the file has
+  // since left it (they staged all of it, say) — wherever it went. See resolveSection().
+  const section = $derived(
+    selectedFile === null ? null : resolveSection(appState.selectedSection, presence),
   );
 
-  // Whether the selected file is a tracked, modified (non-untracked) unstaged file.
-  const selectedIsUnstaged = $derived(
-    selectedFile !== null && unstagedFiles.some((f) => f.path === selectedFile),
-  );
+  // Governs which diff half to fetch and which hunk callbacks to wire. Deliberately
+  // section-based rather than "does this file have anything staged": the latter shows
+  // the staged diff for a partially-staged file even when the user clicked its Unstaged
+  // row, which hid Stage/Discard on the very half those actions exist for.
+  const selectedIsStaged = $derived(section === "staged");
 
-  // Whether the selected file is displayed in the Unstaged section. In unified mode
-  // that section also lists untracked files, so a selected untracked file counts too.
-  // Drives the Unstaged header button's Fork-style "Stage" vs "Stage all".
-  const selectedInUnstagedSection = $derived(
-    selectedIsUnstaged || (appState.unifyUnstaged && selectedIsUntracked),
-  );
+  // Untracked files have no index entry, so the regular diff is empty — they need the
+  // `git diff --no-index` path (and hunk/line staging doesn't apply to them). This is a
+  // property of the FILE, not of the section: with unifyUnstaged on, an untracked file
+  // is rendered in the Unstaged list but still needs --no-index.
+  const selectedIsUntracked = $derived(presence.untracked);
+
+  // Whether the selected file is displayed in the Unstaged section. Untracked rows
+  // report "unstaged" when unifyUnstaged merges them there, so no special case is
+  // needed. Drives the Unstaged header's Fork-style "Stage" vs "Stage all".
+  const selectedInUnstagedSection = $derived(section === "unstaged");
+
+  // The unstaged half of a partially-staged file. Discarding here reverts the lines to
+  // the STAGED version rather than to HEAD, and the confirm dialog says so.
+  const selectedHasStagedCounterpart = $derived(section !== "staged" && presence.staged);
 
   // Raw patch for the selected file. Re-fetches whenever selectedFile changes OR
   // workingChanges is refreshed (after every op, including hunk ops). We key on a
@@ -90,7 +102,7 @@
   // hunks on the backend — also triggers a re-fetch and prevents stale hunk indices.
   const diffKey = $derived(
     selectedFile !== null
-      ? `${selectedFile}::${selectedIsStaged ? "staged" : selectedIsUntracked ? "untracked" : "unstaged"}::${appState.workingChangesRev}::${appState.effectiveDiffContext}`
+      ? `${selectedFile}::${section}::${selectedIsUntracked}::${appState.workingChangesRev}::${appState.effectiveDiffContext}`
       : "",
   );
 
@@ -157,8 +169,18 @@
 
   // ── Row click ───────────────────────────────────────────────────────────────
 
-  function selectFile(path: string) {
-    appState.setSelectedFile(path === selectedFile ? null : path);
+  // Clicking the already-selected row toggles the selection off. "Already-selected"
+  // means the same path IN THE SAME SECTION, so clicking a partially-staged file's
+  // other row switches sides rather than deselecting.
+  function selectFile(path: string, rowSection: WorkingSection) {
+    const same = selectedFile === path && section === rowSection;
+    appState.setSelectedFile(same ? null : { path, section: rowSection });
+  }
+
+  /** Does this row own the current selection? Compares the resolved section, so an
+   *  `MM` file highlights only the row that is actually being diffed. */
+  function isSelectedRow(path: string, rowSection: WorkingSection): boolean {
+    return selectedFile === path && section === rowSection;
   }
 
   // ── Right-click context menu (Fork-style) ────────────────────────────────────
@@ -177,8 +199,11 @@
     const seq = ++ctxSeq;
     const { clientX, clientY } = e;
     // Select the row so the diff pane follows the right-click. selectFile toggles
-    // off when re-clicking the selected row, so only set it if not already selected.
-    if (selectedFile !== f.path) appState.setSelectedFile(f.path);
+    // off when re-clicking the selected row, so only set it if not already selected —
+    // and re-select when the same path is right-clicked in its OTHER section.
+    if (!isSelectedRow(f.path, section)) {
+      appState.setSelectedFile({ path: f.path, section });
+    }
 
     // File actions (Tauri only). A deleted file has no on-disk target, so Open /
     // Open With are disabled and Show in Finder opens the containing folder instead
@@ -278,14 +303,14 @@
   <!-- svelte-ignore a11y_no_noninteractive_element_interactions -->
   <div
     class="file-row"
-    class:selected={selectedFile === f.path}
+    class:selected={isSelectedRow(f.path, "staged")}
     role="row"
     tabindex="0"
     style={`padding-left:${ind}px`}
-    onmousedown={() => selectFile(f.path)}
+    onmousedown={() => selectFile(f.path, "staged")}
     oncontextmenu={(e) => onRowContext(e, f, "staged")}
     onkeydown={(e) => {
-      if (e.key === "Enter" || e.key === " ") selectFile(f.path);
+      if (e.key === "Enter" || e.key === " ") selectFile(f.path, "staged");
     }}
   >
     <span class="glyph {glyphClass(f)}">{glyph(f)}</span>
@@ -297,14 +322,14 @@
   <!-- svelte-ignore a11y_no_noninteractive_element_interactions -->
   <div
     class="file-row"
-    class:selected={selectedFile === f.path}
+    class:selected={isSelectedRow(f.path, "unstaged")}
     role="row"
     tabindex="0"
     style={`padding-left:${ind}px`}
-    onmousedown={() => selectFile(f.path)}
+    onmousedown={() => selectFile(f.path, "unstaged")}
     oncontextmenu={(e) => onRowContext(e, f, "unstaged")}
     onkeydown={(e) => {
-      if (e.key === "Enter" || e.key === " ") selectFile(f.path);
+      if (e.key === "Enter" || e.key === " ") selectFile(f.path, "unstaged");
     }}
   >
     <span class="glyph {glyphClass(f)}">{glyph(f)}</span>
@@ -316,14 +341,14 @@
   <!-- svelte-ignore a11y_no_noninteractive_element_interactions -->
   <div
     class="file-row"
-    class:selected={selectedFile === f.path}
+    class:selected={isSelectedRow(f.path, "untracked")}
     role="row"
     tabindex="0"
     style={`padding-left:${ind}px`}
-    onmousedown={() => selectFile(f.path)}
+    onmousedown={() => selectFile(f.path, "untracked")}
     oncontextmenu={(e) => onRowContext(e, f, "untracked")}
     onkeydown={(e) => {
-      if (e.key === "Enter" || e.key === " ") selectFile(f.path);
+      if (e.key === "Enter" || e.key === " ") selectFile(f.path, "untracked");
     }}
   >
     <span class="glyph {glyphClass(f)}">{glyph(f)}</span>
@@ -391,16 +416,16 @@
             {#each stagedFiles as f (f.path)}
               <li
                 class="file-row"
-                class:selected={selectedFile === f.path}
+                class:selected={isSelectedRow(f.path, "staged")}
                 role="row"
                 tabindex="0"
                 in:receive|global={{ key: f.path }}
                 out:send|global={{ key: f.path }}
                 animate:flip={FLIP}
-                onmousedown={() => selectFile(f.path)}
+                onmousedown={() => selectFile(f.path, "staged")}
                 oncontextmenu={(e) => onRowContext(e, f, "staged")}
                 onkeydown={(e) => {
-                  if (e.key === "Enter" || e.key === " ") selectFile(f.path);
+                  if (e.key === "Enter" || e.key === " ") selectFile(f.path, "staged");
                 }}
               >
                 <span class="glyph {glyphClass(f)}">{glyph(f)}</span>
@@ -447,16 +472,16 @@
             {#each unstagedDisplay as f (f.path)}
               <li
                 class="file-row"
-                class:selected={selectedFile === f.path}
+                class:selected={isSelectedRow(f.path, "unstaged")}
                 role="row"
                 tabindex="0"
                 in:receive|global={{ key: f.path }}
                 out:send|global={{ key: f.path }}
                 animate:flip={FLIP}
-                onmousedown={() => selectFile(f.path)}
+                onmousedown={() => selectFile(f.path, "unstaged")}
                 oncontextmenu={(e) => onRowContext(e, f, "unstaged")}
                 onkeydown={(e) => {
-                  if (e.key === "Enter" || e.key === " ") selectFile(f.path);
+                  if (e.key === "Enter" || e.key === " ") selectFile(f.path, "unstaged");
                 }}
               >
                 <span class="glyph {glyphClass(f)}">{glyph(f)}</span>
@@ -505,16 +530,16 @@
               {#each untrackedFiles as f (f.path)}
                 <li
                   class="file-row"
-                  class:selected={selectedFile === f.path}
+                  class:selected={isSelectedRow(f.path, "untracked")}
                   role="row"
                   tabindex="0"
                   in:receive|global={{ key: f.path }}
                   out:send|global={{ key: f.path }}
                   animate:flip={FLIP}
-                  onmousedown={() => selectFile(f.path)}
+                  onmousedown={() => selectFile(f.path, "untracked")}
                   oncontextmenu={(e) => onRowContext(e, f, "untracked")}
                   onkeydown={(e) => {
-                    if (e.key === "Enter" || e.key === " ") selectFile(f.path);
+                    if (e.key === "Enter" || e.key === " ") selectFile(f.path, "untracked");
                   }}
                 >
                   <span class="glyph {glyphClass(f)}">{glyph(f)}</span>
@@ -563,10 +588,12 @@
               : undefined}
             onDiscardHunk={selectedIsStaged || selectedIsUntracked
               ? undefined
-              : (i, n) => gitActions.discardHunk(selectedFile!, i, n)}
+              : (i, n) =>
+                  gitActions.discardHunk(selectedFile!, i, n, selectedHasStagedCounterpart)}
             onDiscardLines={selectedIsStaged || selectedIsUntracked
               ? undefined
-              : (hi, sel) => gitActions.discardLines(selectedFile!, hi, sel)}
+              : (hi, sel) =>
+                  gitActions.discardLines(selectedFile!, hi, sel, selectedHasStagedCounterpart)}
           />
         {/if}
       </div>
diff --git a/src/lib/gitActions.ts b/src/lib/gitActions.ts
index 6ad8532..088758a 100644
--- a/src/lib/gitActions.ts
+++ b/src/lib/gitActions.ts
@@ -518,6 +518,17 @@ async function runResolve(label: string, fn: () => Promise<unknown>): Promise<bo
   }
 }
 
+// Confirm copy for a partial discard. Discarding UNSTAGED lines reverse-applies against
+// the index, so when the same file also has staged content the lines fall back to the
+// staged version rather than vanishing — saying "permanently" there would overstate it.
+// With nothing staged, the index matches HEAD and the change really is gone for good.
+function discardMessage(n: number, unit: string, path: string, revertsToIndex: boolean): string {
+  const what = `${n} ${unit}${n === 1 ? "" : "s"} in ${path}`;
+  return revertsToIndex
+    ? `Discard ${what}? They revert to your staged version of this file. This cannot be undone.`
+    : `Permanently discard ${what}. This cannot be undone. (Stash instead to keep them.)`;
+}
+
 // Run a working-copy op (non-destructive): guard → run → refresh working changes + graph.
 async function runWorktree(label: string, fn: () => Promise<unknown>): Promise<boolean> {
   if (!isTauri()) {
@@ -874,7 +885,12 @@ export const gitActions = {
   // file-level `discard` below: uncommitted work is not in the reflog, so there is
   // no backup bundle to take. Guard BEFORE confirming so the browser preview never
   // shows a dialog it cannot honour.
-  discardHunk: async (path: string, hunkIndex: number, changedLines: number): Promise<boolean> => {
+  discardHunk: async (
+    path: string,
+    hunkIndex: number,
+    changedLines: number,
+    revertsToIndex = false,
+  ): Promise<boolean> => {
     if (!isTauri()) {
       appState.status = "That action needs the desktop app (not the browser preview).";
       return false;
@@ -889,7 +905,7 @@ export const gitActions = {
     const n = changedLines;
     const confirmed = await dialogs.confirm({
       title: "Discard hunk",
-      message: `Permanently discard ${n} changed line${n === 1 ? "" : "s"} in ${path}. This cannot be undone. (Stash instead to keep them.)`,
+      message: discardMessage(n, "changed line", path, revertsToIndex),
       confirmLabel: "Discard",
       danger: true,
     });
@@ -898,7 +914,12 @@ export const gitActions = {
       api.discardHunk(appState.repo, path, hunkIndex, appState.effectiveDiffContext),
     );
   },
-  discardLines: async (path: string, hunkIndex: number, selected: number[]): Promise<boolean> => {
+  discardLines: async (
+    path: string,
+    hunkIndex: number,
+    selected: number[],
+    revertsToIndex = false,
+  ): Promise<boolean> => {
     if (!isTauri()) {
       appState.status = "That action needs the desktop app (not the browser preview).";
       return false;
@@ -910,7 +931,7 @@ export const gitActions = {
     const n = selected.length;
     const confirmed = await dialogs.confirm({
       title: "Discard lines",
-      message: `Permanently discard ${n} line${n === 1 ? "" : "s"} in ${path}. This cannot be undone. (Stash instead to keep them.)`,
+      message: discardMessage(n, "line", path, revertsToIndex),
       confirmLabel: "Discard",
       danger: true,
     });
diff --git a/src/lib/store.svelte.ts b/src/lib/store.svelte.ts
index 185ff36..ff4ba58 100644
--- a/src/lib/store.svelte.ts
+++ b/src/lib/store.svelte.ts
@@ -2,6 +2,7 @@
 // Components import this module and read/write fields directly.
 import type { Commit, GraphCommit, Ref, RefEntry, RemoteInfo, RepoStatus, UndoSnapshot, WorkingFile, WorktreeInfo } from "./types";
 import type { DateFormatPrefs } from "./dates";
+import type { WorkingSection } from "./workingSection";
 import type { Store } from "@tauri-apps/plugin-store";
 import {
   computeLanes,
@@ -1102,13 +1103,16 @@ function makeState() {
   // workingChanges: the live file list from `git status`.
   // workingChangesRev: monotonic counter bumped on every refresh so diff effects
   //   re-run after hunk ops (which don't change the file COUNT but do re-index hunks).
-  // selectedFile: which file is being diffed in the working-copy panel.
+  // selected: which file is being diffed in the working-copy panel, AND which list it
+  //   was clicked in. The section is not decoration: a partially-staged file appears in
+  //   both Staged and Unstaged, and the two halves need different diffs and different
+  //   actions, so a path alone cannot identify what the user opened.
   // activeView: which main screen is showing — "timeline" (graph + commit detail) or
   // "changes" (the Local Changes / working-copy screen). Replaces the old
   // workingCopySelected boolean (kept as a derived getter for existing call sites).
   let workingChanges = $state<WorkingFile[]>([]);
   let workingChangesRev = $state(0);
-  let selectedFile = $state<string | null>(null);
+  let workingSelection = $state<{ path: string; section: WorkingSection } | null>(null);
   let activeView = $state<"timeline" | "changes" | "github">("timeline");
   // Transient (non-persisted) suggested commit message, set by squash-merge to
   // prefill the CommitComposer before the user edits/commits.
@@ -1656,7 +1660,7 @@ function makeState() {
         repoLoading = v !== "";
         // Transient / selection state belongs to the previous repo — always reset.
         lastUndo = null;
-        selectedFile = null;
+        workingSelection = null;
         activeView = "timeline";
         suggestedCommitMessage = "";
         remoteOpActive = false;
@@ -1952,10 +1956,14 @@ function makeState() {
       return workingChangesRev;
     },
     get selectedFile() {
-      return selectedFile;
+      return workingSelection?.path ?? null;
     },
-    setSelectedFile(v: string | null) {
-      selectedFile = v;
+    /** The list the selection was made in. Null when nothing is selected. */
+    get selectedSection(): WorkingSection | null {
+      return workingSelection?.section ?? null;
+    },
+    setSelectedFile(v: { path: string; section: WorkingSection } | null) {
+      workingSelection = v;
     },
     get workingCopySelected() {
       // Back-compat shim: working-copy "row focus" now maps onto activeView.
diff --git a/src/lib/workingSection.test.ts b/src/lib/workingSection.test.ts
new file mode 100644
index 0000000..77eb60a
--- /dev/null
+++ b/src/lib/workingSection.test.ts
@@ -0,0 +1,66 @@
+import { describe, it, expect } from "vitest";
+import { resolveSection, type SectionPresence, type WorkingSection } from "./workingSection";
+
+const present = (p: Partial<SectionPresence> = {}): SectionPresence => ({
+  staged: false,
+  unstaged: false,
+  untracked: false,
+  ...p,
+});
+
+describe("resolveSection", () => {
+  it("keeps the clicked section when the file is still in it", () => {
+    // The case the whole type exists for: a partially-staged file is in BOTH lists,
+    // and clicking the Unstaged row must not resolve to "staged".
+    const both = present({ staged: true, unstaged: true });
+    expect(resolveSection("unstaged", both)).toBe("unstaged");
+    expect(resolveSection("staged", both)).toBe("staged");
+  });
+
+  it("follows the file to Staged after all of it has been staged", () => {
+    expect(resolveSection("unstaged", present({ staged: true }))).toBe("staged");
+  });
+
+  it("follows the file to Unstaged after it has been unstaged", () => {
+    expect(resolveSection("staged", present({ unstaged: true }))).toBe("unstaged");
+  });
+
+  it("follows an untracked file into the Unstaged list when it is merged there", () => {
+    // "Merge Untracked into Unstaged" renders untracked rows as unstaged; the row
+    // reports "unstaged" while presence still says untracked.
+    expect(resolveSection("unstaged", present({ untracked: true }))).toBe("untracked");
+  });
+
+  it("prefers unstaged over staged when the file somehow left the clicked section and is in both", () => {
+    expect(resolveSection("untracked", present({ staged: true, unstaged: true }))).toBe("unstaged");
+  });
+
+  it("returns null when the path is in no section", () => {
+    expect(resolveSection("unstaged", present())).toBeNull();
+    expect(resolveSection(null, present())).toBeNull();
+  });
+
+  it("resolves without a clicked section by falling back to whatever holds the file", () => {
+    expect(resolveSection(null, present({ staged: true }))).toBe("staged");
+    expect(resolveSection(null, present({ untracked: true }))).toBe("untracked");
+  });
+
+  it("never returns a section the file is absent from", () => {
+    const SECTIONS: (WorkingSection | null)[] = ["staged", "unstaged", "untracked", null];
+    for (const clicked of SECTIONS) {
+      for (const s of [true, false]) {
+        for (const u of [true, false]) {
+          for (const t of [true, false]) {
+            const p = present({ staged: s, unstaged: u, untracked: t });
+            const got = resolveSection(clicked, p);
+            if (got === null) {
+              expect(s || u || t, `clicked=${clicked} presence=${s}/${u}/${t}`).toBe(false);
+            } else {
+              expect(p[got], `clicked=${clicked} presence=${s}/${u}/${t} -> ${got}`).toBe(true);
+            }
+          }
+        }
+      }
+    }
+  });
+});
diff --git a/src/lib/workingSection.ts b/src/lib/workingSection.ts
new file mode 100644
index 0000000..f9a7b4e
--- /dev/null
+++ b/src/lib/workingSection.ts
@@ -0,0 +1,46 @@
+/**
+ * Which list of the working-copy screen a file was selected in.
+ *
+ * A partially-staged file (`MM`) appears in BOTH the Staged and the Unstaged list, so a
+ * path alone cannot say which half the user opened — and the two halves need different
+ * diffs and different actions (Unstage on one side, Stage/Discard on the other). Rows
+ * therefore carry their section, and the selection records it.
+ *
+ * "untracked" is a section, not a file property: with "Merge Untracked into Unstaged"
+ * enabled, untracked files are rendered in the Unstaged list and their rows report
+ * `"unstaged"`. Whether a file needs the `--no-index` diff is a separate question,
+ * answered by the file itself.
+ */
+export type WorkingSection = "staged" | "unstaged" | "untracked";
+
+/** Which sections currently contain a given path. */
+export interface SectionPresence {
+  staged: boolean;
+  unstaged: boolean;
+  untracked: boolean;
+}
+
+/**
+ * The section the diff pane should actually show for the selected file.
+ *
+ * Normally this is just the section the user clicked. But the file can leave that
+ * section under them — staging all of a partially-staged file removes it from Unstaged,
+ * and unstaging removes it from Staged. Rather than stranding the pane on an empty diff
+ * with no visible selected row, follow the file to whichever section still holds it.
+ *
+ * Returns null when the path is in no section at all (it was committed, discarded, or
+ * the refresh dropped it), which callers render as "no selection".
+ */
+export function resolveSection(
+  clicked: WorkingSection | null,
+  present: SectionPresence,
+): WorkingSection | null {
+  if (clicked !== null && present[clicked]) return clicked;
+  // Preference order matters only for a file that left its section. Unstaged first so
+  // that unstaging a file lands on the half that now holds the change; a file that left
+  // Unstaged (fully staged) falls through to Staged.
+  if (present.unstaged) return "unstaged";
+  if (present.untracked) return "untracked";
+  if (present.staged) return "staged";
+  return null;
+}

From 0981c3645eb06d138c384e982c93f96e845ee694 Mon Sep 17 00:00:00 2001
From: Ash Shah <494shah@gmail.com>
Date: Fri, 7 Aug 2026 11:36:37 -0700
Subject: [PATCH 21/41] fix: resolve merged untracked rows to the list they are
 rendered in
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

presence.unstaged checked unstagedFiles, which excludes untracked, while the
rendered Unstaged list is unstagedDisplay, which includes them when "Merge
Untracked into Unstaged" is on. A merged untracked row therefore reported
section "unstaged" but resolved to "untracked" — a section with no rows in
that mode — so the selected row never highlighted, clicking it again could
not deselect, and the Unstaged header fell back to "Stage all".

Sections are rendered lists, not file states, so presence now describes what
is on screen. Two comments that asserted the opposite are corrected.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 src/lib/components/WorkingCopyView.svelte | 16 ++++++++++------
 src/lib/gitActions.ts                     |  2 +-
 src/lib/workingSection.test.ts            | 16 ++++++++++++----
 src/lib/workingSection.ts                 | 13 ++++++++++++-
 4 files changed, 35 insertions(+), 12 deletions(-)

diff --git a/src/lib/components/WorkingCopyView.svelte b/src/lib/components/WorkingCopyView.svelte
index ccd668d..20b53ab 100644
--- a/src/lib/components/WorkingCopyView.svelte
+++ b/src/lib/components/WorkingCopyView.svelte
@@ -60,11 +60,15 @@
 
   const selectedFile = $derived(appState.selectedFile);
 
-  // Which sections currently hold the selected path. A partially-staged file is in two
-  // of them at once — which is precisely why the clicked section has to be recorded.
+  // Which RENDERED lists currently hold the selected path — sections are lists on screen,
+  // not file states. A partially-staged file is in two of them at once, which is precisely
+  // why the clicked section has to be recorded. Note `unstagedDisplay`, not `unstagedFiles`:
+  // with unifyUnstaged on, untracked rows are rendered in the Unstaged list and report
+  // "unstaged", so presence has to agree or the selection resolves to a section that has
+  // no rows in that mode.
   const presence = $derived({
     staged: selectedFile !== null && stagedFiles.some((f) => f.path === selectedFile),
-    unstaged: selectedFile !== null && unstagedFiles.some((f) => f.path === selectedFile),
+    unstaged: selectedFile !== null && unstagedDisplay.some((f) => f.path === selectedFile),
     untracked: selectedFile !== null && untrackedFiles.some((f) => f.path === selectedFile),
   });
 
@@ -86,9 +90,9 @@
   // is rendered in the Unstaged list but still needs --no-index.
   const selectedIsUntracked = $derived(presence.untracked);
 
-  // Whether the selected file is displayed in the Unstaged section. Untracked rows
-  // report "unstaged" when unifyUnstaged merges them there, so no special case is
-  // needed. Drives the Unstaged header's Fork-style "Stage" vs "Stage all".
+  // Whether the selected file is displayed in the Unstaged section — including an
+  // untracked file that unifyUnstaged has merged into that list, which `presence.unstaged`
+  // accounts for. Drives the Unstaged header's Fork-style "Stage" vs "Stage all".
   const selectedInUnstagedSection = $derived(section === "unstaged");
 
   // The unstaged half of a partially-staged file. Discarding here reverts the lines to
diff --git a/src/lib/gitActions.ts b/src/lib/gitActions.ts
index 088758a..5945cfb 100644
--- a/src/lib/gitActions.ts
+++ b/src/lib/gitActions.ts
@@ -525,7 +525,7 @@ async function runResolve(label: string, fn: () => Promise<unknown>): Promise<bo
 function discardMessage(n: number, unit: string, path: string, revertsToIndex: boolean): string {
   const what = `${n} ${unit}${n === 1 ? "" : "s"} in ${path}`;
   return revertsToIndex
-    ? `Discard ${what}? They revert to your staged version of this file. This cannot be undone.`
+    ? `Discard ${what}. They revert to your staged version of this file. This cannot be undone.`
     : `Permanently discard ${what}. This cannot be undone. (Stash instead to keep them.)`;
 }
 
diff --git a/src/lib/workingSection.test.ts b/src/lib/workingSection.test.ts
index 77eb60a..a8a75f5 100644
--- a/src/lib/workingSection.test.ts
+++ b/src/lib/workingSection.test.ts
@@ -25,10 +25,18 @@ describe("resolveSection", () => {
     expect(resolveSection("staged", present({ unstaged: true }))).toBe("unstaged");
   });
 
-  it("follows an untracked file into the Unstaged list when it is merged there", () => {
-    // "Merge Untracked into Unstaged" renders untracked rows as unstaged; the row
-    // reports "unstaged" while presence still says untracked.
-    expect(resolveSection("unstaged", present({ untracked: true }))).toBe("untracked");
+  it("keeps a merged untracked row in the Unstaged list it is rendered in", () => {
+    // "Merge Untracked into Unstaged" renders untracked rows in the Unstaged list, so
+    // the row reports "unstaged" AND presence.unstaged is true. Resolving to "untracked"
+    // here would name a section that has no rows in that mode, leaving the selected row
+    // unhighlighted and the header button acting on the whole list.
+    expect(resolveSection("unstaged", present({ unstaged: true, untracked: true }))).toBe(
+      "unstaged",
+    );
+  });
+
+  it("resolves an untracked file to its own section when the lists are separate", () => {
+    expect(resolveSection("untracked", present({ untracked: true }))).toBe("untracked");
   });
 
   it("prefers unstaged over staged when the file somehow left the clicked section and is in both", () => {
diff --git a/src/lib/workingSection.ts b/src/lib/workingSection.ts
index f9a7b4e..01c009f 100644
--- a/src/lib/workingSection.ts
+++ b/src/lib/workingSection.ts
@@ -13,7 +13,14 @@
  */
 export type WorkingSection = "staged" | "unstaged" | "untracked";
 
-/** Which sections currently contain a given path. */
+/**
+ * Which RENDERED lists currently contain a given path.
+ *
+ * These describe what is on screen, not file states. In particular `unstaged` must be
+ * true for an untracked file when "Merge Untracked into Unstaged" is on, because the
+ * row is rendered in that list and reports `"unstaged"` — otherwise the selection
+ * resolves to a section that has no rows in that mode.
+ */
 export interface SectionPresence {
   staged: boolean;
   unstaged: boolean;
@@ -28,6 +35,10 @@ export interface SectionPresence {
  * and unstaging removes it from Staged. Rather than stranding the pane on an empty diff
  * with no visible selected row, follow the file to whichever section still holds it.
  *
+ * The caller's recorded section is deliberately NOT rewritten when a follow happens, so
+ * the original intent survives: if the file later regains content in the section the user
+ * actually clicked, the pane returns there rather than staying where it drifted.
+ *
  * Returns null when the path is in no section at all (it was committed, discarded, or
  * the refresh dropped it), which callers render as "no selection".
  */

From 36547f7827892206b1d719b7858f256741b64a6b Mon Sep 17 00:00:00 2001
From: Ash Shah <494shah@gmail.com>
Date: Sat, 8 Aug 2026 10:59:48 -0700
Subject: [PATCH 22/41] fix: pin hunk actions to the hunk header bar

Hunk-scope actions anchored to hov.ri, so every context row the pointer
crossed re-anchored the toolbar and it chased the cursor down the hunk.
That anchor existed to stop the toolbar hiding on hunks taller than the
pane; clamping (d8b84c6) now covers that, so the anchor can be stable.

Hunk actions now sit on the hunk's own @@ header bar, where their scope is
written. Block and selection actions still anchor to their ring, so the
toolbar's position says which of the two you are targeting.

The header row gains data-h/data-i as the anchor, which also made it match
the arrow-key row query; that selector is narrowed to .diff-row so ArrowDown
cannot land on a non-focusable header and dead-end.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 src/lib/components/DiffView.svelte | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/src/lib/components/DiffView.svelte b/src/lib/components/DiffView.svelte
index 715cb09..6e586b4 100644
--- a/src/lib/components/DiffView.svelte
+++ b/src/lib/components/DiffView.svelte
@@ -47,7 +47,15 @@
   // Hovered unit. `block` is the index into blocksForView(hunk), or null on a context
   // row (which targets the whole hunk instead). `ri` is the row itself, kept so the
   // hunk-scope toolbar can anchor to a row the user can actually see.
-  let hov = $state<{ fi: number; hi: number; ri: number; block: number | null } | null>(null);
+  let hov = $state<{ fi: number; hi: number; block: number | null } | null>(null);
+
+  /**
+   * Sentinel `data-i` for a hunk's header row (the `@@ … @@` bar). Real row indices are
+   * >= 0, so -1 can't collide. Hunk-scope actions anchor here rather than to whichever
+   * line the pointer happens to be on: every context row would otherwise re-anchor the
+   * toolbar, making it chase the cursor down the hunk.
+   */
+  const HUNK_HEADER_ROW = -1;
 
   /**
    * Row indices mean different things per view: in unified they index `hunk.lines`,
@@ -70,7 +78,7 @@
     const h = parsed.files[fi]?.hunks[hi];
     if (!h) return;
     const block = appState.diffSplit ? splitBlockAt(toSplitRows(h), ri) : blockAt(h, ri);
-    hov = { fi, hi, ri, block };
+    hov = { fi, hi, block };
   }
 
   function clearHover() {
@@ -124,7 +132,7 @@
     }
     // Anchor to the hovered row, not row 0: a hunk taller than the pane would otherwise
     // put its anchor off-screen and `measureTool` would hide the toolbar entirely.
-    return { fi: hov.fi, hi: hov.hi, scope: "hunk", ords: null, anchorRow: hov.ri };
+    return { fi: hov.fi, hi: hov.hi, scope: "hunk", ords: null, anchorRow: HUNK_HEADER_ROW };
   }
 
   function runAction(kind: "stage" | "unstage" | "discard") {
@@ -476,7 +484,9 @@
       if (!wrap) return;
       // Querying the DOM keeps this correct across hunk boundaries without duplicating
       // the unified/split row-space logic — the rendered order IS the navigation order.
-      const rows = [...wrap.querySelectorAll<HTMLElement>("tr[data-h][data-i]")];
+      // `.diff-row` excludes the hunk-header rows, which also carry data-h/data-i (as the
+      // toolbar's anchor) but are not focusable — arrowing onto one would dead-end.
+      const rows = [...wrap.querySelectorAll<HTMLElement>("tr.diff-row[data-h][data-i]")];
       const cur = rows.findIndex(
         (el) => el.dataset.h === String(hi) && el.dataset.i === String(ri),
       );
@@ -648,7 +658,7 @@
                 class:hunk-hover={hasActions && !sel && hov?.fi === fi && hov?.hi === hi}
               >
                 <!-- Hunk header row -->
-                <tr class="hunk-header-row">
+                <tr class="hunk-header-row" data-h={hi} data-i={HUNK_HEADER_ROW}>
                   {#if appState.diffSplit}
                     <td class="hunk-header-cell" colspan="4">
                       <span class="hunk-range">{hunk.header}</span>

From 57202ce14362ad0127a463c41904050ddcb4c48f Mon Sep 17 00:00:00 2001
From: Ash Shah <494shah@gmail.com>
Date: Sat, 8 Aug 2026 11:33:45 -0700
Subject: [PATCH 23/41] fix: clear a stale init-repo fixture directory before
 creating it
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The previous commit claimed pid + counter "cannot collide by construction"
and kept `create_dir` over `create_dir_all` on that basis. That reasoning
only holds among LIVE processes. The counter restarts at zero every run, so
uniqueness rests entirely on the pid never repeating — and a pid is unique
only while its process is alive. A run killed before `Drop` (Ctrl-C on
cargo test, or a panic=abort) leaves its directories behind; once the OS
recycles that pid, a fresh process counting from zero reproduces the exact
same path and `create_dir(...).unwrap()` panics with AlreadyExists.

Not hypothetical: this machine currently holds 36 orphaned `gte-*` fixture
directories spanning 18 distinct pids.

Remove any leftover first, then `create_dir_all` — the same two lines the
TempRepo fixtures in ops.rs, ops_worktree.rs, ops_merge.rs, ops_rewrite.rs
and graph.rs already use. Those fixtures were right and this one was the
outlier; the extra line is the point, not redundancy.

Reported by Codex review on #25. cargo test -p git-core: 183 passed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 crates/git-core/src/git_ops.rs | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/crates/git-core/src/git_ops.rs b/crates/git-core/src/git_ops.rs
index d4ef536..771a7c4 100644
--- a/crates/git-core/src/git_ops.rs
+++ b/crates/git-core/src/git_ops.rs
@@ -356,10 +356,12 @@ mod tests {
             let id = COUNTER.fetch_add(1, Ordering::SeqCst);
             let path = std::env::temp_dir()
                 .join(format!("git-it-init-test-{}-{}", std::process::id(), id));
-            // Deliberately `create_dir`, not `create_dir_all`: with pid + counter a
-            // collision is impossible, so if one ever happens it should panic loudly
-            // rather than be silently absorbed.
-            fs::create_dir(&path).unwrap();
+            // pid + counter is unique among LIVE processes, but not against the dead: a run
+            // killed before `Drop` leaves its directories behind, and once the OS recycles
+            // that pid a fresh process counting from zero reproduces the same path. Clear
+            // any such leftover first — the same guard the other TempRepo fixtures use.
+            let _ = fs::remove_dir_all(&path);
+            fs::create_dir_all(&path).unwrap();
             Self(path)
         }
     }

From eccbee2c1d2a9d4a9745454d38e735fb5955afbb Mon Sep 17 00:00:00 2001
From: Ash Shah <494shah@gmail.com>
Date: Sat, 8 Aug 2026 12:19:09 -0700
Subject: [PATCH 24/41] fix: repair zero-context hunk placement and guard
 discard against a stale diff
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Both from the Codex review on #26. Investigating the first turned up a worse
bug underneath it.

## Hunk placement at -U0

`git apply` positions a hunk by the coordinate of the image it produces —
new_start forward, old_start under --reverse — then offset-searches for the
preimage around it. That search is why a wrong coordinate normally goes
unnoticed, and it is exactly what hid this: at context >= 1 every case still
landed correctly.

At -U0 a pure insertion (forward) or a pure deletion (reverse) has an EMPTY
preimage. Nothing to search for, so git applies at precisely the line named
and reports success from the wrong place. Two defects met there:

- A hunk lifted out of a multi-hunk diff keeps BOTH coordinates from the full
  diff, so the side not facing the apply target is offset by the hunks left
  behind. `build_partial_hunk` made it worse by writing old_start into both
  slots. New `reanchor` keeps the trustworthy side and derives the other; it
  is now shared with the whole-hunk ops, which had the same fault by way of
  replaying git's live header.
- Without --unidiff-zero git enforces "a hunk with no trailing context must
  match at EOF", which every context-free hunk trips. Passed only when
  context == 0; at any real depth those checks stay on.

Removing either half alone reintroduces failures (13 and 5 respectively), so
both are load-bearing. Worst case found: at -U0, staging a hunk silently
appended the line at end-of-file and returned Ok. Restoring a deleted line via
discard was mis-placed the same way — on the path with no reflog.

## Stale diff under the confirmation dialog

A hunk index is just an integer; nothing in it says which hunk it meant. The
discard confirmation has no timeout, and the fswatch refresh never invalidates
the captured index, so an external edit could re-split the file and the op
would reverse-apply a hunk the user never saw.

The displayed diff now travels with the request and git-core compares it to the
live one BEFORE selecting any hunk, so a mismatch cannot touch the working
tree. Whole-file rather than per-hunk: distinguishing a harmless edit would
mean trusting the same index arithmetic that is in question.

Left alone deliberately: stage_hunk/unstage_hunk freshness (same window, but
they mutate the index, which is recoverable).

27 tests over four shapes x six ops. cargo test -p git-core 220 passed;
npm run check 530 files 0 errors; npm test 386 passed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 crates/git-core/src/ops_worktree.rs       | 653 ++++++++++++++++++++--
 src-tauri/src/commands.rs                 |  10 +-
 src/lib/api.ts                            |  16 +-
 src/lib/components/WorkingCopyView.svelte |  16 +-
 src/lib/gitActions.ts                     |  16 +-
 5 files changed, 657 insertions(+), 54 deletions(-)

diff --git a/crates/git-core/src/ops_worktree.rs b/crates/git-core/src/ops_worktree.rs
index 4742638..f44185b 100644
--- a/crates/git-core/src/ops_worktree.rs
+++ b/crates/git-core/src/ops_worktree.rs
@@ -259,10 +259,85 @@ pub fn split_hunks(diff: &str) -> (String, Vec<String>) {
     (header, hunks)
 }
 
+/// Parse `@@ -A[,B] +C[,D] @@[ heading]` into `(old_start, old_n, new_start, new_n, heading)`.
+/// An omitted count means 1 — git writes `@@ -5 +5 @@` for a single-line range. `heading` is
+/// everything after the closing `@@` (git's function-context hint), returned verbatim so it can
+/// be spliced back on. None if the line is not a hunk header.
+fn parse_hunk_header(at_line: &str) -> Option<(u64, u64, u64, u64, &str)> {
+    let (ranges, heading) = at_line.strip_prefix("@@ ")?.split_once(" @@")?;
+    let (old, new) = ranges.split_once(' ')?;
+    let range = |s: &str, sign: char| -> Option<(u64, u64)> {
+        let s = s.strip_prefix(sign)?;
+        Some(match s.split_once(',') {
+            Some((start, count)) => (start.parse().ok()?, count.parse().ok()?),
+            None => (s.parse().ok()?, 1),
+        })
+    };
+    let (old_start, old_n) = range(old, '-')?;
+    let (new_start, new_n) = range(new, '+')?;
+    Some((old_start, old_n, new_start, new_n, heading))
+}
+
+/// Format a hunk header, always with explicit counts and always newline-terminated.
+fn hunk_header(old_start: u64, old_n: u64, new_start: u64, new_n: u64, heading: &str) -> String {
+    let heading = heading.strip_suffix('\n').unwrap_or(heading);
+    format!("@@ -{},{} +{},{} @@{}\n", old_start, old_n, new_start, new_n, heading)
+}
+
+/// Re-anchor one hunk lifted out of a multi-hunk diff so it applies at the right line ALONE.
+///
+/// `git apply` positions a hunk by the coordinate of the image it is producing: `new_start`
+/// going forward, `old_start` going `--reverse` (reverse swaps the two sides). It then searches
+/// for the preimage around that line, which is why an off-by-N coordinate usually goes unnoticed.
+/// But at `-U0` a pure insertion (forward) or a pure deletion (reverse) has an EMPTY preimage —
+/// there is nothing to search for, so git applies at exactly the line named and reports success
+/// from the wrong place.
+///
+/// An extracted hunk carries both coordinates from the FULL diff, where the side we are not
+/// applying against is offset by every line the hunks we did NOT extract added or removed earlier
+/// in the file. Only the side facing our target is trustworthy: `old_start` for a forward apply
+/// (the target is the diff's old image — the index), `new_start` for a reverse one (the target is
+/// its new image — the worktree, or the index when unstaging). Keep that side, derive the other.
+///
+/// `prefix` is the number of unchanged lines before the hunk. git writes a zero-length range as
+/// the line it sits AFTER (`-16,0` = insert after old line 16) and a non-empty range as the first
+/// line it covers (`prefix + 1`) — that convention is the whole of the arithmetic below.
+fn reanchor(old_start: u64, old_n: u64, new_start: u64, new_n: u64, reverse: bool) -> (u64, u64) {
+    if reverse {
+        let prefix = if new_n == 0 { new_start } else { new_start.saturating_sub(1) };
+        (if old_n == 0 { prefix } else { prefix + 1 }, new_start)
+    } else {
+        let prefix = if old_n == 0 { old_start } else { old_start.saturating_sub(1) };
+        (old_start, if new_n == 0 { prefix } else { prefix + 1 })
+    }
+}
+
+/// Re-anchor a whole hunk taken verbatim from git's diff (see `reanchor`). The body — and so both
+/// line counts — is untouched. A header we cannot parse is handed back unchanged: git wrote it, so
+/// git can read it, and refusing to guess beats emitting something we invented.
+fn reanchor_hunk(hunk: &str, reverse: bool) -> String {
+    let mut parts = hunk.splitn(2, '\n');
+    let at_line = parts.next().unwrap_or("");
+    let body = parts.next().unwrap_or("");
+    match parse_hunk_header(at_line) {
+        Some((old_start, old_n, new_start, new_n, heading)) => {
+            let (o, n) = reanchor(old_start, old_n, new_start, new_n, reverse);
+            format!("{}{}", hunk_header(o, old_n, n, new_n, heading), body)
+        }
+        None => hunk.to_string(),
+    }
+}
+
 /// Pipe a patch (reconstructed from git's own diff output) to `git apply` via stdin.
 /// `cached` selects the target: true → `--cached` (the index, for stage/unstage),
 /// false → the WORKING TREE only (for discard). Never uses a temp file or shell.
-fn git_apply(repo: &Path, patch: &str, reverse: bool, cached: bool) -> Result<(), String> {
+///
+/// `zero_context` must be set when the patch came from a `-U0` diff. Without it git enforces
+/// "a hunk with no trailing context must match at the end of the file", which a context-free
+/// hunk always trips: reverse applies then fail outright, and a forward insertion silently lands
+/// at EOF. `--unidiff-zero` lifts exactly that rule, so it is passed ONLY at `-U0` — at any real
+/// context depth those checks are the safety net and stay on.
+fn git_apply(repo: &Path, patch: &str, reverse: bool, cached: bool, zero_context: bool) -> Result<(), String> {
     let mut c = Command::new("git");
     c.current_dir(repo).arg("apply");
     if cached {
@@ -271,6 +346,9 @@ fn git_apply(repo: &Path, patch: &str, reverse: bool, cached: bool) -> Result<()
     if reverse {
         c.arg("--reverse");
     }
+    if zero_context {
+        c.arg("--unidiff-zero");
+    }
     c.arg("-")
         .stdin(Stdio::piped())
         .stdout(Stdio::piped())
@@ -294,29 +372,31 @@ fn git_apply(repo: &Path, patch: &str, reverse: bool, cached: bool) -> Result<()
 /// Stage one hunk (by index) of `path`'s UNSTAGED diff.
 /// The patch is reconstructed from a diff fetched at the caller's display `context`,
 /// so the supplied `hunk_index` lines up with the hunks the user is actually viewing
-/// (the frontend fetches the displayed diff at the same context). The partial-hunk
-/// builder recomputes the `@@` header from the emitted lines, so any context depth works.
+/// (the frontend fetches the displayed diff at the same context). `reanchor_hunk` repairs
+/// the coordinate the extracted hunk inherited from the hunks left behind, so any context
+/// depth works — see `reanchor` for why that is not cosmetic at `-U0`.
 /// Hunk indices refer to the CURRENT live diff; after a successful stage/unstage the remaining
 /// diff re-indexes, so callers must re-fetch the diff before issuing another hunk op.
 pub fn stage_hunk(repo: &Path, path: &str, hunk_index: usize, context: u32) -> Result<(), String> {
     let d = diff(repo, Some(path), false, context)?;
     let (header, hunks) = split_hunks(&d);
     let h = hunks.get(hunk_index).ok_or("hunk index out of range")?;
-    git_apply(repo, &format!("{}{}", header, h), false, true)
+    git_apply(repo, &format!("{}{}", header, reanchor_hunk(h, false)), false, true, context == 0)
 }
 
 /// Unstage one hunk (by index) of `path`'s STAGED diff.
 /// The patch is reconstructed from a diff fetched at the caller's display `context`,
 /// so the supplied `hunk_index` lines up with the hunks the user is actually viewing
-/// (the frontend fetches the displayed diff at the same context). The partial-hunk
-/// builder recomputes the `@@` header from the emitted lines, so any context depth works.
+/// (the frontend fetches the displayed diff at the same context). `reanchor_hunk` repairs
+/// the coordinate the extracted hunk inherited from the hunks left behind, so any context
+/// depth works — see `reanchor` for why that is not cosmetic at `-U0`.
 /// Hunk indices refer to the CURRENT live diff; after a successful stage/unstage the remaining
 /// diff re-indexes, so callers must re-fetch the diff before issuing another hunk op.
 pub fn unstage_hunk(repo: &Path, path: &str, hunk_index: usize, context: u32) -> Result<(), String> {
     let d = diff(repo, Some(path), true, context)?;
     let (header, hunks) = split_hunks(&d);
     let h = hunks.get(hunk_index).ok_or("hunk index out of range")?;
-    git_apply(repo, &format!("{}{}", header, h), true, true)
+    git_apply(repo, &format!("{}{}", header, reanchor_hunk(h, true)), true, true, context == 0)
 }
 
 // ---------------------------------------------------------------------------
@@ -364,24 +444,19 @@ fn require_contiguous(selected: &[usize]) -> Result<(), String> {
 ///   - Unselected `-` lines are dropped (they are absent from the staged file).
 ///
 /// Selected `+`/`-` lines: kept as-is in both directions (mark real change).
-/// Context, `\ No newline` handling, header recompute, and the any_real_change
-/// guard are unchanged.
+/// Context, `\ No newline` handling, and the any_real_change guard are unchanged.
+///
+/// The `@@` counts are recomputed from the emitted lines and the start lines are re-anchored
+/// (see `reanchor`). Dropping lines never moves the side we anchor on: forward, the emitted old
+/// side is exactly the hunk's old side (dropped `+` occupy no old line); reverse, the emitted new
+/// side is exactly the hunk's new side (dropped `-` occupy no new line).
 /// Returns None when the selection keeps no change line (caller should no-op).
 fn build_partial_hunk(hunk: &str, selected: &std::collections::HashSet<usize>, reverse: bool) -> Option<String> {
     let mut lines = hunk.splitn(2, '\n');
     let at_line = lines.next().unwrap_or("");
     let body = lines.next().unwrap_or("");
 
-    // Parse @@ -A[,B] +C[,D] @@ [heading]
-    // We only need A (old_start). Be tolerant of missing counts.
-    let old_start: u64 = {
-        // Find "-A" after "@@"
-        let after_at = at_line.trim_start_matches('@').trim_start_matches(' ');
-        // e.g. "-12,6 +12,7 @@ heading" or "-5 +5 @@"
-        let old_part = after_at.trim_start_matches('-');
-        let end = old_part.find([',', ' ']).unwrap_or(old_part.len());
-        old_part[..end].parse().unwrap_or(1)
-    };
+    let (old_start, _, new_start, _, heading) = parse_hunk_header(at_line)?;
 
     let mut old_n: u64 = 0;
     let mut new_n: u64 = 0;
@@ -476,14 +551,15 @@ fn build_partial_hunk(hunk: &str, selected: &std::collections::HashSet<usize>, r
         return None;
     }
 
-    let header = format!("@@ -{},{} +{},{} @@\n", old_start, old_n, old_start, new_n);
-    Some(format!("{}{}", header, out))
+    let (o, n) = reanchor(old_start, old_n, new_start, new_n, reverse);
+    Some(format!("{}{}", hunk_header(o, old_n, n, new_n, heading), out))
 }
 
 /// Stage selected lines (change-line ordinals) of one hunk of `path`'s UNSTAGED diff.
 /// The diff is fetched at the caller's display `context` so `hunk_index` and the
 /// change-line ordinals line up with the diff the user is viewing. `build_partial_hunk`
-/// recomputes the `@@` header from the emitted lines, so any context depth works.
+/// recomputes the `@@` header counts from the emitted lines and re-anchors its start lines
+/// (see `reanchor`), so any context depth works.
 pub fn stage_lines(repo: &Path, path: &str, hunk_index: usize, selected: &[usize], context: u32) -> Result<(), String> {
     require_contiguous(selected)?;
     let d = diff(repo, Some(path), false, context)?;
@@ -491,13 +567,14 @@ pub fn stage_lines(repo: &Path, path: &str, hunk_index: usize, selected: &[usize
     let h = hunks.get(hunk_index).ok_or("hunk index out of range")?;
     let set: std::collections::HashSet<usize> = selected.iter().copied().collect();
     let partial = build_partial_hunk(h, &set, false).ok_or("no lines selected to stage")?;
-    git_apply(repo, &format!("{}{}", header, partial), false, true)
+    git_apply(repo, &format!("{}{}", header, partial), false, true, context == 0)
 }
 
 /// Unstage selected lines (change-line ordinals) of one hunk of `path`'s STAGED diff.
 /// The diff is fetched at the caller's display `context` so `hunk_index` and the
 /// change-line ordinals line up with the diff the user is viewing. `build_partial_hunk`
-/// recomputes the `@@` header from the emitted lines, so any context depth works.
+/// recomputes the `@@` header counts from the emitted lines and re-anchors its start lines
+/// (see `reanchor`), so any context depth works.
 pub fn unstage_lines(repo: &Path, path: &str, hunk_index: usize, selected: &[usize], context: u32) -> Result<(), String> {
     require_contiguous(selected)?;
     let d = diff(repo, Some(path), true, context)?;
@@ -505,7 +582,29 @@ pub fn unstage_lines(repo: &Path, path: &str, hunk_index: usize, selected: &[usi
     let h = hunks.get(hunk_index).ok_or("hunk index out of range")?;
     let set: std::collections::HashSet<usize> = selected.iter().copied().collect();
     let partial = build_partial_hunk(h, &set, true).ok_or("no lines selected to unstage")?;
-    git_apply(repo, &format!("{}{}", header, partial), true, true)
+    git_apply(repo, &format!("{}{}", header, partial), true, true, context == 0)
+}
+
+/// Refuse a discard whose `hunk_index` / ordinals were picked against a different diff.
+///
+/// `expected_diff` is the exact `diff()` text the caller displayed. The confirmation dialog in
+/// front of a discard has no timeout, so an external edit — another editor, another Git It window,
+/// a build step — can re-split the file between the click and the confirm. Nothing about a plain
+/// integer index says which hunk it meant, so a re-fetched diff would happily reverse-apply hunk N
+/// of a file the user never saw, and unlike stage/unstage there is no index or reflog to undo it.
+///
+/// The comparison is deliberately whole-file rather than per-hunk. Not every edit moves the hunk
+/// the user picked — one confined to a later hunk does not — but telling those apart means trusting
+/// the same index arithmetic that is in question, and refusing costs one retry while guessing wrong
+/// costs work that cannot be recovered. This is additive — `require_contiguous` remains the
+/// independent defence against a gapped selection reordering the file.
+fn require_unchanged_diff(live: &str, expected: &str) -> Result<(), String> {
+    if live == expected {
+        return Ok(());
+    }
+    Err("the file changed since the diff you were shown — nothing was discarded. \
+         Check the updated diff and try again."
+        .to_string())
 }
 
 /// Discard one hunk (by index) of `path`'s UNSTAGED diff: reverse-apply it to the
@@ -513,13 +612,21 @@ pub fn unstage_lines(repo: &Path, path: &str, hunk_index: usize, selected: &[usi
 /// INDEX, the lines revert to their staged state — staged changes to the same file
 /// are untouched. DESTRUCTIVE / not undoable.
 ///
-/// Hunk indices refer to the CURRENT live diff; after a successful op the remaining
-/// diff re-indexes, so callers must re-fetch before issuing another.
-pub fn discard_hunk(repo: &Path, path: &str, hunk_index: usize, context: u32) -> Result<(), String> {
+/// `expected_diff` is the diff the caller showed the user; the op is refused if the live diff
+/// no longer matches it (see `require_unchanged_diff`). Hunk indices refer to that diff; after a
+/// successful op the remaining diff re-indexes, so callers must re-fetch before issuing another.
+pub fn discard_hunk(
+    repo: &Path,
+    path: &str,
+    hunk_index: usize,
+    expected_diff: &str,
+    context: u32,
+) -> Result<(), String> {
     let d = diff(repo, Some(path), false, context)?;
+    require_unchanged_diff(&d, expected_diff)?;
     let (header, hunks) = split_hunks(&d);
     let h = hunks.get(hunk_index).ok_or("hunk index out of range")?;
-    git_apply(repo, &format!("{}{}", header, h), true, false)
+    git_apply(repo, &format!("{}{}", header, reanchor_hunk(h, true)), true, false, context == 0)
 }
 
 /// Discard selected change-line ordinals of one hunk of `path`'s UNSTAGED diff.
@@ -527,14 +634,25 @@ pub fn discard_hunk(repo: &Path, path: &str, hunk_index: usize, context: u32) ->
 /// working file (unselected `+` become context because they ARE present there;
 /// unselected `-` are dropped because they are not) — exactly what a worktree
 /// reverse-apply needs. DESTRUCTIVE / not undoable.
-pub fn discard_lines(repo: &Path, path: &str, hunk_index: usize, selected: &[usize], context: u32) -> Result<(), String> {
+///
+/// `expected_diff` is the diff the caller showed the user; the op is refused if the live diff
+/// no longer matches it (see `require_unchanged_diff`).
+pub fn discard_lines(
+    repo: &Path,
+    path: &str,
+    hunk_index: usize,
+    selected: &[usize],
+    expected_diff: &str,
+    context: u32,
+) -> Result<(), String> {
     require_contiguous(selected)?;
     let d = diff(repo, Some(path), false, context)?;
+    require_unchanged_diff(&d, expected_diff)?;
     let (header, hunks) = split_hunks(&d);
     let h = hunks.get(hunk_index).ok_or("hunk index out of range")?;
     let set: std::collections::HashSet<usize> = selected.iter().copied().collect();
     let partial = build_partial_hunk(h, &set, true).ok_or("no lines selected to discard")?;
-    git_apply(repo, &format!("{}{}", header, partial), true, false)
+    git_apply(repo, &format!("{}{}", header, partial), true, false, context == 0)
 }
 
 /// Stash current changes (staged + unstaged). Message is optional.
@@ -828,6 +946,183 @@ mod tests {
         v.iter().copied().collect()
     }
 
+    const BASE_20: &str =
+        "a\nb\nc\nd\ne\nf\ng\nh\ni\nj\nk\nl\nm\nn\no\np\nq\nr\ns\nt\n";
+    const TWO_ADD_HUNKS: &str =
+        "a\nb\nB2\nc\nd\ne\nf\ng\nh\ni\nj\nk\nl\nm\nn\no\np\nQ2\nq\nr\ns\nt\n";
+    const FIRST_ADD_ONLY: &str =
+        "a\nb\nB2\nc\nd\ne\nf\ng\nh\ni\nj\nk\nl\nm\nn\no\np\nq\nr\ns\nt\n";
+    const SECOND_ADD_ONLY: &str =
+        "a\nb\nc\nd\ne\nf\ng\nh\ni\nj\nk\nl\nm\nn\no\np\nQ2\nq\nr\ns\nt\n";
+    const THREE_LINE_SHIFT_HUNKS: &str =
+        "a\nb\nB2a\nB2b\nB2c\nc\nd\ne\nf\ng\nh\ni\nj\nk\nl\nm\nn\no\np\nQ2\nq\nr\ns\nt\n";
+    const THREE_LINE_SHIFT_FIRST_ONLY: &str =
+        "a\nb\nB2a\nB2b\nB2c\nc\nd\ne\nf\ng\nh\ni\nj\nk\nl\nm\nn\no\np\nq\nr\ns\nt\n";
+    // A 3-line insertion early on, then a PURE DELETION later: the reverse-apply twin of the
+    // pure-insertion case above. Restoring `q` has an empty preimage, so nothing anchors the
+    // patch except the header coordinate, and the earlier hunk shifts it by 3.
+    const SHIFTED_DELETE_HUNKS: &str =
+        "a\nb\nB2a\nB2b\nB2c\nc\nd\ne\nf\ng\nh\ni\nj\nk\nl\nm\nn\no\np\nr\ns\nt\n";
+    const SHIFTED_DELETE_RESTORED: &str =
+        "a\nb\nB2a\nB2b\nB2c\nc\nd\ne\nf\ng\nh\ni\nj\nk\nl\nm\nn\no\np\nq\nr\ns\nt\n";
+    const MIXED_SECOND_HUNK: &str =
+        "a\nb\nB2\nc\nd\ne\nf\ng\nh\ni\nj\nk\nl\nm\nn\no\np\nQ2\nr\ns\nt\n";
+    const MIXED_SECOND_ONLY: &str =
+        "a\nb\nc\nd\ne\nf\ng\nh\ni\nj\nk\nl\nm\nn\no\np\nQ2\nr\ns\nt\n";
+    const MIXED_FIRST_ONLY: &str =
+        "a\nb\nB2\nc\nd\ne\nf\ng\nh\ni\nj\nk\nl\nm\nn\no\np\nq\nr\ns\nt\n";
+    const MIXED_SELECTED_DELETION_STAGED: &str =
+        "a\nb\nc\nd\ne\nf\ng\nh\ni\nj\nk\nl\nm\nn\no\np\nr\ns\nt\n";
+    const MIXED_SELECTED_DELETION_RESTORED: &str =
+        "a\nb\nB2\nc\nd\ne\nf\ng\nh\ni\nj\nk\nl\nm\nn\no\np\nq\nQ2\nr\ns\nt\n";
+
+    fn read_index_file(r: &TempRepo, path: &str) -> String {
+        let output = Command::new("git")
+            .current_dir(&r.path)
+            .arg("show")
+            .arg(format!(":{}", path))
+            .output()
+            .unwrap();
+        assert!(
+            output.status.success(),
+            "git show index file: {}",
+            String::from_utf8_lossy(&output.stderr)
+        );
+        String::from_utf8(output.stdout).unwrap()
+    }
+
+    /// Discard against the diff as it stands right now — the freshness snapshot the UI
+    /// captures when the user clicks. Tests that exercise the stale-snapshot refusal pass
+    /// their own `expected_diff` instead.
+    fn discard_hunk_now(r: &TempRepo, path: &str, hunk_index: usize, context: u32) -> Result<(), String> {
+        let live = diff(&r.path, Some(path), false, context)?;
+        discard_hunk(&r.path, path, hunk_index, &live, context)
+    }
+
+    fn discard_lines_now(
+        r: &TempRepo,
+        path: &str,
+        hunk_index: usize,
+        selected: &[usize],
+        context: u32,
+    ) -> Result<(), String> {
+        let live = diff(&r.path, Some(path), false, context)?;
+        discard_lines(&r.path, path, hunk_index, selected, &live, context)
+    }
+
+    fn repo_with_second_hunk(
+        edited: &str,
+        staged: bool,
+        context: u32,
+        second_header_prefix: &str,
+    ) -> TempRepo {
+        let r = TempRepo::new();
+        r.commit_file("matrix.txt", BASE_20, "init");
+        r.write("matrix.txt", edited);
+        if staged {
+            r.git(&["add", "matrix.txt"]);
+        }
+        let d = diff(&r.path, Some("matrix.txt"), staged, context).unwrap();
+        let (_header, hunks) = split_hunks(&d);
+        assert_eq!(hunks.len(), 2, "expected two hunks, diff was:\n{}", d);
+        assert!(
+            hunks[1].starts_with(second_header_prefix),
+            "second hunk must have the expected divergent starts, diff was:\n{}",
+            d
+        );
+        r
+    }
+
+    fn assert_operation_content(
+        r: &TempRepo,
+        result: Result<(), String>,
+        expected_index: &str,
+        expected_worktree: &str,
+    ) {
+        let actual_index = read_index_file(r, "matrix.txt");
+        let actual_worktree = fs::read_to_string(r.path.join("matrix.txt")).unwrap();
+        assert!(
+            result.is_ok()
+                && actual_index == expected_index
+                && actual_worktree == expected_worktree,
+            "result: {:?}\nindex expected:\n{}index actual:\n{}worktree expected:\n{}worktree actual:\n{}",
+            result,
+            expected_index,
+            actual_index,
+            expected_worktree,
+            actual_worktree
+        );
+    }
+
+    fn assert_stage_hunk_case(
+        edited: &str,
+        context: u32,
+        second_header_prefix: &str,
+        expected_index: &str,
+    ) {
+        let r = repo_with_second_hunk(edited, false, context, second_header_prefix);
+        let result = stage_hunk(&r.path, "matrix.txt", 1, context);
+        assert_operation_content(&r, result, expected_index, edited);
+    }
+
+    fn assert_unstage_hunk_case(
+        edited: &str,
+        context: u32,
+        second_header_prefix: &str,
+        expected_index: &str,
+    ) {
+        let r = repo_with_second_hunk(edited, true, context, second_header_prefix);
+        let result = unstage_hunk(&r.path, "matrix.txt", 1, context);
+        assert_operation_content(&r, result, expected_index, edited);
+    }
+
+    fn assert_stage_lines_case(
+        edited: &str,
+        context: u32,
+        second_header_prefix: &str,
+        selected: &[usize],
+        expected_index: &str,
+    ) {
+        let r = repo_with_second_hunk(edited, false, context, second_header_prefix);
+        let result = stage_lines(&r.path, "matrix.txt", 1, selected, context);
+        assert_operation_content(&r, result, expected_index, edited);
+    }
+
+    fn assert_unstage_lines_case(
+        edited: &str,
+        context: u32,
+        second_header_prefix: &str,
+        selected: &[usize],
+        expected_index: &str,
+    ) {
+        let r = repo_with_second_hunk(edited, true, context, second_header_prefix);
+        let result = unstage_lines(&r.path, "matrix.txt", 1, selected, context);
+        assert_operation_content(&r, result, expected_index, edited);
+    }
+
+    fn assert_discard_hunk_case(
+        edited: &str,
+        context: u32,
+        second_header_prefix: &str,
+        expected_worktree: &str,
+    ) {
+        let r = repo_with_second_hunk(edited, false, context, second_header_prefix);
+        let result = discard_hunk_now(&r, "matrix.txt", 1, context);
+        assert_operation_content(&r, result, BASE_20, expected_worktree);
+    }
+
+    fn assert_discard_lines_case(
+        edited: &str,
+        context: u32,
+        second_header_prefix: &str,
+        selected: &[usize],
+        expected_worktree: &str,
+    ) {
+        let r = repo_with_second_hunk(edited, false, context, second_header_prefix);
+        let result = discard_lines_now(&r, "matrix.txt", 1, selected, context);
+        assert_operation_content(&r, result, BASE_20, expected_worktree);
+    }
+
     /// Two added lines; select only ordinal 0. The second add is dropped; new_n reduced by 1.
     #[test]
     fn partial_hunk_two_adds_select_first() {
@@ -971,6 +1266,204 @@ mod tests {
         assert!(unstaged.contains("+line3"), "line3 still unstaged");
     }
 
+    // ── context / multi-hunk operation matrix ───────────────────────────────
+
+    #[test]
+    fn context_three_second_hunk_stage_hunk_updates_index_at_exact_position() {
+        assert_stage_hunk_case(TWO_ADD_HUNKS, 3, "@@ -14,6 +15,7 @@", SECOND_ADD_ONLY);
+    }
+
+    #[test]
+    fn context_three_second_hunk_unstage_hunk_updates_index_at_exact_position() {
+        assert_unstage_hunk_case(TWO_ADD_HUNKS, 3, "@@ -14,6 +15,7 @@", FIRST_ADD_ONLY);
+    }
+
+    #[test]
+    fn context_three_second_hunk_stage_lines_updates_index_at_exact_position() {
+        assert_stage_lines_case(TWO_ADD_HUNKS, 3, "@@ -14,6 +15,7 @@", &[0], SECOND_ADD_ONLY);
+    }
+
+    #[test]
+    fn context_three_second_hunk_unstage_lines_updates_index_at_exact_position() {
+        assert_unstage_lines_case(TWO_ADD_HUNKS, 3, "@@ -14,6 +15,7 @@", &[0], FIRST_ADD_ONLY);
+    }
+
+    #[test]
+    fn context_three_second_hunk_discard_hunk_updates_worktree_at_exact_position() {
+        assert_discard_hunk_case(TWO_ADD_HUNKS, 3, "@@ -14,6 +15,7 @@", FIRST_ADD_ONLY);
+    }
+
+    #[test]
+    fn context_three_second_hunk_discard_lines_updates_worktree_at_exact_position() {
+        assert_discard_lines_case(TWO_ADD_HUNKS, 3, "@@ -14,6 +15,7 @@", &[0], FIRST_ADD_ONLY);
+    }
+
+    #[test]
+    fn context_zero_second_hunk_stage_hunk_updates_index_at_exact_position() {
+        assert_stage_hunk_case(TWO_ADD_HUNKS, 0, "@@ -16,0 +18 @@", SECOND_ADD_ONLY);
+    }
+
+    #[test]
+    fn context_zero_second_hunk_unstage_hunk_updates_index_at_exact_position() {
+        assert_unstage_hunk_case(TWO_ADD_HUNKS, 0, "@@ -16,0 +18 @@", FIRST_ADD_ONLY);
+    }
+
+    #[test]
+    fn context_zero_second_hunk_stage_lines_updates_index_at_exact_position() {
+        assert_stage_lines_case(TWO_ADD_HUNKS, 0, "@@ -16,0 +18 @@", &[0], SECOND_ADD_ONLY);
+    }
+
+    #[test]
+    fn context_zero_second_hunk_unstage_lines_updates_index_at_exact_position() {
+        assert_unstage_lines_case(TWO_ADD_HUNKS, 0, "@@ -16,0 +18 @@", &[0], FIRST_ADD_ONLY);
+    }
+
+    #[test]
+    fn context_zero_second_hunk_discard_hunk_updates_worktree_at_exact_position() {
+        assert_discard_hunk_case(TWO_ADD_HUNKS, 0, "@@ -16,0 +18 @@", FIRST_ADD_ONLY);
+    }
+
+    #[test]
+    fn context_zero_second_hunk_discard_lines_updates_worktree_at_exact_position() {
+        assert_discard_lines_case(TWO_ADD_HUNKS, 0, "@@ -16,0 +18 @@", &[0], FIRST_ADD_ONLY);
+    }
+
+    #[test]
+    fn context_zero_mixed_second_hunk_stage_hunk_updates_index_exactly() {
+        assert_stage_hunk_case(MIXED_SECOND_HUNK, 0, "@@ -17 +18 @@", MIXED_SECOND_ONLY);
+    }
+
+    #[test]
+    fn context_zero_mixed_second_hunk_unstage_hunk_updates_index_exactly() {
+        assert_unstage_hunk_case(MIXED_SECOND_HUNK, 0, "@@ -17 +18 @@", MIXED_FIRST_ONLY);
+    }
+
+    #[test]
+    fn context_zero_mixed_second_hunk_stage_lines_stages_only_the_deletion() {
+        assert_stage_lines_case(
+            MIXED_SECOND_HUNK,
+            0,
+            "@@ -17 +18 @@",
+            &[0],
+            MIXED_SELECTED_DELETION_STAGED,
+        );
+    }
+
+    #[test]
+    fn context_zero_mixed_second_hunk_unstage_lines_unstages_only_the_deletion() {
+        assert_unstage_lines_case(
+            MIXED_SECOND_HUNK,
+            0,
+            "@@ -17 +18 @@",
+            &[0],
+            MIXED_SELECTED_DELETION_RESTORED,
+        );
+    }
+
+    #[test]
+    fn context_zero_mixed_second_hunk_discard_hunk_updates_worktree_exactly() {
+        assert_discard_hunk_case(MIXED_SECOND_HUNK, 0, "@@ -17 +18 @@", MIXED_FIRST_ONLY);
+    }
+
+    #[test]
+    fn context_zero_mixed_second_hunk_discard_lines_restores_only_the_deletion() {
+        assert_discard_lines_case(
+            MIXED_SECOND_HUNK,
+            0,
+            "@@ -17 +18 @@",
+            &[0],
+            MIXED_SELECTED_DELETION_RESTORED,
+        );
+    }
+
+    // Reverse-direction twin of the ctx-0 pure-insertion cases: the hunk that RESTORES `q` has
+    // an empty preimage, so `git apply --reverse` places it purely by the header coordinate, and
+    // the extracted hunk inherits an old-side start that the 3-line earlier insertion has moved.
+    // Without `reanchor` the line comes back three rows too high — Ok(()), wrong file.
+    #[test]
+    fn context_zero_shifted_deletion_discard_hunk_restores_at_exact_position() {
+        assert_discard_hunk_case(SHIFTED_DELETE_HUNKS, 0, "@@ -17 +19,0 @@", SHIFTED_DELETE_RESTORED);
+    }
+
+    #[test]
+    fn context_zero_shifted_deletion_discard_lines_restores_at_exact_position() {
+        assert_discard_lines_case(
+            SHIFTED_DELETE_HUNKS,
+            0,
+            "@@ -17 +19,0 @@",
+            &[0],
+            SHIFTED_DELETE_RESTORED,
+        );
+    }
+
+    #[test]
+    fn context_zero_shifted_deletion_unstage_hunk_restores_at_exact_position() {
+        assert_unstage_hunk_case(SHIFTED_DELETE_HUNKS, 0, "@@ -17 +19,0 @@", SHIFTED_DELETE_RESTORED);
+    }
+
+    #[test]
+    fn context_one_three_line_shift_stage_hunk_updates_index_at_exact_position() {
+        assert_stage_hunk_case(
+            THREE_LINE_SHIFT_HUNKS,
+            1,
+            "@@ -16,2 +19,3 @@",
+            SECOND_ADD_ONLY,
+        );
+    }
+
+    #[test]
+    fn context_one_three_line_shift_unstage_hunk_updates_index_at_exact_position() {
+        assert_unstage_hunk_case(
+            THREE_LINE_SHIFT_HUNKS,
+            1,
+            "@@ -16,2 +19,3 @@",
+            THREE_LINE_SHIFT_FIRST_ONLY,
+        );
+    }
+
+    #[test]
+    fn context_one_three_line_shift_stage_lines_updates_index_at_exact_position() {
+        assert_stage_lines_case(
+            THREE_LINE_SHIFT_HUNKS,
+            1,
+            "@@ -16,2 +19,3 @@",
+            &[0],
+            SECOND_ADD_ONLY,
+        );
+    }
+
+    #[test]
+    fn context_one_three_line_shift_unstage_lines_updates_index_at_exact_position() {
+        assert_unstage_lines_case(
+            THREE_LINE_SHIFT_HUNKS,
+            1,
+            "@@ -16,2 +19,3 @@",
+            &[0],
+            THREE_LINE_SHIFT_FIRST_ONLY,
+        );
+    }
+
+    #[test]
+    fn context_one_three_line_shift_discard_hunk_updates_worktree_at_exact_position() {
+        assert_discard_hunk_case(
+            THREE_LINE_SHIFT_HUNKS,
+            1,
+            "@@ -16,2 +19,3 @@",
+            THREE_LINE_SHIFT_FIRST_ONLY,
+        );
+    }
+
+    #[test]
+    fn context_one_three_line_shift_discard_lines_updates_worktree_at_exact_position() {
+        assert_discard_lines_case(
+            THREE_LINE_SHIFT_HUNKS,
+            1,
+            "@@ -16,2 +19,3 @@",
+            &[0],
+            THREE_LINE_SHIFT_FIRST_ONLY,
+        );
+    }
+
     // ── discard (worktree reverse-apply) ─────────────────────────────────────
 
     #[test]
@@ -989,7 +1482,7 @@ mod tests {
         let (_h, hunks) = split_hunks(&d);
         assert_eq!(hunks.len(), 2, "expected two hunks, diff was:\n{}", d);
 
-        discard_hunk(&r.path, "f.txt", 0, 3).unwrap();
+        discard_hunk_now(&r, "f.txt", 0, 3).unwrap();
 
         let now = fs::read_to_string(r.path.join("f.txt")).unwrap();
         assert!(now.contains("line2\n"), "hunk 0 should be reverted");
@@ -1003,7 +1496,7 @@ mod tests {
         r.commit_file("f.txt", "base\n", "init");
         r.write("f.txt", "base\nline1\nline2\nline3\n");
         // ordinals 0,1,2 == +line1,+line2,+line3 — discard only line2.
-        discard_lines(&r.path, "f.txt", 0, &[1], 3).unwrap();
+        discard_lines_now(&r, "f.txt", 0, &[1], 3).unwrap();
         assert_eq!(
             fs::read_to_string(r.path.join("f.txt")).unwrap(),
             "base\nline1\nline3\n",
@@ -1026,7 +1519,7 @@ mod tests {
         assert!(staged.contains("+keep"), "precondition: keep must be staged");
 
         // The unstaged diff now holds exactly one change line (`+drop`) at ordinal 0.
-        discard_lines(&r.path, "f.txt", 0, &[0], 3).unwrap();
+        discard_lines_now(&r, "f.txt", 0, &[0], 3).unwrap();
 
         assert_eq!(
             fs::read_to_string(r.path.join("f.txt")).unwrap(),
@@ -1045,7 +1538,7 @@ mod tests {
 
         // Ordinals: -aaa=0 -bbb=1 -ccc=2 +XXX=3 +YYY=4 +ZZZ=5.
         // [2,5] is the shape split view's paired-row selection used to emit.
-        let err = discard_lines(&r.path, "f.txt", 0, &[2, 5], 3).unwrap_err();
+        let err = discard_lines_now(&r, "f.txt", 0, &[2, 5], 3).unwrap_err();
         assert!(err.contains("non-contiguous"), "unexpected error: {}", err);
 
         // The refusal must be total — the worktree is untouched.
@@ -1065,23 +1558,99 @@ mod tests {
         r.commit_file("f.txt", "base\n", "init");
         r.write("f.txt", "base\nl1\nl2\nl3\n");
         // Out of order and with a duplicate — still one contiguous run once normalized.
-        discard_lines(&r.path, "f.txt", 0, &[2, 1, 1], 3).unwrap();
+        discard_lines_now(&r, "f.txt", 0, &[2, 1, 1], 3).unwrap();
         assert_eq!(
             fs::read_to_string(r.path.join("f.txt")).unwrap(),
             "base\nl1\n"
         );
     }
 
-    /// The `-` path: discard must put a line BACK, not just remove one. Every existing
-    /// discard test uses a pure-addition hunk, so this branch of `build_partial_hunk`
-    /// was only ever exercised against the INDEX by `unstage_lines`, never against the
-    /// working tree.
+    // ── stale diff snapshot (discard TOCTOU) ─────────────────────────────────
+
+    /// Set up the exact race the confirmation dialog opens: the user is shown a two-hunk diff and
+    /// picks hunk 1 (`Q2`); while the modal sits there something else edits the file, adding a
+    /// change EARLIER in it. Hunk 1 is still in range — it now names the new edit instead.
+    /// Returns (repo, the diff the user saw, the file as the user last saw it).
+    fn repo_with_diff_changed_under_the_dialog() -> (TempRepo, String, String) {
+        // 30 lines so three edits ~9 apart stay three separate hunks at -U3.
+        let base: String = (1..=30).map(|i| format!("line{}\n", i)).collect();
+        let seen_state = base
+            .replace("line3\n", "B2\nline3\n")
+            .replace("line21\n", "Q2\nline21\n");
+
+        let r = TempRepo::new();
+        r.commit_file("f.txt", &base, "init");
+        r.write("f.txt", &seen_state);
+        let shown = diff(&r.path, Some("f.txt"), false, 3).unwrap();
+        assert_eq!(split_hunks(&shown).1.len(), 2, "user saw two hunks:\n{}", shown);
+
+        // …meanwhile, an external edit lands between `B2` and `Q2`.
+        r.write("f.txt", &seen_state.replace("line12\n", "H2\nline12\n"));
+        let now = diff(&r.path, Some("f.txt"), false, 3).unwrap();
+        assert_eq!(
+            split_hunks(&now).1.len(),
+            3,
+            "index 1 must now name a DIFFERENT hunk:\n{}",
+            now
+        );
+        (r, shown, seen_state)
+    }
+
+    /// Stale index 1 would reverse-apply the `H2` hunk — an edit the user never saw, with no
+    /// reflog to get it back. The snapshot check must refuse and leave the file alone.
+    #[test]
+    fn discard_hunk_refuses_a_diff_that_changed_under_the_dialog() {
+        let (r, shown, _) = repo_with_diff_changed_under_the_dialog();
+        let before = read_file(&r, "f.txt");
+
+        let err = discard_hunk(&r.path, "f.txt", 1, &shown, 3).unwrap_err();
+        assert!(err.contains("nothing was discarded"), "unexpected error: {}", err);
+        assert_eq!(
+            read_file(&r, "f.txt"),
+            before,
+            "a refused discard must not touch the worktree"
+        );
+    }
+
+    #[test]
+    fn discard_lines_refuses_a_diff_that_changed_under_the_dialog() {
+        let (r, shown, _) = repo_with_diff_changed_under_the_dialog();
+        let before = read_file(&r, "f.txt");
+
+        let err = discard_lines(&r.path, "f.txt", 1, &[0], &shown, 3).unwrap_err();
+        assert!(err.contains("nothing was discarded"), "unexpected error: {}", err);
+        assert_eq!(
+            read_file(&r, "f.txt"),
+            before,
+            "a refused discard must not touch the worktree"
+        );
+    }
+
+    /// The refusal has to be a retry, not a dead end: re-reading the diff and discarding against
+    /// THAT succeeds, and hits the hunk the fresh diff actually names.
+    #[test]
+    fn discard_succeeds_once_the_snapshot_is_refreshed() {
+        let (r, shown, seen_state) = repo_with_diff_changed_under_the_dialog();
+        assert!(discard_hunk(&r.path, "f.txt", 1, &shown, 3).is_err());
+
+        discard_hunk_now(&r, "f.txt", 1, 3).unwrap();
+        assert_eq!(
+            read_file(&r, "f.txt"),
+            seen_state,
+            "hunk 1 of the FRESH diff is the H2 insertion"
+        );
+    }
+
+    /// The `-` path: discard must put a line BACK, not just remove one. The discard tests
+    /// that came before this one all used a pure-addition hunk, so this branch of
+    /// `build_partial_hunk` was only ever exercised against the INDEX by `unstage_lines`,
+    /// never against the working tree.
     #[test]
     fn discard_lines_restores_a_deleted_line() {
         let r = TempRepo::new();
         r.commit_file("f.txt", "a\nb\nc\n", "init");
         r.write("f.txt", "a\nc\n");
-        discard_lines(&r.path, "f.txt", 0, &[0], 3).unwrap();
+        discard_lines_now(&r, "f.txt", 0, &[0], 3).unwrap();
         assert_eq!(fs::read_to_string(r.path.join("f.txt")).unwrap(), "a\nb\nc\n");
     }
 
@@ -1094,7 +1663,7 @@ mod tests {
         r.commit_file("f.txt", "a\nb\nc\n", "init");
         r.write("f.txt", "a\nB2\nc\n");
         // Ordinals: -b=0, +B2=1. Discard only the deletion.
-        discard_lines(&r.path, "f.txt", 0, &[0], 3).unwrap();
+        discard_lines_now(&r, "f.txt", 0, &[0], 3).unwrap();
         assert_eq!(fs::read_to_string(r.path.join("f.txt")).unwrap(), "a\nb\nB2\nc\n");
     }
 
diff --git a/src-tauri/src/commands.rs b/src-tauri/src/commands.rs
index b95a36d..c43396d 100644
--- a/src-tauri/src/commands.rs
+++ b/src-tauri/src/commands.rs
@@ -462,14 +462,16 @@ pub fn unstage_lines(repo: String, path: String, hunk_index: usize, selected: Ve
     ops_worktree::unstage_lines(&PathBuf::from(repo), &path, hunk_index, &selected, context)
 }
 
+// `expected_diff` is the diff text the UI displayed. Discard is irreversible, so git-core
+// refuses the op when the live diff has moved on — see ops_worktree::require_unchanged_diff.
 #[tauri::command]
-pub fn discard_hunk(repo: String, path: String, hunk_index: usize, context: u32) -> Result<(), String> {
-    ops_worktree::discard_hunk(&PathBuf::from(repo), &path, hunk_index, context)
+pub fn discard_hunk(repo: String, path: String, hunk_index: usize, expected_diff: String, context: u32) -> Result<(), String> {
+    ops_worktree::discard_hunk(&PathBuf::from(repo), &path, hunk_index, &expected_diff, context)
 }
 
 #[tauri::command]
-pub fn discard_lines(repo: String, path: String, hunk_index: usize, selected: Vec<usize>, context: u32) -> Result<(), String> {
-    ops_worktree::discard_lines(&PathBuf::from(repo), &path, hunk_index, &selected, context)
+pub fn discard_lines(repo: String, path: String, hunk_index: usize, selected: Vec<usize>, expected_diff: String, context: u32) -> Result<(), String> {
+    ops_worktree::discard_lines(&PathBuf::from(repo), &path, hunk_index, &selected, &expected_diff, context)
 }
 
 #[tauri::command]
diff --git a/src/lib/api.ts b/src/lib/api.ts
index 2e48a38..53c7381 100644
--- a/src/lib/api.ts
+++ b/src/lib/api.ts
@@ -198,10 +198,18 @@ export const api = {
     invoke<void>("stage_lines", { repo, path, hunkIndex, selected, context }),
   unstageLines: (repo: string, path: string, hunkIndex: number, selected: number[], context = 3) =>
     invoke<void>("unstage_lines", { repo, path, hunkIndex, selected, context }),
-  discardHunk: (repo: string, path: string, hunkIndex: number, context = 3) =>
-    invoke<void>("discard_hunk", { repo, path, hunkIndex, context }),
-  discardLines: (repo: string, path: string, hunkIndex: number, selected: number[], context = 3) =>
-    invoke<void>("discard_lines", { repo, path, hunkIndex, selected, context }),
+  // `expectedDiff` is the exact patch text that was on screen. Discard cannot be undone, so
+  // the backend refuses the op rather than re-reading these indices against a diff that moved.
+  discardHunk: (repo: string, path: string, hunkIndex: number, expectedDiff: string, context = 3) =>
+    invoke<void>("discard_hunk", { repo, path, hunkIndex, expectedDiff, context }),
+  discardLines: (
+    repo: string,
+    path: string,
+    hunkIndex: number,
+    selected: number[],
+    expectedDiff: string,
+    context = 3,
+  ) => invoke<void>("discard_lines", { repo, path, hunkIndex, selected, expectedDiff, context }),
   stashPush: (repo: string, message: string | null) =>
     invoke<void>("stash_push", { repo, message }),
   stashList: (repo: string) => invoke<StashEntry[]>("stash_list", { repo }),
diff --git a/src/lib/components/WorkingCopyView.svelte b/src/lib/components/WorkingCopyView.svelte
index 20b53ab..3113e9a 100644
--- a/src/lib/components/WorkingCopyView.svelte
+++ b/src/lib/components/WorkingCopyView.svelte
@@ -593,11 +593,23 @@
             onDiscardHunk={selectedIsStaged || selectedIsUntracked
               ? undefined
               : (i, n) =>
-                  gitActions.discardHunk(selectedFile!, i, n, selectedHasStagedCounterpart)}
+                  gitActions.discardHunk(
+                    selectedFile!,
+                    i,
+                    n,
+                    diffPatch,
+                    selectedHasStagedCounterpart,
+                  )}
             onDiscardLines={selectedIsStaged || selectedIsUntracked
               ? undefined
               : (hi, sel) =>
-                  gitActions.discardLines(selectedFile!, hi, sel, selectedHasStagedCounterpart)}
+                  gitActions.discardLines(
+                    selectedFile!,
+                    hi,
+                    sel,
+                    diffPatch,
+                    selectedHasStagedCounterpart,
+                  )}
           />
         {/if}
       </div>
diff --git a/src/lib/gitActions.ts b/src/lib/gitActions.ts
index 5945cfb..2048ef4 100644
--- a/src/lib/gitActions.ts
+++ b/src/lib/gitActions.ts
@@ -885,10 +885,14 @@ export const gitActions = {
   // file-level `discard` below: uncommitted work is not in the reflog, so there is
   // no backup bundle to take. Guard BEFORE confirming so the browser preview never
   // shows a dialog it cannot honour.
+  // `expectedDiff` is captured at click time and carried across the confirmation await:
+  // it is what pins hunkIndex/selected to the diff the user actually judged, however long
+  // the dialog stays open. See ops_worktree::require_unchanged_diff.
   discardHunk: async (
     path: string,
     hunkIndex: number,
     changedLines: number,
+    expectedDiff: string,
     revertsToIndex = false,
   ): Promise<boolean> => {
     if (!isTauri()) {
@@ -911,13 +915,14 @@ export const gitActions = {
     });
     if (!confirmed) return false;
     return runWorktree(`Discard hunk in ${path}`, () =>
-      api.discardHunk(appState.repo, path, hunkIndex, appState.effectiveDiffContext),
+      api.discardHunk(appState.repo, path, hunkIndex, expectedDiff, appState.effectiveDiffContext),
     );
   },
   discardLines: async (
     path: string,
     hunkIndex: number,
     selected: number[],
+    expectedDiff: string,
     revertsToIndex = false,
   ): Promise<boolean> => {
     if (!isTauri()) {
@@ -937,7 +942,14 @@ export const gitActions = {
     });
     if (!confirmed) return false;
     return runWorktree(`Discard ${n} line(s) in ${path}`, () =>
-      api.discardLines(appState.repo, path, hunkIndex, selected, appState.effectiveDiffContext),
+      api.discardLines(
+        appState.repo,
+        path,
+        hunkIndex,
+        selected,
+        expectedDiff,
+        appState.effectiveDiffContext,
+      ),
     );
   },
   commitChanges: (message: string, signoff = false) =>

From 8fea2c5730514c0debae1083f11e729fb1308869 Mon Sep 17 00:00:00 2001
From: Ash Shah <494shah@gmail.com>
Date: Sat, 8 Aug 2026 13:02:01 -0700
Subject: [PATCH 25/41] docs: design for scoping the native context menu to
 selectable text

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .../2026-08-08-context-menu-scoping-design.md | 126 ++++++++++++++++++
 1 file changed, 126 insertions(+)
 create mode 100644 docs/superpowers/specs/2026-08-08-context-menu-scoping-design.md

diff --git a/docs/superpowers/specs/2026-08-08-context-menu-scoping-design.md b/docs/superpowers/specs/2026-08-08-context-menu-scoping-design.md
new file mode 100644
index 0000000..5947678
--- /dev/null
+++ b/docs/superpowers/specs/2026-08-08-context-menu-scoping-design.md
@@ -0,0 +1,126 @@
+# Scoping the native context menu
+
+**Date:** 2026-08-08
+**Status:** approved
+**Branch:** `fix/scope-native-context-menu` off `next`
+
+## Problem
+
+`src/routes/+page.svelte` installs a window-level handler that cancels every native context
+menu in the app:
+
+```ts
+const suppressNativeContextMenu = (event: MouseEvent) => event.preventDefault();
+window.addEventListener("contextmenu", suppressNativeContextMenu);
+```
+
+It arrived in `15e51c3` (2026-07-17). The app supplies its own menu for a handful of row
+types — commit rows, sidebar refs, worktrees, working-copy files — and everywhere else the
+handler only takes functionality away. Right-clicking a commit-message box, a PR review
+textarea, diff code, or rendered Markdown yields nothing: no Copy, no Paste, no Look Up, no
+spelling suggestions. On macOS that reads as broken.
+
+Reported by Codex review on PR #26 as P2. The code is not part of that PR, so it is being
+fixed on its own branch.
+
+## What the investigation changed
+
+Three findings moved this away from the obvious framing.
+
+**The original intent is already satisfied by the build configuration.** The handler was
+presumably written to hide WebKit's developer menu (Reload / Inspect Element), which looks
+unprofessional in a shipped app. But `src-tauri/Cargo.toml` declares
+`tauri = { version = "2", features = ["macos-private-api"] }` — no `devtools` feature. Tauri
+enables the inspector on debug builds only, so **"Inspect Element" never appears in a release
+build**. The dev menu is a dev-build-only phenomenon, and no `tauri.conf.json` option is needed
+(or exists) to suppress it.
+
+**The global handler is not what makes the custom menus work.** Every custom handler already
+calls `preventDefault()` itself: `GraphHistory.svelte:247`, `Sidebar.svelte:238`,
+`WorktreePanel.svelte:67`, and the `WorkingCopyView` / `RefTree` callbacks. Removing the global
+handler would not produce two menus stacked on a commit row.
+
+**The app already decides where text matters.** `+page.svelte` sets a no-select baseline and
+opts back in on a curated list:
+
+```css
+:global(body) { user-select: none; }
+:global(input), :global(textarea), :global([contenteditable="true"]),
+:global(.diff-cell), :global(.md), :global(.body-msg), :global(.sha),
+:global(.selectable), :global(.selectable *) { user-select: text; }
+```
+
+That list is, almost by definition, the set of places a native context menu is useful. The fix
+should defer to it rather than introduce a second, independently-maintained notion of
+"editable or selectable".
+
+## Design
+
+Gate the suppression on the computed `user-select` value at the event target:
+
+```ts
+const suppressNativeContextMenu = (event: MouseEvent) => {
+  const el = event.target as Element | null;
+  // The native menu earns its place exactly where text is selectable — read the
+  // `user-select` allowlist below rather than keeping a second list in sync with it.
+  const style = el && getComputedStyle(el);
+  if (style && (style.webkitUserSelect || style.userSelect) !== "none") return;
+  event.preventDefault();
+};
+```
+
+`user-select` inherits, so a descendant of `.md` or `.selectable` computes to `text` and is
+allowed without enumerating descendants. `DiffView`'s line-number gutter sets its own
+`user-select: none`, so it re-suppresses automatically — gutter-drag line staging never offers
+a text menu. Both the prefixed and unprefixed properties are read: `minimumSystemVersion` is
+12.3 (Monterey / Safari 15.x), where unprefixed `user-select` support is not guaranteed.
+
+### Resulting behavior
+
+| Right-click target | Before | After |
+|---|---|---|
+| Commit row, sidebar ref, worktree, working-copy file | app menu | app menu (unchanged) |
+| Toolbar, panel header, labels, tabs | nothing | nothing (unchanged) |
+| Commit-message input, review textarea | nothing | native Copy / Paste / spelling |
+| Diff code (`.diff-cell`) | nothing | native Copy / Look Up |
+| Rendered Markdown (`.md`), commit body, SHA | nothing | native Copy / Look Up |
+| Diff line-number gutter | nothing | nothing (own `user-select: none`) |
+
+### Rejected alternatives
+
+**An explicit selector constant** mirroring the CSS list, extracted as a pure predicate in
+`src/lib/`. More obvious to read and unit-testable, but it duplicates the allowlist. The two
+drift the first time someone adds a selectable class to the CSS and not to the TS, and the
+failure is silent — a text area that quietly stops offering a menu.
+
+**Deleting the global handler entirely** and relying on components to self-suppress. The most
+surgical option (three lines) and the truest to native behavior, since all custom handlers
+already `preventDefault()`. Rejected because WKWebView's default menu would then appear on
+chrome, and what that menu contains in a *release* build (no inspector, everything
+`user-select: none`) cannot be confirmed from a debug build — the two differ precisely in the
+inspector item. Possibly empty and therefore invisible, possibly a stray "Reload" / "Services"
+on every toolbar. Not worth the uncertainty for three lines.
+
+## Scope
+
+One handler in `src/routes/+page.svelte`. No component changes, no CSS changes, no Tauri
+config or Cargo feature changes.
+
+## Verification
+
+Automated gates cannot reach this. Whether a native menu appears is a WKWebView decision made
+after `preventDefault()` is or is not called, and no test environment renders one.
+`npm run check`, `npm test`, and `cargo test` confirm only that nothing else broke.
+
+By hand, in a bundled debug `.app` (see the `gitit-tauri-gui-automation` notes — `tauri dev`
+runs a bare binary with no bundle identifier and is invisible to screenshots):
+
+1. Right-click a commit-message box — Copy / Paste / spelling appear.
+2. Right-click diff code — Copy / Look Up appear.
+3. Right-click a commit row in the graph — the app's own menu appears, and no WebKit menu
+   leaks in behind it.
+4. Right-click a toolbar or panel header — nothing appears.
+5. Right-click the diff line-number gutter — nothing appears.
+
+Note that a debug build *does* carry the inspector, so "Inspect Element" showing up in step 1
+or 2 is expected there and absent from the shipped app.

From a32bf4d18950abcea4746c776c1e9789c7183b8a Mon Sep 17 00:00:00 2001
From: Ash Shah <494shah@gmail.com>
Date: Sat, 8 Aug 2026 13:16:18 -0700
Subject: [PATCH 26/41] fix: stop a partial selection at a no-newline EOF from
 merging two lines
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When the last line of a file with no trailing newline changes, git emits a
`-`/`+` pair where BOTH sides carry `\ No newline at end of file`. The marker
claims the line before it ends the image it belongs to. `build_partial_hunk`
kept that marker whenever the preceding line had been emitted — including when
a demoted-to-context line was emitted after it, which makes the claim false.

`git apply` accepts the contradiction and resolves it by concatenating. With
base "a\nt" and worktree "a\nT2", discarding just the deletion produced
"a\ntT2" — the two lines merged onto one, Ok(()) returned, on the path with no
reflog and no backup bundle. Pre-existing: reproduces against HEAD.

The two directions are not symmetric, so they get different answers.

Reversing (discard/unstage) keeps the other half as context on the side that
still ends there, so dropping the stale marker expresses the intent exactly —
verified against real git, the file becomes "a\nt\nT2".

Going forward (stage) would need the demoted line newline-terminated on the new
side and not on the old. One context line cannot say that, so no patch
expresses it and it is now refused, in the same spirit as require_contiguous.
Whole-hunk ops replay git's own hunk verbatim and are unaffected, so staging
the whole hunk remains available.

Deciding the marker's fate needs to know what follows it, so the emitter now
tracks what the previous line was emitted AS rather than merely that it was,
and build_partial_hunk returns Result<Option<String>, String> to carry the
refusal. Callers keep their own "no lines selected" messages.

partial_hunk_no_newline_marker asserted the buggy output — its comment narrated
the mechanism ("last_emitted=true -> marker kept"). That exact patch shape was
confirmed against real git to stage "oldnew" instead of "old\nnew", so the
first half now expects the refusal.

cargo test -p git-core 224 passed; npm run check 530 files 0 errors;
npm test 386 passed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 crates/git-core/src/ops_worktree.rs | 248 +++++++++++++++++++++++-----
 1 file changed, 207 insertions(+), 41 deletions(-)

diff --git a/crates/git-core/src/ops_worktree.rs b/crates/git-core/src/ops_worktree.rs
index f44185b..2bb40ce 100644
--- a/crates/git-core/src/ops_worktree.rs
+++ b/crates/git-core/src/ops_worktree.rs
@@ -444,24 +444,67 @@ fn require_contiguous(selected: &[usize]) -> Result<(), String> {
 ///   - Unselected `-` lines are dropped (they are absent from the staged file).
 ///
 /// Selected `+`/`-` lines: kept as-is in both directions (mark real change).
-/// Context, `\ No newline` handling, and the any_real_change guard are unchanged.
+/// The any_real_change guard is unchanged; `\ No newline` handling is described below.
 ///
 /// The `@@` counts are recomputed from the emitted lines and the start lines are re-anchored
 /// (see `reanchor`). Dropping lines never moves the side we anchor on: forward, the emitted old
 /// side is exactly the hunk's old side (dropped `+` occupy no old line); reverse, the emitted new
 /// side is exactly the hunk's new side (dropped `-` occupy no new line).
-/// Returns None when the selection keeps no change line (caller should no-op).
-fn build_partial_hunk(hunk: &str, selected: &std::collections::HashSet<usize>, reverse: bool) -> Option<String> {
+///
+/// `Ok(None)` when the selection keeps no change line (caller supplies its own message).
+/// `Err` when the selection cannot be expressed as a patch at all — see the `'\\'` arm.
+fn build_partial_hunk(
+    hunk: &str,
+    selected: &std::collections::HashSet<usize>,
+    reverse: bool,
+) -> Result<Option<String>, String> {
     let mut lines = hunk.splitn(2, '\n');
     let at_line = lines.next().unwrap_or("");
     let body = lines.next().unwrap_or("");
 
-    let (old_start, _, new_start, _, heading) = parse_hunk_header(at_line)?;
+    let Some((old_start, _, new_start, _, heading)) = parse_hunk_header(at_line) else {
+        return Ok(None);
+    };
+
+    // Signs of the change lines, indexed by ordinal — the lookahead a `\ No newline`
+    // marker needs to tell whether the line it follows is still file-final once the
+    // unselected lines are dropped or demoted.
+    let signs: Vec<char> = body
+        .split_inclusive('\n')
+        .filter_map(|l| match l.chars().next() {
+            Some(c @ ('+' | '-')) => Some(c),
+            _ => None,
+        })
+        .collect();
+
+    // Does any change line from ordinal `from` onward still occupy `old_side`
+    // (or the new side) of the emitted patch? A demoted line becomes context and
+    // so occupies both; a dropped one occupies neither.
+    let occupies_from = |from: usize, old_side: bool| -> bool {
+        signs.iter().enumerate().skip(from).any(|(o, &s)| {
+            match (s, selected.contains(&o)) {
+                ('+', true) => !old_side,
+                ('-', true) => old_side,
+                ('+', false) => reverse,
+                ('-', false) => !reverse,
+                _ => false,
+            }
+        })
+    };
+
+    // What the previous source line was actually emitted as. Paired with the first
+    // ordinal that comes after it — the marker arm needs both.
+    #[derive(Clone, Copy)]
+    enum Emitted {
+        Context,
+        Del,
+        Add,
+    }
 
     let mut old_n: u64 = 0;
     let mut new_n: u64 = 0;
     let mut ord: usize = 0;
-    let mut last_emitted = false;
+    let mut last: Option<(Emitted, usize)> = None;
     let mut any_real_change = false;
     let mut out = String::new();
 
@@ -474,7 +517,7 @@ fn build_partial_hunk(hunk: &str, selected: &std::collections::HashSet<usize>, r
                 out.push_str(raw_line);
                 old_n += 1;
                 new_n += 1;
-                last_emitted = true;
+                last = Some((Emitted::Context, ord));
             }
             Some('+') => {
                 let this = ord;
@@ -483,7 +526,7 @@ fn build_partial_hunk(hunk: &str, selected: &std::collections::HashSet<usize>, r
                     // Selected addition: keep as `+` in both directions.
                     out.push_str(raw_line);
                     new_n += 1;
-                    last_emitted = true;
+                    last = Some((Emitted::Add, ord));
                     any_real_change = true;
                 } else if reverse {
                     // Unstage path: this `+` line IS in the staged (new) image,
@@ -493,10 +536,10 @@ fn build_partial_hunk(hunk: &str, selected: &std::collections::HashSet<usize>, r
                     out.push_str(rest);
                     old_n += 1;
                     new_n += 1;
-                    last_emitted = true;
+                    last = Some((Emitted::Context, ord));
                 } else {
                     // Stage path: unselected addition → drop it entirely.
-                    last_emitted = false;
+                    last = None;
                 }
             }
             Some('-') => {
@@ -506,12 +549,12 @@ fn build_partial_hunk(hunk: &str, selected: &std::collections::HashSet<usize>, r
                     // Selected deletion: keep as `-` in both directions.
                     out.push_str(raw_line);
                     old_n += 1;
-                    last_emitted = true;
+                    last = Some((Emitted::Del, ord));
                     any_real_change = true;
                 } else if reverse {
                     // Unstage path: this `-` line is absent from the staged (new) image,
                     // so drop it entirely (it has no presence in the staged file to anchor on).
-                    last_emitted = false;
+                    last = None;
                 } else {
                     // Stage path: unselected deletion → demote to context.
                     let rest = &raw_line[1..];
@@ -519,15 +562,49 @@ fn build_partial_hunk(hunk: &str, selected: &std::collections::HashSet<usize>, r
                     out.push_str(rest);
                     old_n += 1;
                     new_n += 1;
-                    last_emitted = true;
+                    last = Some((Emitted::Context, ord));
                 }
             }
             Some('\\') => {
-                // "\ No newline at end of file" — keep only if last line was emitted
-                if last_emitted {
-                    out.push_str(raw_line);
+                // `\ No newline at end of file` claims the line before it is the LAST line
+                // of the image(s) that line belongs to. A partial selection can leave content
+                // after it on one of those sides, which makes the claim false — and `git apply`
+                // resolves the contradiction by CONCATENATING the two lines onto one, silently
+                // and with no reflog on the discard path. So the marker survives only while it
+                // is still true.
+                match last {
+                    Some((Emitted::Del, from)) => {
+                        if !occupies_from(from, true) {
+                            out.push_str(raw_line);
+                        }
+                    }
+                    Some((Emitted::Add, from)) => {
+                        if !occupies_from(from, false) {
+                            out.push_str(raw_line);
+                        }
+                    }
+                    Some((Emitted::Context, from)) => {
+                        // A context line is one line shared by both images, so it cannot end
+                        // one of them and not the other. When the selection asks for exactly
+                        // that — staging an addition after a demoted final line, say — no
+                        // patch expresses it, and emitting one anyway is how the corruption
+                        // happened. Refuse instead; the whole-hunk action still works.
+                        let old_more = occupies_from(from, true);
+                        let new_more = occupies_from(from, false);
+                        if old_more != new_more {
+                            return Err("this selection cannot be expressed as a patch: it splits \
+                                        a change at a no-newline end of file, where the kept line \
+                                        would have to end with a newline on one side and not the \
+                                        other. Use the whole-hunk action instead."
+                                .to_string());
+                        }
+                        if !old_more {
+                            out.push_str(raw_line);
+                        }
+                    }
+                    None => {}
                 }
-                // do not change counts or last_emitted
+                // do not change counts or `last`
             }
             None | Some(_) => {
                 // bare empty line or other: treat as context
@@ -541,18 +618,18 @@ fn build_partial_hunk(hunk: &str, selected: &std::collections::HashSet<usize>, r
                     out.push_str(&content);
                     old_n += 1;
                     new_n += 1;
-                    last_emitted = true;
+                    last = Some((Emitted::Context, ord));
                 }
             }
         }
     }
 
     if !any_real_change {
-        return None;
+        return Ok(None);
     }
 
     let (o, n) = reanchor(old_start, old_n, new_start, new_n, reverse);
-    Some(format!("{}{}", hunk_header(o, old_n, n, new_n, heading), out))
+    Ok(Some(format!("{}{}", hunk_header(o, old_n, n, new_n, heading), out)))
 }
 
 /// Stage selected lines (change-line ordinals) of one hunk of `path`'s UNSTAGED diff.
@@ -566,7 +643,7 @@ pub fn stage_lines(repo: &Path, path: &str, hunk_index: usize, selected: &[usize
     let (header, hunks) = split_hunks(&d);
     let h = hunks.get(hunk_index).ok_or("hunk index out of range")?;
     let set: std::collections::HashSet<usize> = selected.iter().copied().collect();
-    let partial = build_partial_hunk(h, &set, false).ok_or("no lines selected to stage")?;
+    let partial = build_partial_hunk(h, &set, false)?.ok_or("no lines selected to stage")?;
     git_apply(repo, &format!("{}{}", header, partial), false, true, context == 0)
 }
 
@@ -581,7 +658,7 @@ pub fn unstage_lines(repo: &Path, path: &str, hunk_index: usize, selected: &[usi
     let (header, hunks) = split_hunks(&d);
     let h = hunks.get(hunk_index).ok_or("hunk index out of range")?;
     let set: std::collections::HashSet<usize> = selected.iter().copied().collect();
-    let partial = build_partial_hunk(h, &set, true).ok_or("no lines selected to unstage")?;
+    let partial = build_partial_hunk(h, &set, true)?.ok_or("no lines selected to unstage")?;
     git_apply(repo, &format!("{}{}", header, partial), true, true, context == 0)
 }
 
@@ -651,7 +728,7 @@ pub fn discard_lines(
     let (header, hunks) = split_hunks(&d);
     let h = hunks.get(hunk_index).ok_or("hunk index out of range")?;
     let set: std::collections::HashSet<usize> = selected.iter().copied().collect();
-    let partial = build_partial_hunk(h, &set, true).ok_or("no lines selected to discard")?;
+    let partial = build_partial_hunk(h, &set, true)?.ok_or("no lines selected to discard")?;
     git_apply(repo, &format!("{}{}", header, partial), true, false, context == 0)
 }
 
@@ -1127,7 +1204,7 @@ mod tests {
     #[test]
     fn partial_hunk_two_adds_select_first() {
         let hunk = "@@ -10,3 +10,5 @@\n context\n+add0\n+add1\n context2\n";
-        let result = build_partial_hunk(hunk, &set(&[0]), false).expect("should produce patch");
+        let result = build_partial_hunk(hunk, &set(&[0]), false).unwrap().expect("should produce patch");
         assert!(result.contains("+add0"), "selected add kept");
         assert!(!result.contains("+add1"), "unselected add dropped");
         // old_n: 2 context lines = 2; new_n: 2 context + 1 kept add = 3
@@ -1139,7 +1216,7 @@ mod tests {
     fn partial_hunk_minus_kept_vs_demoted() {
         // hunk with two `-` lines (ordinals 0,1); select only 0
         let hunk = "@@ -5,4 +5,2 @@\n ctx\n-keep\n-demote\n ctx2\n";
-        let result = build_partial_hunk(hunk, &set(&[0]), false).expect("should produce patch");
+        let result = build_partial_hunk(hunk, &set(&[0]), false).unwrap().expect("should produce patch");
         // "keep" stays as `-keep`
         assert!(result.contains("-keep"), "kept minus preserved");
         // "demote" becomes ` demote` (context)
@@ -1153,7 +1230,7 @@ mod tests {
     fn partial_hunk_mixed_select_plus_only() {
         let hunk = "@@ -12,4 +12,4 @@\n ctx1\n-removed\n+added\n ctx2\n";
         // ordinal 0 = `-removed`, ordinal 1 = `+added`; select only 1
-        let result = build_partial_hunk(hunk, &set(&[1]), false).expect("should produce patch");
+        let result = build_partial_hunk(hunk, &set(&[1]), false).unwrap().expect("should produce patch");
         assert!(result.starts_with("@@ -12,3 +12,4 @@\n"), "header: {}", &result);
         assert!(result.contains(" removed"), "demoted to context");
         assert!(!result.contains("-removed"), "not a removal");
@@ -1165,17 +1242,20 @@ mod tests {
     fn partial_hunk_no_newline_marker() {
         let hunk = "@@ -1,1 +1,1 @@\n-old\n\\ No newline at end of file\n+new\n\\ No newline at end of file\n";
         // ordinal 0 = `-old`, ordinal 1 = `+new`
-        // select only 1 (the add); `-old` becomes context
-        let result_add_only = build_partial_hunk(hunk, &set(&[1]), false).expect("patch");
-        // The no-newline after `-old` becomes context so last_emitted=true → marker kept
-        // The no-newline after `+new` which is kept → also kept
-        assert!(result_add_only.contains("\\ No newline"), "marker kept after emitted lines");
-
-        // Now select only 0 (the remove); `+new` is dropped
-        let result_rm_only = build_partial_hunk(hunk, &set(&[0]), false).expect("patch");
-        // The no-newline after `-old` (which is kept): last_emitted=true → kept
-        // The no-newline after `+new` (which is dropped): last_emitted=false → dropped
-        // We expect marker after the kept `-old`, but not a second one after dropped `+new`
+
+        // Select only 1 (the add), so `-old` is demoted to context. This USED to emit a
+        // patch keeping the marker after that context line, which asserted `old` was
+        // file-final while `+new` followed it. `git apply --cached` accepts that and
+        // resolves the contradiction by concatenating: the index became "oldnew", not
+        // "old\nnew" (verified against real git). One context line cannot end the old
+        // image and not the new one, so no patch expresses this selection — refuse it.
+        let err = build_partial_hunk(hunk, &set(&[1]), false).unwrap_err();
+        assert!(err.contains("no-newline"), "should name the cause, got: {err}");
+
+        // Now select only 0 (the remove); `+new` is dropped. The old side genuinely ends
+        // at `old` with no newline and nothing follows it, so the marker still holds.
+        let result_rm_only = build_partial_hunk(hunk, &set(&[0]), false).unwrap().expect("patch");
+        // Marker after the kept `-old`, but not a second one after the dropped `+new`.
         let count = result_rm_only.matches("\\ No newline").count();
         assert_eq!(count, 1, "only one no-newline marker (after kept line), got: {}", result_rm_only);
     }
@@ -1184,14 +1264,14 @@ mod tests {
     #[test]
     fn partial_hunk_empty_selection_is_none() {
         let hunk = "@@ -1,2 +1,3 @@\n ctx\n+add\n ctx2\n";
-        assert!(build_partial_hunk(hunk, &set(&[]), false).is_none());
+        assert!(build_partial_hunk(hunk, &set(&[]), false).unwrap().is_none());
     }
 
     /// Count-omitted header `@@ -5 +5 @@` parses old_start as 5.
     #[test]
     fn partial_hunk_count_omitted_header() {
         let hunk = "@@ -5 +5 @@\n+newline\n";
-        let result = build_partial_hunk(hunk, &set(&[0]), false).expect("patch");
+        let result = build_partial_hunk(hunk, &set(&[0]), false).unwrap().expect("patch");
         assert!(result.starts_with("@@ -5,"), "old_start=5: {}", result);
     }
 
@@ -1207,7 +1287,7 @@ mod tests {
         let hunk = "@@ -10,14 +10,14 @@\n c1\n c2\n c3\n c4\n c5\n c6\n-removed\n+added\n c7\n c8\n c9\n c10\n c11\n c12\n";
 
         // Select only the `+added` (ordinal 1): the unselected `-removed` is demoted to context.
-        let result = build_partial_hunk(hunk, &set(&[1]), false).expect("should produce patch");
+        let result = build_partial_hunk(hunk, &set(&[1]), false).unwrap().expect("should produce patch");
         assert!(result.contains("+added"), "selected add kept");
         assert!(result.contains(" removed"), "unselected minus demoted to context");
         assert!(!result.contains("-removed"), "unselected minus is not a removal");
@@ -1235,7 +1315,7 @@ mod tests {
         assert_eq!(header, expected, "header counts must match emitted body: {}", result);
 
         // Select only the `-removed` (ordinal 0): the unselected `+added` is dropped.
-        let rm_only = build_partial_hunk(hunk, &set(&[0]), false).expect("should produce patch");
+        let rm_only = build_partial_hunk(hunk, &set(&[0]), false).unwrap().expect("should produce patch");
         assert!(rm_only.contains("-removed"), "selected minus kept as removal");
         assert!(!rm_only.contains("+added"), "unselected add dropped");
     }
@@ -1667,6 +1747,92 @@ mod tests {
         assert_eq!(fs::read_to_string(r.path.join("f.txt")).unwrap(), "a\nb\nB2\nc\n");
     }
 
+    // ---------------------------------------------------------------------
+    // Partial selections at a no-newline end of file
+    //
+    // When the last line of a file with no trailing newline changes, git emits a
+    // `-`/`+` pair where BOTH sides carry `\ No newline at end of file`. Selecting
+    // one half of that pair asks for a file where the restored line is no longer
+    // final — so it must GAIN a trailing newline that the marker denies it.
+    //
+    // The two directions are not symmetric. Reversing (discard/unstage) keeps the
+    // other half as context on the side that still ends there, so dropping the
+    // stale marker expresses it exactly. Going forward (stage) would need the
+    // demoted line to be newline-terminated on the new side and not on the old —
+    // which a single context line cannot say — so that one is refused.
+    // ---------------------------------------------------------------------
+
+    fn index_content(r: &TempRepo, f: &str) -> String {
+        let o = Command::new("git")
+            .current_dir(&r.path)
+            .args(["cat-file", "-p", &format!(":{}", f)])
+            .output()
+            .unwrap();
+        assert!(o.status.success(), "git cat-file failed");
+        String::from_utf8_lossy(&o.stdout).to_string()
+    }
+
+    /// Restoring the deletion must leave `t` and `T2` on SEPARATE lines. Before the
+    /// fix this returned Ok and silently produced "a\ntT2" — the two lines merged —
+    /// on the discard path, which has no reflog to recover from.
+    #[test]
+    fn discard_lines_at_no_newline_eof_keeps_lines_separate() {
+        let r = TempRepo::new();
+        r.commit_file("f.txt", "a\nt", "init");
+        r.write("f.txt", "a\nT2");
+        // Ordinals: -t=0, +T2=1. Restore the deletion, keep the addition.
+        discard_lines_now(&r, "f.txt", 0, &[0], 3).unwrap();
+        assert_eq!(read_file(&r, "f.txt"), "a\nt\nT2");
+    }
+
+    /// The index twin of the case above: same shape, same merge, same fix.
+    #[test]
+    fn unstage_lines_at_no_newline_eof_keeps_lines_separate() {
+        let r = TempRepo::new();
+        r.commit_file("f.txt", "a\nt", "init");
+        r.write("f.txt", "a\nT2");
+        r.git(&["add", "f.txt"]);
+        // Ordinals in the STAGED diff: -t=0, +T2=1. Unstage the deletion.
+        unstage_lines(&r.path, "f.txt", 0, &[0], 3).unwrap();
+        assert_eq!(index_content(&r, "f.txt"), "a\nt\nT2");
+    }
+
+    /// Staging only the addition cannot be expressed: `t` would have to be
+    /// newline-terminated in the index and not in HEAD, and one context line cannot
+    /// carry both. Refuse rather than emit a patch that applies cleanly and corrupts.
+    #[test]
+    fn stage_lines_at_no_newline_eof_refuses_rather_than_corrupting() {
+        let r = TempRepo::new();
+        r.commit_file("f.txt", "a\nt", "init");
+        r.write("f.txt", "a\nT2");
+        // Ordinals: -t=0, +T2=1. Stage only the addition.
+        let err = stage_lines(&r.path, "f.txt", 0, &[1], 3).unwrap_err();
+        assert!(
+            err.contains("no-newline"),
+            "error should name the cause, got: {err}"
+        );
+        // Nothing staged, and the working tree is untouched.
+        assert_eq!(index_content(&r, "f.txt"), "a\nt");
+        assert_eq!(read_file(&r, "f.txt"), "a\nT2");
+    }
+
+    /// The escape hatch the refusal leaves open: whole-hunk ops replay git's own
+    /// hunk verbatim, so they are unaffected by any of this.
+    #[test]
+    fn whole_hunk_ops_at_no_newline_eof_are_unaffected() {
+        let r = TempRepo::new();
+        r.commit_file("f.txt", "a\nt", "init");
+        r.write("f.txt", "a\nT2");
+        stage_hunk(&r.path, "f.txt", 0, 3).unwrap();
+        assert_eq!(index_content(&r, "f.txt"), "a\nT2");
+
+        let r2 = TempRepo::new();
+        r2.commit_file("f.txt", "a\nt", "init");
+        r2.write("f.txt", "a\nT2");
+        discard_hunk_now(&r2, "f.txt", 0, 3).unwrap();
+        assert_eq!(read_file(&r2, "f.txt"), "a\nt");
+    }
+
     #[test]
     fn working_changes_handles_space_in_path() {
         let r = TempRepo::new();
@@ -1711,7 +1877,7 @@ mod tests {
     fn partial_hunk_reverse_mixed_select_plus_drops_minus() {
         // ordinal 0 = `-removed`, ordinal 1 = `+added`; select only 1 (the add)
         let hunk = "@@ -12,4 +12,4 @@\n ctx1\n-removed\n+added\n ctx2\n";
-        let result = build_partial_hunk(hunk, &set(&[1]), true).expect("should produce patch");
+        let result = build_partial_hunk(hunk, &set(&[1]), true).unwrap().expect("should produce patch");
         // `-removed` must be dropped entirely in reverse mode (absent from staged image)
         assert!(!result.contains("-removed"), "unselected minus dropped in reverse");
         assert!(!result.contains(" removed"), "demoted context must NOT appear in reverse");

From 3513a5010baf999ba681e5ccf2d8dd1de78e6201 Mon Sep 17 00:00:00 2001
From: Ash Shah <494shah@gmail.com>
Date: Sat, 8 Aug 2026 16:09:41 -0700
Subject: [PATCH 27/41] fix: let the native context menu through where text is
 selectable
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A window-level handler cancelled every native context menu in the app. The
handful of row types with their own menu already call preventDefault
themselves, so all it did elsewhere was take functionality away: right-clicking
a commit-message box, a review textarea, diff code, or rendered Markdown gave
nothing at all — no Copy, Paste, Look Up, or spelling. On macOS that reads as
broken.

The intent was presumably to hide WebKit's developer menu, but `devtools` is
not in the Tauri feature list, so the inspector only exists on debug builds and
never ships. Nothing needed guarding in release.

Rather than invent a second notion of "editable or selectable", read the
computed `user-select`: the stylesheet right below already curates that set,
opting a no-select body back in for form fields, diff code, rendered markdown,
commit bodies and `.sha`. It inherits, so descendants of `.md`/`.selectable`
are covered without enumerating them, and DiffView's gutter — which sets its
own `user-select: none` so gutter-drag staging never selects text — keeps
suppressing its menu for free. Both the prefixed and unprefixed properties are
read: minimumSystemVersion is 12.3, where unprefixed support is not a given.

Verified by running the handler against the live stylesheet: chrome, nested
toolbar spans and the gutter suppress; input, textarea, .md and its
descendants, .diff-cell, .sha, .body-msg and deep .selectable children get the
native menu. What that menu RENDERS is a WKWebView decision no test
environment reproduces, so it still wants a look in a bundled build.

npm run check 524 files 0 errors; npm test 330 passed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 src/routes/+page.svelte | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/src/routes/+page.svelte b/src/routes/+page.svelte
index e57db74..1961bea 100644
--- a/src/routes/+page.svelte
+++ b/src/routes/+page.svelte
@@ -292,7 +292,19 @@
         updateCheckOnActivate();
       }
     };
-    const suppressNativeContextMenu = (event: MouseEvent) => event.preventDefault();
+    // Keep WebKit's menu off the app's own chrome, but let it through where text is
+    // selectable — that is where Copy/Paste/Look Up/spelling are worth having, and
+    // losing them on a commit message or a diff reads as broken on macOS. The
+    // `user-select` allowlist below already curates exactly that set, so read the
+    // computed value rather than keeping a second list in sync with it. It inherits,
+    // so descendants of `.md`/`.selectable` are covered, and DiffView's gutter
+    // re-suppresses itself. Rows with their own menu call preventDefault themselves.
+    const suppressNativeContextMenu = (event: MouseEvent) => {
+      const el = event.target as Element | null;
+      const style = el && getComputedStyle(el);
+      if (style && (style.webkitUserSelect || style.userSelect) !== "none") return;
+      event.preventDefault();
+    };
     window.addEventListener("focus", onActivate);
     document.addEventListener("visibilitychange", onActivate);
     window.addEventListener("contextmenu", suppressNativeContextMenu);

From a6673e83f9f5006181f0f50867b960702320cfa6 Mon Sep 17 00:00:00 2001
From: Ash Shah <494shah@gmail.com>
Date: Sat, 8 Aug 2026 17:44:29 -0700
Subject: [PATCH 28/41] fix: reject an existing bare repository as an init
 destination
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`initialize_repository` guarded against an existing repository two ways, and a
bare one slipped between them: it has no `.git` child, and `rev-parse
--is-inside-work-tree` answers `false` inside it. The destination is non-empty,
so the user got the "folder is not empty" prompt rather than "already a Git
repository" — and on confirming, `git init` ran with the bare repo as its
working directory.

Verified against real git: it prints "Initialized empty Git repository in
.../bare.git/.git/" and creates a nested repository inside the bare one. The
bare repo's own HEAD, refs and core.bare survive untouched — `diff -rq` against
a backup shows only the added `.git` — so this is a wrong state rather than
data loss, but it is exactly what the sibling guard exists to prevent.

Probe the destination itself with `rev-parse --resolve-git-dir`. It answers for
the path GIVEN and does not walk up to a parent, so a plain folder that merely
sits inside a repository is still a valid destination — that case belongs to
is_inside_worktree, and a test now pins it. The `.git` check is kept alongside
rather than replaced, so nothing that was refused before is accepted now.

Reported by Codex review on #26; the code is not part of that PR — it came from
15e51c3 (2026-07-17) and git_ops.rs is untouched there — so it is fixed here.

cargo test full workspace green (git-core 185); npm run check 524 files
0 errors; npm test 330 passed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 crates/git-core/src/git_ops.rs | 57 +++++++++++++++++++++++++++++++++-
 1 file changed, 56 insertions(+), 1 deletion(-)

diff --git a/crates/git-core/src/git_ops.rs b/crates/git-core/src/git_ops.rs
index 771a7c4..e586fd3 100644
--- a/crates/git-core/src/git_ops.rs
+++ b/crates/git-core/src/git_ops.rs
@@ -37,6 +37,21 @@ fn is_inside_worktree(path: &Path) -> bool {
         .unwrap_or(false)
 }
 
+/// Is `path` ITSELF a Git directory? True for a bare repository's own folder — which has no
+/// `.git` child, so an existence check on that never sees it — and for a normal repository's
+/// `.git`. `--resolve-git-dir` answers for the path given and does NOT walk up to a parent,
+/// so a plain folder that merely sits inside a repository is not mistaken for one; that case
+/// belongs to `is_inside_worktree`. Callers pass an absolute path (`parent` is canonicalized
+/// before the join), so the operand cannot be read as a flag.
+fn is_git_dir(path: &Path) -> bool {
+    Command::new("git")
+        .args(["rev-parse", "--resolve-git-dir"])
+        .arg(path)
+        .output()
+        .map(|output| output.status.success())
+        .unwrap_or(false)
+}
+
 /// Initialize a repository in one direct child of an existing parent folder.
 /// A non-empty destination is reported without mutation until the caller
 /// explicitly retries with `allow_non_empty`.
@@ -91,7 +106,10 @@ pub fn initialize_repository(
     if destination.exists() && !destination.is_dir() {
         return Err("A file already exists at the requested repository path.".to_string());
     }
-    if destination.join(".git").exists() {
+    // `.git` catches a normal repository; `is_git_dir` catches a bare one, which has no `.git`
+    // child and reports `false` for `--is-inside-work-tree`, so it slipped past both guards and
+    // `git init` would nest a fresh repository inside it.
+    if destination.join(".git").exists() || is_git_dir(&destination) {
         return Err("That folder is already a Git repository. Open it instead.".to_string());
     }
     let nesting_probe = if destination.is_dir() {
@@ -432,4 +450,41 @@ mod tests {
         assert!(err.contains("nested repository"));
         assert!(!parent.0.join("nested").exists());
     }
+
+    /// A bare repository has no `.git` child, and `rev-parse --is-inside-work-tree` answers
+    /// `false` inside one — so neither existing guard saw it. `allow_non_empty` here is the
+    /// dangerous path: the user is warned the folder is not empty, confirms, and `git init`
+    /// then creates a nested repository inside the bare one.
+    #[test]
+    fn initialize_repository_rejects_an_existing_bare_repository() {
+        let parent = TempFolder::new();
+        let mut init = Command::new("git");
+        init.current_dir(&parent.0).args(["init", "-q", "--bare", "shipped.git"]);
+        run(&mut init).unwrap();
+
+        let err = initialize_repository(&parent.0, "shipped.git", "main", true).unwrap_err();
+
+        assert!(
+            err.contains("already a Git repository"),
+            "should be refused as an existing repository, got: {err}"
+        );
+        assert!(
+            !parent.0.join("shipped.git").join(".git").exists(),
+            "must not have initialized a nested repository inside the bare one"
+        );
+    }
+
+    /// The guard must not over-reach: a plain folder that merely sits next to a repository
+    /// is still a valid destination. `--resolve-git-dir` answers for the path given and does
+    /// not walk up, which is what keeps this case working.
+    #[test]
+    fn initialize_repository_still_accepts_a_plain_empty_folder() {
+        let parent = TempFolder::new();
+        fs::create_dir(parent.0.join("fresh")).unwrap();
+
+        let result = initialize_repository(&parent.0, "fresh", "main", true).unwrap();
+
+        assert!(result.initialized);
+        assert!(parent.0.join("fresh").join(".git").is_dir());
+    }
 }

From 652543ed6f43d9853e03084e1f8f5098496dedd4 Mon Sep 17 00:00:00 2001
From: Ash Shah <494shah@gmail.com>
Date: Sat, 8 Aug 2026 19:37:29 -0700
Subject: [PATCH 29/41] fix: stop a line or hunk discard from reverting a mode
 change
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`chmod +x` plus an edited line is one diff with one file header, and git puts
`old mode`/`new mode` in that header. Discard reverse-applies the header to the
working tree, and `git apply` honours a mode pair — so "Discard 1 line" also
took the executable bit off. Not in the confirmation, not in the line count,
and not undoable.

Verified against real git: reverse-applying the header with the mode pair took
f.sh from 755 to 644 while reverting the text; dropping the two mode lines left
755 and reverted the text just the same.

Codex flagged `discard_lines`. `discard_hunk` reverse-applies the same header
and loses the bit identically, so both destructive ops now build a content-only
header. Stage and unstage keep the mode deliberately: there it belongs to the
same index entry the caller is moving, and the result is recoverable either way.

cargo test -p git-core: 222 passed (the one failure in a full run is the
`git_ops.rs` init-repo flake, fixed on `next` by #25 and merged in next commit).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 crates/git-core/src/ops_worktree.rs | 53 +++++++++++++++++++++++++++--
 1 file changed, 51 insertions(+), 2 deletions(-)

diff --git a/crates/git-core/src/ops_worktree.rs b/crates/git-core/src/ops_worktree.rs
index f44185b..353cfaf 100644
--- a/crates/git-core/src/ops_worktree.rs
+++ b/crates/git-core/src/ops_worktree.rs
@@ -585,6 +585,20 @@ pub fn unstage_lines(repo: &Path, path: &str, hunk_index: usize, selected: &[usi
     git_apply(repo, &format!("{}{}", header, partial), true, true, context == 0)
 }
 
+/// Strip `old mode` / `new mode` from a file header, leaving the content change alone.
+///
+/// A discard reverse-applies to the WORKING TREE, and `git apply` honours a mode pair in the
+/// header. So `chmod +x` plus an edited line — one diff, one header — meant "Discard 1 line"
+/// silently reverted the executable bit too: not in the confirmation, not in the line count, and
+/// not undoable. Stage/unstage keep the mode deliberately; there the mode belongs to the same
+/// index entry the caller is moving, and the result is recoverable either way.
+fn content_only_header(header: &str) -> String {
+    header
+        .split_inclusive('\n')
+        .filter(|line| !line.starts_with("old mode ") && !line.starts_with("new mode "))
+        .collect()
+}
+
 /// Refuse a discard whose `hunk_index` / ordinals were picked against a different diff.
 ///
 /// `expected_diff` is the exact `diff()` text the caller displayed. The confirmation dialog in
@@ -626,7 +640,7 @@ pub fn discard_hunk(
     require_unchanged_diff(&d, expected_diff)?;
     let (header, hunks) = split_hunks(&d);
     let h = hunks.get(hunk_index).ok_or("hunk index out of range")?;
-    git_apply(repo, &format!("{}{}", header, reanchor_hunk(h, true)), true, false, context == 0)
+    git_apply(repo, &format!("{}{}", content_only_header(&header), reanchor_hunk(h, true)), true, false, context == 0)
 }
 
 /// Discard selected change-line ordinals of one hunk of `path`'s UNSTAGED diff.
@@ -652,7 +666,7 @@ pub fn discard_lines(
     let h = hunks.get(hunk_index).ok_or("hunk index out of range")?;
     let set: std::collections::HashSet<usize> = selected.iter().copied().collect();
     let partial = build_partial_hunk(h, &set, true).ok_or("no lines selected to discard")?;
-    git_apply(repo, &format!("{}{}", header, partial), true, false, context == 0)
+    git_apply(repo, &format!("{}{}", content_only_header(&header), partial), true, false, context == 0)
 }
 
 /// Stash current changes (staged + unstaged). Message is optional.
@@ -1667,6 +1681,41 @@ mod tests {
         assert_eq!(fs::read_to_string(r.path.join("f.txt")).unwrap(), "a\nb\nB2\nc\n");
     }
 
+    /// `chmod +x` plus an edit makes git put `old mode`/`new mode` in the FILE header, and the
+    /// whole header is what gets reverse-applied. Discarding text would then also revert the
+    /// executable bit — a change the confirmation never mentions and the line count never counts.
+    #[test]
+    fn discard_lines_leaves_a_mode_change_alone() {
+        use std::os::unix::fs::PermissionsExt;
+        let r = TempRepo::new();
+        r.commit_file("f.sh", "a\nb\nc\n", "init");
+        r.write("f.sh", "a\nB2\nc\n");
+        fs::set_permissions(r.path.join("f.sh"), fs::Permissions::from_mode(0o755)).unwrap();
+
+        // Ordinals: -b=0, +B2=1. Discard only the deletion.
+        discard_lines_now(&r, "f.sh", 0, &[0], 3).unwrap();
+
+        assert_eq!(read_file(&r, "f.sh"), "a\nb\nB2\nc\n");
+        let mode = fs::metadata(r.path.join("f.sh")).unwrap().permissions().mode() & 0o777;
+        assert_eq!(mode, 0o755, "the chmod +x must survive a line discard");
+    }
+
+    /// Same leak one function over: `discard_hunk` reverse-applies the same header.
+    #[test]
+    fn discard_hunk_leaves_a_mode_change_alone() {
+        use std::os::unix::fs::PermissionsExt;
+        let r = TempRepo::new();
+        r.commit_file("f.sh", "a\nb\nc\n", "init");
+        r.write("f.sh", "a\nB2\nc\n");
+        fs::set_permissions(r.path.join("f.sh"), fs::Permissions::from_mode(0o755)).unwrap();
+
+        discard_hunk_now(&r, "f.sh", 0, 3).unwrap();
+
+        assert_eq!(read_file(&r, "f.sh"), "a\nb\nc\n");
+        let mode = fs::metadata(r.path.join("f.sh")).unwrap().permissions().mode() & 0o777;
+        assert_eq!(mode, 0o755, "the chmod +x must survive a hunk discard");
+    }
+
     #[test]
     fn working_changes_handles_space_in_path() {
         let r = TempRepo::new();

From 13d8ed70388cc020b1e2aca808e2c28712c601ff Mon Sep 17 00:00:00 2001
From: Ash Shah <494shah@gmail.com>
Date: Sat, 8 Aug 2026 19:37:41 -0700
Subject: [PATCH 30/41] fix: re-fetch the diff after a discard is refused as
 stale
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A discard carries the patch the user was judging so git-core can refuse one
picked against a diff that has since moved. That guard worked, but the retry
did not: `applyWorkingChanges` compares WorkingFile metadata and skips the
update when it matches, so an external edit to an ALREADY-modified file leaves
the status list identical, never bumps `workingChangesRev`, and the shown patch
stays stale. `runWorktree` does not refresh on failure, so every retry sent the
same stale patch and got the same refusal — until the user happened to reselect
the file or change the context depth.

Add `invalidateWorkingDiff()`, which bumps the revision the diff effect keys
on, and call it when a discard fails. Refusal becomes something the next click
can get past instead of a dead end. Deliberately on any discard failure rather
than only the stale one: after a failed destructive op the shown state is
unverified either way, and matching on message text would be brittle.

Success still refreshes exactly once through `runWorktree` — untouched, so the
stage/unstage row animation is unaffected.

npm run check 530 files 0 errors; npm test 386 passed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 src/lib/gitActions.ts   | 39 +++++++++++++++++++++++++++++----------
 src/lib/store.svelte.ts | 11 +++++++++++
 2 files changed, 40 insertions(+), 10 deletions(-)

diff --git a/src/lib/gitActions.ts b/src/lib/gitActions.ts
index 2048ef4..a9aa500 100644
--- a/src/lib/gitActions.ts
+++ b/src/lib/gitActions.ts
@@ -529,6 +529,21 @@ function discardMessage(n: number, unit: string, path: string, revertsToIndex: b
     : `Permanently discard ${what}. This cannot be undone. (Stash instead to keep them.)`;
 }
 
+/**
+ * Settle a discard result. On failure, force the shown diff to re-fetch.
+ *
+ * A discard carries the patch the user was judging so git-core can refuse one picked against a
+ * diff that has since moved. But the fswatch refresh compares WorkingFile metadata, so an
+ * external edit to an already-modified file leaves the status list identical and the shown patch
+ * stale — every retry would then be refused with the same stale patch until the user happened to
+ * reselect the file or change the context depth. Re-fetching turns the refusal into something the
+ * next click can actually get past. Success needs nothing: `runWorktree` already reloads.
+ */
+function discarded(ok: boolean): boolean {
+  if (!ok) appState.invalidateWorkingDiff();
+  return ok;
+}
+
 // Run a working-copy op (non-destructive): guard → run → refresh working changes + graph.
 async function runWorktree(label: string, fn: () => Promise<unknown>): Promise<boolean> {
   if (!isTauri()) {
@@ -914,8 +929,10 @@ export const gitActions = {
       danger: true,
     });
     if (!confirmed) return false;
-    return runWorktree(`Discard hunk in ${path}`, () =>
-      api.discardHunk(appState.repo, path, hunkIndex, expectedDiff, appState.effectiveDiffContext),
+    return discarded(
+      await runWorktree(`Discard hunk in ${path}`, () =>
+        api.discardHunk(appState.repo, path, hunkIndex, expectedDiff, appState.effectiveDiffContext),
+      ),
     );
   },
   discardLines: async (
@@ -941,14 +958,16 @@ export const gitActions = {
       danger: true,
     });
     if (!confirmed) return false;
-    return runWorktree(`Discard ${n} line(s) in ${path}`, () =>
-      api.discardLines(
-        appState.repo,
-        path,
-        hunkIndex,
-        selected,
-        expectedDiff,
-        appState.effectiveDiffContext,
+    return discarded(
+      await runWorktree(`Discard ${n} line(s) in ${path}`, () =>
+        api.discardLines(
+          appState.repo,
+          path,
+          hunkIndex,
+          selected,
+          expectedDiff,
+          appState.effectiveDiffContext,
+        ),
       ),
     );
   },
diff --git a/src/lib/store.svelte.ts b/src/lib/store.svelte.ts
index ff4ba58..d4b0879 100644
--- a/src/lib/store.svelte.ts
+++ b/src/lib/store.svelte.ts
@@ -1952,6 +1952,17 @@ function makeState() {
       workingChanges = v;
       workingChangesRev++;
     },
+    /**
+     * Force the displayed diff to re-fetch when the file LIST has not changed.
+     * `applyWorkingChanges` compares WorkingFile metadata and skips the update when it
+     * matches, so an external edit to an already-modified file never bumps the revision
+     * and the shown patch silently goes stale. Discard sends that patch to the backend as
+     * proof of what the user was looking at, so a stale one is refused — and without this
+     * every retry would be refused identically.
+     */
+    invalidateWorkingDiff() {
+      workingChangesRev++;
+    },
     get workingChangesRev() {
       return workingChangesRev;
     },

From eab322629f1260dd5f1abbd5704b594baf24d4eb Mon Sep 17 00:00:00 2001
From: Ash Shah <494shah@gmail.com>
Date: Sat, 8 Aug 2026 20:13:33 -0700
Subject: [PATCH 31/41] fix: make partial discard work on an intent-to-add
 file, and pin diff prefixes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`git add -N` makes a path tracked-and-unstaged, so the UI offers line-level
discard on it. Its diff header says `new file mode` / `--- /dev/null`, but a
partial selection keeps the unselected additions as CONTEXT — an old side the
header denies — and git refused the whole apply with "new file X depends on old
contents". Whole-hunk discard worked, so it looked arbitrary.

The deleted-file mirror needs no repair: reverse-apply DROPS unselected `-`
lines rather than demoting them, so the new side stays empty and `+++ /dev/null`
stays true. The repair is therefore conditioned on the emitted hunk having an
old side, which also leaves a selection covering every addition alone so it
still deletes the file the way a whole-hunk discard does.

Adversarial review caught the first attempt being far worse than the bug. It
rewrote the `---` side by replacing the first `b/` ANYWHERE in the `+++` path.
`diff()` did not pin the prefixes, so under `diff.mnemonicPrefix` (prefixes
become `i/`/`w/`) `w/lib/util.js` became `w/lia/util.js` — git read that as a
rename and applied it: the file the user asked to discard one line from was
emptied, a committed file they never touched was rewritten, and it returned
Ok(()). Reproduced against real git.

Two changes, either of which would have prevented it, because this path has no
reflog:

- `diff()` pins `--src-prefix=a/ --dst-prefix=b/`. The output is not merely
  displayed, it is fed back to `git apply`; the user's config governs what they
  read in a terminal, not what this reconstructs. Also closes a pre-existing
  hazard: under `diff.noprefix` a patch loses a component to apply's `-p1` and
  lands on the wrong file, which affects stage/unstage too.
- The rewrite only ever swaps a LEADING `b/`, and when there is no such prefix
  the header is left completely untouched — the shape that shipped before this
  repair, which git refuses. Half-repairing was never verified, so it is not a
  state worth entering.

`discard_lines_is_unaffected_by_diff_prefix_config` covers both configs and
asserts the neighbour file is untouched; confirmed to fail without the pin.

cargo test -p git-core 225 passed; npm run check 530 files 0 errors;
npm test 386 passed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 crates/git-core/src/ops_worktree.rs | 138 ++++++++++++++++++++++++++--
 1 file changed, 128 insertions(+), 10 deletions(-)

diff --git a/crates/git-core/src/ops_worktree.rs b/crates/git-core/src/ops_worktree.rs
index 353cfaf..d415504 100644
--- a/crates/git-core/src/ops_worktree.rs
+++ b/crates/git-core/src/ops_worktree.rs
@@ -178,6 +178,13 @@ pub fn diff(repo: &Path, path: Option<&str>, staged: bool, context: u32) -> Resu
     c.current_dir(repo)
         .arg("diff")
         .arg("--no-color")
+        // Pin the path prefixes. `diff.mnemonicPrefix` rewrites them per-command (`i/`, `w/`, `c/`)
+        // and `diff.noprefix` removes them entirely, and this output is not just displayed — the
+        // hunks are fed straight back to `git apply`. Under `noprefix` the patch loses a path
+        // component to apply's default `-p1` and lands on the WRONG FILE; anything that reads the
+        // `a/`…`b/` convention out of the header is likewise wrong. The user's config governs what
+        // they read in a terminal, not what this reconstructs and re-applies.
+        .args(["--src-prefix=a/", "--dst-prefix=b/"])
         .arg(format!("-U{}", context));
     if staged {
         c.arg("--cached");
@@ -585,17 +592,67 @@ pub fn unstage_lines(repo: &Path, path: &str, hunk_index: usize, selected: &[usi
     git_apply(repo, &format!("{}{}", header, partial), true, true, context == 0)
 }
 
-/// Strip `old mode` / `new mode` from a file header, leaving the content change alone.
+/// Build the file header for a discard patch: git's own header, minus the parts that describe
+/// the FILE rather than its contents and would otherwise be applied as unasked-for side effects.
 ///
-/// A discard reverse-applies to the WORKING TREE, and `git apply` honours a mode pair in the
-/// header. So `chmod +x` plus an edited line — one diff, one header — meant "Discard 1 line"
-/// silently reverted the executable bit too: not in the confirmation, not in the line count, and
-/// not undoable. Stage/unstage keep the mode deliberately; there the mode belongs to the same
-/// index entry the caller is moving, and the result is recoverable either way.
-fn content_only_header(header: &str) -> String {
+/// - `old mode` / `new mode`. `git apply` honours a mode pair, so `chmod +x` plus an edited line
+///   — one diff, one header — meant "Discard 1 line" also took the executable bit off. Not in the
+///   confirmation, not in the line count, not undoable. Always dropped here. Stage and unstage
+///   keep the mode deliberately: there it belongs to the same index entry the caller is moving,
+///   and the result is recoverable either way.
+///
+/// - `new file mode` + `--- /dev/null`. True of the whole diff of an intent-to-add path
+///   (`git add -N`), which `working_changes` reports as tracked-and-unstaged so the UI offers
+///   line-level discard on it. But a partial selection keeps the unselected additions as CONTEXT,
+///   which gives the patch an old side the header denies, and git refuses the lot with
+///   "new file X depends on old contents". Rewritten to an ordinary content header exactly when
+///   the emitted hunk has an old side, so a selection covering every addition still deletes the
+///   file the way a whole-hunk discard does.
+///
+/// The deleted-file mirror (`+++ /dev/null`) needs no such repair: reverse-apply DROPS unselected
+/// `-` lines rather than demoting them, so the new side stays empty and the header stays true.
+fn discard_header(header: &str, hunk: &str) -> String {
+    let keeps_old_side = parse_hunk_header(hunk.lines().next().unwrap_or(""))
+        .is_some_and(|(_, old_n, _, _, _)| old_n > 0);
+    // Derive the `---` side from the `+++` one rather than re-deriving the path: swapping the
+    // leading `b/` leaves git's quoting of exotic paths intact (the quote precedes the prefix,
+    // so `"b/od\td"` becomes `"a/od\td"`).
+    //
+    // Only ever swap a LEADING `b/`. `diff()` pins the prefixes, but if that ever stops being
+    // true a blind `replace` would hit the first `b/` inside the pathname instead — turning
+    // `w/lib/util.js` into `w/lia/util.js`, which git reads as a rename and applies to a file the
+    // user never touched. Verified: it empties the real file and rewrites the innocent one, and
+    // returns success. When the prefix is absent we emit nothing and git refuses the patch, which
+    // is the only acceptable default on an apply with no reflog behind it.
+    let old_side = header
+        .lines()
+        .find_map(|l| l.strip_prefix("+++ "))
+        .and_then(|p| {
+            let (quote, rest) = match p.strip_prefix('"') {
+                Some(rest) => ("\"", rest),
+                None => ("", p),
+            };
+            rest.strip_prefix("b/")
+                .map(|tail| format!("--- {quote}a/{tail}\n"))
+        });
+    // Repair the new-file header only when there is a real path to repair it WITH. Otherwise
+    // leave every line of it alone: an untouched header is the behaviour that shipped before
+    // this repair existed, and git refuses it. Half-repairing — dropping `new file mode` while
+    // keeping `--- /dev/null` — is a shape nothing has verified.
+    let normalize_new_file = keeps_old_side && old_side.is_some();
     header
         .split_inclusive('\n')
-        .filter(|line| !line.starts_with("old mode ") && !line.starts_with("new mode "))
+        .filter_map(|line| {
+            if line.starts_with("old mode ") || line.starts_with("new mode ") {
+                None
+            } else if normalize_new_file && line.starts_with("new file mode ") {
+                None
+            } else if normalize_new_file && line.starts_with("--- /dev/null") {
+                old_side.clone()
+            } else {
+                Some(line.to_string())
+            }
+        })
         .collect()
 }
 
@@ -640,7 +697,8 @@ pub fn discard_hunk(
     require_unchanged_diff(&d, expected_diff)?;
     let (header, hunks) = split_hunks(&d);
     let h = hunks.get(hunk_index).ok_or("hunk index out of range")?;
-    git_apply(repo, &format!("{}{}", content_only_header(&header), reanchor_hunk(h, true)), true, false, context == 0)
+    let reanchored = reanchor_hunk(h, true);
+    git_apply(repo, &format!("{}{}", discard_header(&header, &reanchored), reanchored), true, false, context == 0)
 }
 
 /// Discard selected change-line ordinals of one hunk of `path`'s UNSTAGED diff.
@@ -666,7 +724,7 @@ pub fn discard_lines(
     let h = hunks.get(hunk_index).ok_or("hunk index out of range")?;
     let set: std::collections::HashSet<usize> = selected.iter().copied().collect();
     let partial = build_partial_hunk(h, &set, true).ok_or("no lines selected to discard")?;
-    git_apply(repo, &format!("{}{}", content_only_header(&header), partial), true, false, context == 0)
+    git_apply(repo, &format!("{}{}", discard_header(&header, &partial), partial), true, false, context == 0)
 }
 
 /// Stash current changes (staged + unstaged). Message is optional.
@@ -1700,6 +1758,66 @@ mod tests {
         assert_eq!(mode, 0o755, "the chmod +x must survive a line discard");
     }
 
+    /// `git add -N` makes a path tracked-but-unstaged, so the UI offers line-level discard on it.
+    /// Its diff header says `new file mode` / `--- /dev/null`, and a partial selection keeps the
+    /// unselected additions as CONTEXT — giving the patch a non-empty old side the header denies.
+    /// Git refused the whole thing with "new file n.txt depends on old contents".
+    #[test]
+    fn discard_lines_on_an_intent_to_add_file_keeps_the_unselected_lines() {
+        let r = TempRepo::new();
+        r.commit_file("base.txt", "base\n", "init");
+        r.write("n.txt", "a\nb\nc\n");
+        r.git(&["add", "-N", "--", "n.txt"]);
+
+        // Ordinals: +a=0, +b=1, +c=2. Discard only the first added line.
+        discard_lines_now(&r, "n.txt", 0, &[0], 3).unwrap();
+
+        assert_eq!(read_file(&r, "n.txt"), "b\nc\n");
+    }
+
+    /// `diff.mnemonicPrefix` renames the path prefixes per-command (`i/`, `w/`), and `diff.noprefix`
+    /// drops them. This output is not merely displayed — it is fed back to `git apply` — so an
+    /// unpinned prefix aims the patch at the wrong path. Caught by review: rewriting the `---` side
+    /// by replacing the first `b/` anywhere turned `w/lib/util.js` into `w/lia/util.js`, which git
+    /// reads as a rename; it emptied the file the user was editing, rewrote an untouched committed
+    /// one, and returned Ok. `diff()` now pins `--src-prefix`/`--dst-prefix`.
+    #[test]
+    fn discard_lines_is_unaffected_by_diff_prefix_config() {
+        for (key, value) in [("diff.mnemonicPrefix", "true"), ("diff.noprefix", "true")] {
+            let r = TempRepo::new();
+            r.git(&["config", key, value]);
+            // A committed neighbour whose name is one byte from the `b/`-mangled form of `lib/…`.
+            r.git(&["config", "user.email", "t@example.com"]);
+            r.write("lia.txt", "a\nb\nc\n");
+            r.git(&["add", "--", "lia.txt"]);
+            r.git(&["commit", "-qm", "seed"]);
+            fs::create_dir_all(r.path.join("lib")).unwrap();
+            r.write("lib/util.js", "a\nb\nc\n");
+            r.git(&["add", "-N", "--", "lib/util.js"]);
+
+            discard_lines_now(&r, "lib/util.js", 0, &[0], 3)
+                .unwrap_or_else(|e| panic!("{key}={value}: discard failed: {e}"));
+
+            assert_eq!(read_file(&r, "lib/util.js"), "b\nc\n", "{key}={value}: wrong file content");
+            assert_eq!(read_file(&r, "lia.txt"), "a\nb\nc\n", "{key}={value}: neighbour was touched");
+        }
+    }
+
+    /// The other side of that repair: when the selection covers every addition the patch has no
+    /// old side at all, so the `new file` header is still true and must be left alone — the file
+    /// goes away, exactly as a whole-hunk discard would do.
+    #[test]
+    fn discard_lines_on_an_intent_to_add_file_selecting_all_removes_the_file() {
+        let r = TempRepo::new();
+        r.commit_file("base.txt", "base\n", "init");
+        r.write("n.txt", "a\nb\nc\n");
+        r.git(&["add", "-N", "--", "n.txt"]);
+
+        discard_lines_now(&r, "n.txt", 0, &[0, 1, 2], 3).unwrap();
+
+        assert!(!r.path.join("n.txt").exists(), "every added line discarded — file should be gone");
+    }
+
     /// Same leak one function over: `discard_hunk` reverse-applies the same header.
     #[test]
     fn discard_hunk_leaves_a_mode_change_alone() {

From 2d0dd0c042bfcb9ac870ff01e9483e188f7be5d9 Mon Sep 17 00:00:00 2001
From: Ash Shah <494shah@gmail.com>
Date: Sat, 8 Aug 2026 20:34:47 -0700
Subject: [PATCH 32/41] style: merge two identical filter_map arms in
 discard_header

`clippy::if_same_then_else` fired on the two arms that both drop a header line:
the mode pair, and `new file mode` when the new-file header is being repaired.
Name the two conditions and test them together. No behaviour change.

Missed locally because the documented gate is `npm run check` + `npm test` +
`cargo test`, while CI also runs `cargo clippy -p git-core -p git-it -D warnings`.

cargo test -p git-core -p git-it green; clippy clean.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 crates/git-core/src/ops_worktree.rs | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/crates/git-core/src/ops_worktree.rs b/crates/git-core/src/ops_worktree.rs
index d415504..d11ac43 100644
--- a/crates/git-core/src/ops_worktree.rs
+++ b/crates/git-core/src/ops_worktree.rs
@@ -643,9 +643,9 @@ fn discard_header(header: &str, hunk: &str) -> String {
     header
         .split_inclusive('\n')
         .filter_map(|line| {
-            if line.starts_with("old mode ") || line.starts_with("new mode ") {
-                None
-            } else if normalize_new_file && line.starts_with("new file mode ") {
+            let mode_pair = line.starts_with("old mode ") || line.starts_with("new mode ");
+            let new_file = normalize_new_file && line.starts_with("new file mode ");
+            if mode_pair || new_file {
                 None
             } else if normalize_new_file && line.starts_with("--- /dev/null") {
                 old_side.clone()

From 6c282fb0cc562e57007a0e0e00fe61296ebe4f22 Mon Sep 17 00:00:00 2001
From: Ash Shah <494shah@gmail.com>
Date: Sun, 9 Aug 2026 13:46:39 -0700
Subject: [PATCH 33/41] fix: defer an automatic update prompt for every
 overlay, not just dialogs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`tryPresentPendingAutomaticUpdate` gated on `dialogs.state` alone, so a check
completing while Settings, Manage Repository, amend/rebase, branch-colour or a
GitHub action was open still passed the guard — and the update dialog, which
sits at a higher z-index, mounted straight over the workflow in progress.

`overlays.ts` already exists as the one place that knows every overlay
singleton, precisely so callers stop chasing individual stores and drifting as
new ones are added. Ask it instead. The pending update is not dropped: the
existing retry timer re-checks until nothing is covering the screen.

`dialogs` stays imported — still used by the two confirm() calls below. No
import cycle: nothing overlays.ts pulls in imports the updater.

Reported by Codex review on #27.

npm run check 524 files 0 errors; npm test 330 passed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 src/lib/updater.svelte.ts | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/src/lib/updater.svelte.ts b/src/lib/updater.svelte.ts
index 50d9377..7570031 100644
--- a/src/lib/updater.svelte.ts
+++ b/src/lib/updater.svelte.ts
@@ -3,6 +3,7 @@
 // decisions use the app's modal dialog system.
 import { appState } from "./store.svelte";
 import { dialogs } from "./dialogs.svelte";
+import { anyOverlayOpen } from "./overlays";
 import { api } from "./api";
 import type { DownloadEvent, UpdateInfo } from "./types";
 
@@ -149,12 +150,12 @@ async function tryPresentPendingAutomaticUpdate(): Promise<void> {
     pendingAutomaticUpdate = null;
     return;
   }
-  if (
-    !pendingAutomaticUpdate ||
-    checking ||
-    presenting ||
-    dialogs.state.kind !== "none"
-  ) {
+  // `anyOverlayOpen()` rather than just `dialogs.state`: an automatic check that lands while
+  // Settings, Manage Repository, amend/rebase, branch-colour or a GitHub action is open would
+  // otherwise mount the update dialog — which sits at a higher z-index — straight over the
+  // workflow the user is in the middle of. overlays.ts is the one place that knows every
+  // overlay singleton, so asking it there keeps this from drifting as new ones are added.
+  if (!pendingAutomaticUpdate || checking || presenting || anyOverlayOpen()) {
     schedulePendingPromptRetry();
     return;
   }

From 4ddc2afb2cdf70dabdce5500e14616328e6cbfca Mon Sep 17 00:00:00 2001
From: Ash Shah <494shah@gmail.com>
Date: Sun, 9 Aug 2026 13:46:53 -0700
Subject: [PATCH 34/41] fix: reject a Git directory as the parent, and declare
 the Node floor

Two findings from Codex review on #29.

**Git directory as parent.** The same blind spot this PR fixed for the
destination, one level up. When the destination does not exist yet the nesting
probe falls back to the PARENT, and `--is-inside-work-tree` answers false
inside a Git directory just as it does inside a bare repo. Verified: selecting
`some-repo/.git` produced `some-repo/.git/proj`, a whole repository inside
another repository's metadata, and returned initialized: true. A bare repo as
parent did the same. `is_git_dir(&parent)` now rejects both before any
filesystem mutation, with a message that names the actual problem.

**Node floor.** Vite 8 requires `^20.19.0 || >=22.12.0` (recorded in
package-lock.json) but package.json declared no `engines` and the
build-from-source instructions named no version, so `npm install` on Node 18 or
early 20 warns and then fails later as a confusing build error. Declared in
`engines` and stated in the README next to the commands it governs. CI already
builds on 24, so this documents the existing requirement rather than changing
it. Unrelated to the rest of this PR, but fixing it here keeps the review on
one branch.

cargo test 186 + 7 passed; clippy clean; npm run check 524 files 0 errors;
npm test 330 passed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 README.md                      |  3 +++
 crates/git-core/src/git_ops.rs | 42 ++++++++++++++++++++++++++++++++++
 package.json                   |  3 +++
 3 files changed, 48 insertions(+)

diff --git a/README.md b/README.md
index 1c42534..77e88e3 100644
--- a/README.md
+++ b/README.md
@@ -72,6 +72,9 @@ If `git` or `python3` is missing, the app shows a startup banner with an **Insta
 
 ## Build from source
 
+Needs **Node `^20.19.0 || >=22.12.0`** (Vite 8's floor; CI builds on 24). `npm install` only warns
+on an older runtime, so the failure would otherwise surface later as a confusing build error.
+
 ```sh
 npm install
 npm run tauri dev      # run the app in development
diff --git a/crates/git-core/src/git_ops.rs b/crates/git-core/src/git_ops.rs
index e586fd3..e2a91d8 100644
--- a/crates/git-core/src/git_ops.rs
+++ b/crates/git-core/src/git_ops.rs
@@ -66,6 +66,16 @@ pub fn initialize_repository(
     if !parent.is_dir() {
         return Err("The selected parent path is not a folder.".to_string());
     }
+    // A Git directory is still a folder, and `--is-inside-work-tree` answers false inside one, so
+    // the nesting probe below cannot catch it either — and when the destination does not exist yet
+    // that probe falls back to this very path. Picking `some-repo/.git`, or a bare repo, would
+    // therefore create the new repository inside another repository's metadata.
+    if is_git_dir(&parent) {
+        return Err(
+            "The selected parent folder is a Git repository's internal directory. Choose a different folder."
+                .to_string(),
+        );
+    }
 
     let name = folder_name.trim();
     if name.is_empty()
@@ -474,6 +484,38 @@ mod tests {
         );
     }
 
+    /// The same blind spot one level up. When the destination does not exist yet the nesting probe
+    /// falls back to the PARENT, and `--is-inside-work-tree` is false inside a Git directory just
+    /// as it is inside a bare repo — so picking `some-repo/.git` (or a bare repo) as the parent
+    /// created the new repository inside another repository's metadata.
+    #[test]
+    fn initialize_repository_rejects_a_git_directory_as_parent() {
+        let outer = TempFolder::new();
+
+        // A normal repository's `.git`, and a bare repository, are both Git directories.
+        let mut init = Command::new("git");
+        init.current_dir(&outer.0).args(["init", "-q", "host"]);
+        run(&mut init).unwrap();
+        let mut bare = Command::new("git");
+        bare.current_dir(&outer.0).args(["init", "-q", "--bare", "shipped.git"]);
+        run(&mut bare).unwrap();
+
+        for parent in [outer.0.join("host").join(".git"), outer.0.join("shipped.git")] {
+            let err = initialize_repository(&parent, "proj", "main", false)
+                .expect_err(&format!("{} should have been refused", parent.display()));
+            assert!(
+                err.contains("Git repository"),
+                "{}: should be refused, got: {err}",
+                parent.display()
+            );
+            assert!(
+                !parent.join("proj").exists(),
+                "{}: must not have created anything inside a Git directory",
+                parent.display()
+            );
+        }
+    }
+
     /// The guard must not over-reach: a plain folder that merely sits next to a repository
     /// is still a valid destination. `--resolve-git-dir` answers for the path given and does
     /// not walk up, which is what keeps this case working.
diff --git a/package.json b/package.json
index ee90da3..19c2b58 100644
--- a/package.json
+++ b/package.json
@@ -39,5 +39,8 @@
     "typescript": "~5.6.2",
     "vite": "^8.1.4",
     "vitest": "^4.1.10"
+  },
+  "engines": {
+    "node": "^20.19.0 || >=22.12.0"
   }
 }

From 87a0114bb2cc22711959495a8ea8dd36db0f5d2c Mon Sep 17 00:00:00 2001
From: Ash Shah <494shah@gmail.com>
Date: Sun, 9 Aug 2026 14:19:27 -0700
Subject: [PATCH 35/41] fix: make sidebar ref actions wait for a repo switch,
 and drop a superseded update
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two findings from Codex review on #29. Both are pre-existing on `next` and in
files this PR does not otherwise touch; fixed here to keep the review on one
branch.

**P1 — sidebar acting on the wrong repository.** A switch deliberately keeps the
previous repo's refs on screen until the reload lands, because clearing them
flashed the sidebar empty mid-switch. But `appState.repo` already points at the
new repo, so a command fired from a stale row runs against it. With a name both
repos have — `main`, `develop` — "Delete branch" deletes the wrong repo's
branch, and there is no reflog prompt in front of that.

Clearing the state would reintroduce the flicker the retention exists to
prevent, so the rows stay and the actions go inert: checkout, delete (also the
Linked Worktrees panel, which routes through the same handler), and the ref
context menu all refuse while `repoLoading`, which `reloadGraph` clears in a
`finally` guarded against a superseding switch. The context menu bails before it
is built, so its items are unreachable rather than merely guarded. Selection and
scrolling stay live — they read nothing and write nothing.

Also gated the detached-HEAD menu, which the report did not mention: "Create
branch here" would use the OLD repo's HEAD sha, and two clones of one project
share commit ids, so that can quietly succeed in the wrong repository instead of
erroring on an unknown sha.

**P2 — superseded automatic update still prompting.** A manual check replaces the
backend's pending-update slot, but the UI queue was only cleared on an exact
version match. A manual check finding nothing, or a different version, left the
old one queued; closing the overlay then presented a version the backend no
longer had — Download failed with "no pending update", or fetched something
other than what the dialog named. The queue is now dropped when a manual check
starts. Two regression tests, both watched failing first.

npm run check 530 files 0 errors; npm test 388 passed; cargo test 232 + 7;
clippy clean.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 src/lib/components/Sidebar.svelte | 22 ++++++++++++++
 src/lib/updater.svelte.ts         |  9 +++++-
 src/lib/updater.test.ts           | 50 +++++++++++++++++++++++++++++++
 3 files changed, 80 insertions(+), 1 deletion(-)

diff --git a/src/lib/components/Sidebar.svelte b/src/lib/components/Sidebar.svelte
index b011052..22b55fe 100644
--- a/src/lib/components/Sidebar.svelte
+++ b/src/lib/components/Sidebar.svelte
@@ -70,7 +70,21 @@
     jumpToRefWithLoad(sha);
   }
 
+  // A repo switch deliberately KEEPS the previous repo's refs on screen until the reload lands —
+  // clearing them flashed the sidebar empty mid-switch. But `appState.repo` already points at the
+  // NEW repo, so a command fired from a row still showing the OLD one runs against the new
+  // repository. With a name both repos have — `main`, `develop` — "Delete branch" then deletes the
+  // wrong repo's branch. Keep the rows visible (that was the point) but refuse anything that
+  // touches the repository until the switch completes. Selection and scrolling stay live: they
+  // read nothing and write nothing.
+  function refActionsBlocked(): boolean {
+    if (!appState.repoLoading) return false;
+    appState.status = "Still opening the repository — try that again in a moment.";
+    return true;
+  }
+
   function onRefCheckout(r: RefEntry, kind: "local" | "remote" | "tag") {
+    if (refActionsBlocked()) return;
     if (kind === "local") {
       gitActions.checkout(r.name);
     } else if (kind === "remote") {
@@ -84,6 +98,7 @@
   }
 
   async function confirmDeleteBranch(name: string) {
+    if (refActionsBlocked()) return;
     const detail = appState.refsDetailed.find((d) => d.kind === "local" && d.name === name);
     const tracking = detail?.upstream ?? null; // "origin/feature" | null (tracking CONFIG)
     // The tracking config outlives the remote branch ("gone" after a remote-side
@@ -114,6 +129,9 @@
 
   function onRefContext(event: MouseEvent, r: RefEntry, kind: "local" | "remote" | "tag") {
     event.preventDefault();
+    // Bail before building the menu, so Checkout / Fast-forward / Delete are not merely
+    // guarded but unreachable while the switch is in flight.
+    if (refActionsBlocked()) return;
     jumpTo(r.sha);
     selectRef(kind, r.name);
     const items: MenuItem[] = [];
@@ -236,6 +254,10 @@
   // (saves any commits made here) or hop back to the default local branch.
   function onDetachedContext(event: MouseEvent) {
     event.preventDefault();
+    // Same staleness, worse failure mode: "Create branch here" would use the OLD repo's HEAD sha.
+    // Two clones of one project share commit ids, so this can quietly succeed in the wrong
+    // repository rather than erroring on an unknown sha.
+    if (refActionsBlocked()) return;
     const sha = refs.head[0]?.sha;
     if (!sha) return;
     const items: MenuItem[] = [
diff --git a/src/lib/updater.svelte.ts b/src/lib/updater.svelte.ts
index 7570031..4faacf2 100644
--- a/src/lib/updater.svelte.ts
+++ b/src/lib/updater.svelte.ts
@@ -115,6 +115,14 @@ async function checkForUpdates(
   const manual = source === "manual";
   let available: UpdateInfo | null = null;
   if (manual) {
+    // A manual check replaces the backend's pending-update slot, so anything an automatic check
+    // queued for later is now superseded — whatever this check finds (or does not find) is the
+    // truth. Keeping the queue meant a prompt could resurface after the overlay closed naming a
+    // version the backend no longer had: Download then failed with "no pending update", or
+    // fetched something other than what the dialog said. Clearing it here covers the
+    // nothing-found and different-version cases that an exact version match missed. The retry
+    // timer needs no cancelling — it re-checks this variable and stops on its own.
+    pendingAutomaticUpdate = null;
     appState.setBusyOp("Checking for updates");
     appState.status = "Checking for updates…";
   }
@@ -130,7 +138,6 @@ async function checkForUpdates(
 
   if (!available) return;
   if (manual) {
-    if (pendingAutomaticUpdate?.version === available.version) pendingAutomaticUpdate = null;
     await presentUpdate(available);
   } else {
     queueAutomaticUpdate(available);
diff --git a/src/lib/updater.test.ts b/src/lib/updater.test.ts
index 74c2882..78ddd5e 100644
--- a/src/lib/updater.test.ts
+++ b/src/lib/updater.test.ts
@@ -133,6 +133,56 @@ describe("automatic updater lifecycle", () => {
     expect(mocks.confirm).toHaveBeenCalledOnce();
   });
 
+  // A manual check replaces the backend's pending-update slot. If the UI keeps the queued
+  // automatic update anyway, closing the overlay later presents a version the backend no longer
+  // has — Download then fails with "no pending update", or fetches something other than what the
+  // dialog named. Only an exact version match used to clear the queue.
+  it("drops a queued automatic update when a manual check finds nothing", async () => {
+    mocks.dialogState.kind = "prompt"; // an overlay is up, so the automatic prompt queues
+    mocks.checkUpdateOnChannel.mockResolvedValue({
+      version: "0.3.0-next.21",
+      currentVersion: "0.3.0-next.20",
+      notes: null,
+    });
+    const updater = await loadUpdater();
+    await updater.startupUpdateCheck();
+    expect(mocks.confirm).not.toHaveBeenCalled();
+
+    // User switches channel in Settings and checks by hand; this time there is nothing.
+    mocks.checkUpdateOnChannel.mockResolvedValue(null);
+    await updater.manualCheckForUpdates();
+
+    mocks.dialogState.kind = "none";
+    await vi.advanceTimersByTimeAsync(1000);
+    expect(mocks.confirm).not.toHaveBeenCalled();
+  });
+
+  it("drops a queued automatic update when a manual check finds a different version", async () => {
+    mocks.dialogState.kind = "prompt";
+    mocks.checkUpdateOnChannel.mockResolvedValue({
+      version: "0.3.0-next.21",
+      currentVersion: "0.3.0-next.20",
+      notes: null,
+    });
+    const updater = await loadUpdater();
+    await updater.startupUpdateCheck();
+    expect(mocks.confirm).not.toHaveBeenCalled();
+
+    mocks.checkUpdateOnChannel.mockResolvedValue({
+      version: "0.4.0",
+      currentVersion: "0.3.0-next.20",
+      notes: null,
+    });
+    await updater.manualCheckForUpdates();
+    // The manual check presents its own find immediately.
+    expect(mocks.confirm).toHaveBeenCalledOnce();
+
+    // Closing the overlay must NOT then present the superseded next.21 as well.
+    mocks.dialogState.kind = "none";
+    await vi.advanceTimersByTimeAsync(1000);
+    expect(mocks.confirm).toHaveBeenCalledOnce();
+  });
+
   it("uses activation as a catch-up check after a throttled timer window", async () => {
     const updater = await loadUpdater();
     await updater.startupUpdateCheck();

From 66682518b761da6431d69cddde62cf5582e3c2ff Mon Sep 17 00:00:00 2001
From: Ash Shah <494shah@gmail.com>
Date: Sun, 9 Aug 2026 14:40:39 -0700
Subject: [PATCH 36/41] fix: reject a parent anywhere below Git metadata, not
 just the Git dir itself
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`is_git_dir` resolves an exact path, so the parent guard saw `repo/.git` and a
bare repo but walked straight past `repo/.git/hooks` and `bare.git/objects` —
which a folder picker reaches just as easily. `--is-inside-work-tree` is false
down there too, so nothing else caught it either, and the flow created a
repository inside another repository's object store. Reproduced: it returned
initialized: true with a path of `host/.git/hooks/proj`.

`--is-inside-git-dir` is documented as true anywhere below the repository
directory, which is the question a candidate parent actually has to answer:

  path                 resolve-git-dir   is-inside-git-dir
  normal (worktree)    false             false
  normal/.git          true              true
  normal/.git/hooks    false             true
  bare.git             true              true
  bare.git/objects     false             true
  plain (no repo)      false             error

The working-tree row is why this stays a separate probe from the nesting one: a
normal working directory must remain a valid parent. The error row is handled
the way `is_inside_worktree` already does — a non-zero exit counts as false.

`is_git_dir` still guards the DESTINATION, where the exact-path question is the
right one. The parent test now covers both tops and both descendants.

cargo test 232 + 7; clippy clean; npm run check 530 files 0 errors;
npm test 388 passed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 crates/git-core/src/git_ops.rs | 33 ++++++++++++++++++++++++++++++---
 1 file changed, 30 insertions(+), 3 deletions(-)

diff --git a/crates/git-core/src/git_ops.rs b/crates/git-core/src/git_ops.rs
index e2a91d8..9980c4c 100644
--- a/crates/git-core/src/git_ops.rs
+++ b/crates/git-core/src/git_ops.rs
@@ -43,6 +43,24 @@ fn is_inside_worktree(path: &Path) -> bool {
 /// so a plain folder that merely sits inside a repository is not mistaken for one; that case
 /// belongs to `is_inside_worktree`. Callers pass an absolute path (`parent` is canonicalized
 /// before the join), so the operand cannot be read as a flag.
+/// Is `path` inside a repository's metadata — the Git directory itself, or anything below it?
+///
+/// `is_git_dir` answers only for the exact directory, so a folder picker landing on
+/// `repo/.git/hooks` or `bare.git/objects` walked straight past it, and `--is-inside-work-tree` is
+/// false down there as well. `--is-inside-git-dir` is documented to be true anywhere below the
+/// repository directory, which is exactly the question a candidate PARENT has to answer.
+/// A path in no repository at all makes git exit non-zero; that counts as false.
+fn is_inside_git_dir(path: &Path) -> bool {
+    Command::new("git")
+        .current_dir(path)
+        .args(["rev-parse", "--is-inside-git-dir"])
+        .output()
+        .ok()
+        .filter(|output| output.status.success())
+        .map(|output| String::from_utf8_lossy(&output.stdout).trim() == "true")
+        .unwrap_or(false)
+}
+
 fn is_git_dir(path: &Path) -> bool {
     Command::new("git")
         .args(["rev-parse", "--resolve-git-dir"])
@@ -69,8 +87,10 @@ pub fn initialize_repository(
     // A Git directory is still a folder, and `--is-inside-work-tree` answers false inside one, so
     // the nesting probe below cannot catch it either — and when the destination does not exist yet
     // that probe falls back to this very path. Picking `some-repo/.git`, or a bare repo, would
-    // therefore create the new repository inside another repository's metadata.
-    if is_git_dir(&parent) {
+    // therefore create the new repository inside another repository's metadata. `is_inside_git_dir`
+    // rather than `is_git_dir` because a picker reaches `.git/hooks` and `bare.git/objects` just as
+    // easily as the top of either, and an exact-path probe does not see those.
+    if is_inside_git_dir(&parent) {
         return Err(
             "The selected parent folder is a Git repository's internal directory. Choose a different folder."
                 .to_string(),
@@ -500,7 +520,14 @@ mod tests {
         bare.current_dir(&outer.0).args(["init", "-q", "--bare", "shipped.git"]);
         run(&mut bare).unwrap();
 
-        for parent in [outer.0.join("host").join(".git"), outer.0.join("shipped.git")] {
+        // The Git directory itself, a bare repo, and — because an exact-path probe misses them —
+        // directories BELOW either one, which a folder picker reaches just as easily.
+        for parent in [
+            outer.0.join("host").join(".git"),
+            outer.0.join("host").join(".git").join("hooks"),
+            outer.0.join("shipped.git"),
+            outer.0.join("shipped.git").join("objects"),
+        ] {
             let err = initialize_repository(&parent, "proj", "main", false)
                 .expect_err(&format!("{} should have been refused", parent.display()));
             assert!(

From f969d77da8e28a04e844b1c051896e9b3e1e0ecb Mon Sep 17 00:00:00 2001
From: Ash Shah <494shah@gmail.com>
Date: Sun, 9 Aug 2026 15:28:37 -0700
Subject: [PATCH 37/41] fix: show the empty state when the selected file leaves
 the working copy
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`resolveSection` returns null once the path is in no list — its last change was
committed or discarded, so the file is no longer part of the working copy. But
`diffKey` tested only `selectedFile`, so it stayed non-empty and the effect
fetched an unstaged diff for a file with nothing to diff. No row could
highlight, since the row test already requires a matching section, while the
pane rendered an empty diff instead of "Select a file to view its diff."

Gate both on `section !== null` rather than clearing the selection: no state
written from a derived or an effect, and it keeps the "follow the file wherever
it went" behaviour the section resolution exists for — if the path comes back,
the selection resumes instead of having been silently dropped.

Reported by Codex review on the v0.4.0 promotion (#30).

Verified by reading plus `npm run check`; there is no WorkingCopyView test
harness, and the path is behind `isTauri()` so the browser preview cannot reach
it either. npm run check 530 files 0 errors; npm test 388 passed;
cargo test 232 + 7.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 src/lib/components/WorkingCopyView.svelte | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/src/lib/components/WorkingCopyView.svelte b/src/lib/components/WorkingCopyView.svelte
index 3113e9a..9ac6c0f 100644
--- a/src/lib/components/WorkingCopyView.svelte
+++ b/src/lib/components/WorkingCopyView.svelte
@@ -104,8 +104,13 @@
   // monotonic revision counter (workingChangesRev) instead of the file count so that
   // a hunk stage/unstage — which doesn't change the file count but does re-index
   // hunks on the backend — also triggers a re-fetch and prevents stale hunk indices.
+  // `section` is null once the path is in NO list — its last change was committed or
+  // discarded, so the file is no longer part of the working copy. Keying on `selectedFile`
+  // alone kept the key non-empty there and fetched an unstaged diff for a file with nothing
+  // to diff: no row could highlight (the row test already requires a matching section), while
+  // the pane showed an empty diff instead of the nothing-selected state.
   const diffKey = $derived(
-    selectedFile !== null
+    selectedFile !== null && section !== null
       ? `${selectedFile}::${section}::${selectedIsUntracked}::${appState.workingChangesRev}::${appState.effectiveDiffContext}`
       : "",
   );
@@ -570,7 +575,9 @@
 
       <!-- ── Diff pane (right column) ─────────────────────────────────────────── -->
       <div class="diff-pane">
-        {#if !selectedFile}
+        <!-- `section === null` means the selected path has left the working copy entirely, so
+             there is nothing to show and no row is highlighted — same state as no selection. -->
+        {#if !selectedFile || section === null}
           <p class="diff-loading">Select a file to view its diff.</p>
         {:else if diffLoading}
           <p class="diff-loading">Loading diff…</p>

From 49cf2396f3cc259fc08dd5b4a3d8358ca6da7be7 Mon Sep 17 00:00:00 2001
From: Ash Shah <494shah@gmail.com>
Date: Sun, 9 Aug 2026 17:03:14 -0700
Subject: [PATCH 38/41] fix: resolve an untracked selection into Unstaged once
 the lists are merged
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Section presence describes lists ON SCREEN, not file states — the rule the
SectionPresence doc already spells out. The component derived the three fields
inline and they disagreed about it: `unstaged` came from the merged display
list, `untracked` came from the raw file state.

So selecting an untracked file and then turning on "Merge Untracked into
Unstaged" reported presence in BOTH. resolveSection kept the recorded
"untracked", the pane resolved to a section with no rows in that mode, nothing
highlighted, and the Unstaged header offered "Stage all" instead of "Stage".

The rule has now been violated once per field, so it moves out of the component
into `renderedPresence` in workingSection.ts, beside the type it builds and the
resolver that consumes it, with the merged case under test.

`untracked` was also answering two different questions through one field. It
now answers only "is the Untracked SECTION showing this row", which is false
while merging. Whether the FILE is untracked — which selects `git diff
--no-index` and disables hunk staging — reads from the file list directly and
is unaffected by the mode, which is what it always needed to be. The Untracked
header that also consults it renders only when NOT merging, so the two readings
coincide there.

Reported by Codex review on the v0.4.0 promotion (#30).

npm run check 530 files 0 errors; npm test 393 passed; cargo test 232 + 7.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 src/lib/components/WorkingCopyView.svelte | 33 +++++++++++-------
 src/lib/workingSection.test.ts            | 42 ++++++++++++++++++++++-
 src/lib/workingSection.ts                 | 32 +++++++++++++++++
 3 files changed, 94 insertions(+), 13 deletions(-)

diff --git a/src/lib/components/WorkingCopyView.svelte b/src/lib/components/WorkingCopyView.svelte
index 9ac6c0f..c76143a 100644
--- a/src/lib/components/WorkingCopyView.svelte
+++ b/src/lib/components/WorkingCopyView.svelte
@@ -8,7 +8,7 @@
   import CommitComposer from "./CommitComposer.svelte";
   import FileTree from "./FileTree.svelte";
   import { buildFileTree } from "../fileTree";
-  import { resolveSection, type WorkingSection } from "../workingSection";
+  import { renderedPresence, resolveSection, type WorkingSection } from "../workingSection";
   import type { WorkingFile } from "../types";
   import { crossfade, fade } from "svelte/transition";
   import { flip } from "svelte/animate";
@@ -62,15 +62,20 @@
 
   // Which RENDERED lists currently hold the selected path — sections are lists on screen,
   // not file states. A partially-staged file is in two of them at once, which is precisely
-  // why the clicked section has to be recorded. Note `unstagedDisplay`, not `unstagedFiles`:
-  // with unifyUnstaged on, untracked rows are rendered in the Unstaged list and report
-  // "unstaged", so presence has to agree or the selection resolves to a section that has
-  // no rows in that mode.
-  const presence = $derived({
-    staged: selectedFile !== null && stagedFiles.some((f) => f.path === selectedFile),
-    unstaged: selectedFile !== null && unstagedDisplay.some((f) => f.path === selectedFile),
-    untracked: selectedFile !== null && untrackedFiles.some((f) => f.path === selectedFile),
-  });
+  // why the clicked section has to be recorded. The merged-list handling lives in
+  // `renderedPresence` rather than here: computing the three fields inline is how they came
+  // to disagree about what "rendered" means.
+  const presence = $derived(
+    renderedPresence(
+      selectedFile,
+      {
+        staged: stagedFiles.map((f) => f.path),
+        unstaged: unstagedFiles.map((f) => f.path),
+        untracked: untrackedFiles.map((f) => f.path),
+      },
+      appState.unifyUnstaged,
+    ),
+  );
 
   // The section the pane actually shows: the one the user clicked, or — if the file has
   // since left it (they staged all of it, say) — wherever it went. See resolveSection().
@@ -87,8 +92,12 @@
   // Untracked files have no index entry, so the regular diff is empty — they need the
   // `git diff --no-index` path (and hunk/line staging doesn't apply to them). This is a
   // property of the FILE, not of the section: with unifyUnstaged on, an untracked file
-  // is rendered in the Unstaged list but still needs --no-index.
-  const selectedIsUntracked = $derived(presence.untracked);
+  // is rendered in the Unstaged list but still needs --no-index. Read from the file list,
+  // NOT from `presence.untracked`, which answers the narrower "is the Untracked section
+  // showing this row" and is false while merging.
+  const selectedIsUntracked = $derived(
+    selectedFile !== null && untrackedFiles.some((f) => f.path === selectedFile),
+  );
 
   // Whether the selected file is displayed in the Unstaged section — including an
   // untracked file that unifyUnstaged has merged into that list, which `presence.unstaged`
diff --git a/src/lib/workingSection.test.ts b/src/lib/workingSection.test.ts
index a8a75f5..f4a2275 100644
--- a/src/lib/workingSection.test.ts
+++ b/src/lib/workingSection.test.ts
@@ -1,5 +1,10 @@
 import { describe, it, expect } from "vitest";
-import { resolveSection, type SectionPresence, type WorkingSection } from "./workingSection";
+import {
+  renderedPresence,
+  resolveSection,
+  type SectionPresence,
+  type WorkingSection,
+} from "./workingSection";
 
 const present = (p: Partial<SectionPresence> = {}): SectionPresence => ({
   staged: false,
@@ -72,3 +77,38 @@ describe("resolveSection", () => {
     }
   });
 });
+
+describe("renderedPresence", () => {
+  const files = { staged: ["s.txt"], unstaged: ["u.txt"], untracked: ["n.txt"] };
+
+  it("reports nothing for no selection", () => {
+    expect(renderedPresence(null, files, false)).toEqual(present());
+  });
+
+  it("maps each file to its own section when the lists are separate", () => {
+    expect(renderedPresence("s.txt", files, false)).toEqual(present({ staged: true }));
+    expect(renderedPresence("u.txt", files, false)).toEqual(present({ unstaged: true }));
+    expect(renderedPresence("n.txt", files, false)).toEqual(present({ untracked: true }));
+  });
+
+  it("sees a partially-staged file in both lists at once", () => {
+    const both = { staged: ["p.txt"], unstaged: ["p.txt"], untracked: [] };
+    expect(renderedPresence("p.txt", both, false)).toEqual(present({ staged: true, unstaged: true }));
+  });
+
+  // The bug: with unifyUnstaged on there IS no Untracked list on screen — those rows are
+  // rendered in Unstaged and report "unstaged". Reporting untracked presence anyway let
+  // resolveSection keep a recorded "untracked" and resolve to a section with no rows, so
+  // nothing highlighted and the Unstaged header offered "Stage all" instead of "Stage".
+  it("moves untracked presence into Unstaged when the lists are merged", () => {
+    expect(renderedPresence("n.txt", files, true)).toEqual(present({ unstaged: true }));
+  });
+
+  it("resolves a recorded untracked selection to Unstaged once merging is enabled", () => {
+    const before = renderedPresence("n.txt", files, false);
+    expect(resolveSection("untracked", before)).toBe("untracked");
+
+    const after = renderedPresence("n.txt", files, true);
+    expect(resolveSection("untracked", after)).toBe("unstaged");
+  });
+});
diff --git a/src/lib/workingSection.ts b/src/lib/workingSection.ts
index 01c009f..142af37 100644
--- a/src/lib/workingSection.ts
+++ b/src/lib/workingSection.ts
@@ -27,6 +27,38 @@ export interface SectionPresence {
   untracked: boolean;
 }
 
+/**
+ * Build a `SectionPresence` from the working-copy file lists.
+ *
+ * The rule above — presence describes lists ON SCREEN, not file states — is easy to state and
+ * easy to get wrong: it has been violated once per field. Deriving it inline in the component
+ * meant `unstaged` was computed from the merged display list while `untracked` was computed
+ * from the raw file state, so with merging on a path reported presence in BOTH, `resolveSection`
+ * kept the recorded `"untracked"`, and the pane resolved to a section with no rows — nothing
+ * highlighted and the Unstaged header offered "Stage all" instead of "Stage". Encoding it here
+ * keeps the two fields from drifting apart again, and makes the merged case testable.
+ *
+ * `untracked` is asked twice for different reasons; do not conflate them. This answers "is the
+ * Untracked SECTION showing this row", which is false while merging. Whether the FILE is
+ * untracked — which decides `git diff --no-index` and disables hunk staging — is a separate
+ * question the caller must answer from the file list regardless of mode.
+ */
+export function renderedPresence(
+  path: string | null,
+  files: { staged: string[]; unstaged: string[]; untracked: string[] },
+  unifyUnstaged: boolean,
+): SectionPresence {
+  if (path === null) return { staged: false, unstaged: false, untracked: false };
+  const holds = (list: string[]) => list.includes(path);
+  return {
+    staged: holds(files.staged),
+    // With merging on, the Unstaged list renders the untracked rows too.
+    unstaged: holds(files.unstaged) || (unifyUnstaged && holds(files.untracked)),
+    // ...and the Untracked section is not rendered at all.
+    untracked: !unifyUnstaged && holds(files.untracked),
+  };
+}
+
 /**
  * The section the diff pane should actually show for the selected file.
  *

From 3d8f4094e0dbe8fc9e9fa9c20706e2761b6710e1 Mon Sep 17 00:00:00 2001
From: Ash Shah <494shah@gmail.com>
Date: Sun, 9 Aug 2026 17:12:28 -0700
Subject: [PATCH 39/41] fix: re-check the repository after a ref dialog, not
 only before it
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`refActionsBlocked()` covers the instant of the click. Every ref action that
asks first then waits on a prompt with no timeout, and `gitActions` targets
`appState.repo` — not whatever was on screen when the dialog opened. Switch
repositories mid-prompt and confirming runs the OLD repo's branch or tag name
against the NEW repository; where both hold that name, "Delete" force-deletes
the wrong one. The same time-of-check/time-of-use shape as the stale-diff guard
on discard, which is the precedent for fixing it the same way.

Codex flagged branch delete. Six more sites have the identical gap, three of
them destructive, so all seven are guarded rather than the one reported:

  confirmBranchDelete -> deleteBranch          (reported)
  prompt              -> renameBranch
  prompt              -> createTag
  prompt              -> createBranch (from ref)
  confirm             -> deleteRemoteBranch
  confirm             -> deleteTag
  prompt              -> createBranch (detached HEAD)

`sameRepoAfterPrompt()` captures the repo before the await and returns a
predicate checked after it, so each call site keeps its own control flow
instead of being wrapped in a callback. Refusing states plainly that nothing
was done, rather than failing silently or acting on a guess.

Reported by Codex review on #32.

npm run check 530 files 0 errors; npm test 393 passed; cargo test 232 + 7.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 src/lib/components/Sidebar.svelte | 38 +++++++++++++++++++++++++------
 1 file changed, 31 insertions(+), 7 deletions(-)

diff --git a/src/lib/components/Sidebar.svelte b/src/lib/components/Sidebar.svelte
index 22b55fe..7890d9e 100644
--- a/src/lib/components/Sidebar.svelte
+++ b/src/lib/components/Sidebar.svelte
@@ -83,6 +83,23 @@
     return true;
   }
 
+  // `refActionsBlocked()` only covers the instant of the click. Every ref action that asks
+  // first then waits on a prompt with no timeout, during which the repository can change —
+  // and `gitActions` targets `appState.repo`, not whatever was on screen when the dialog
+  // opened. Confirming afterwards would run the OLD repo's branch or tag name against the
+  // NEW repository; where both hold that name, "Delete" force-deletes the wrong one.
+  //
+  // Capture the repo before the await and re-check after it. Returns a predicate rather than
+  // taking a callback so each call site keeps its own control flow readable.
+  function sameRepoAfterPrompt(): () => boolean {
+    const opened = appState.repo;
+    return () => {
+      if (appState.repo === opened) return true;
+      appState.status = "Repository changed while that dialog was open — nothing was done.";
+      return false;
+    };
+  }
+
   function onRefCheckout(r: RefEntry, kind: "local" | "remote" | "tag") {
     if (refActionsBlocked()) return;
     if (kind === "local") {
@@ -108,8 +125,9 @@
     const upstream = remoteExists ? tracking : null;
     const remoteGone = tracking !== null && !remoteExists;
     const worktree = worktreeFor(name) ?? null;
+    const sameRepo = sameRepoAfterPrompt();
     const res = await dialogs.confirmBranchDelete({ branch: name, upstream, remoteGone, worktree });
-    if (!res.confirmed) return;
+    if (!res.confirmed || !sameRepo()) return;
     let remote: string | undefined;
     let remoteBranch: string | undefined;
     if (res.deleteRemote && upstream) {
@@ -175,15 +193,17 @@
       items.push({
         label: "Rename…",
         action: async () => {
+          const sameRepo = sameRepoAfterPrompt();
           const n = await dialogs.prompt({ title: "Rename branch", label: "New name", value: r.name });
-          if (n && n !== r.name) gitActions.renameBranch(r.name, n);
+          if (n && n !== r.name && sameRepo()) gitActions.renameBranch(r.name, n);
         },
       });
       items.push({
         label: "Create tag here…",
         action: async () => {
+          const sameRepo = sameRepoAfterPrompt();
           const n = await dialogs.prompt({ title: "New tag", label: "Tag name", placeholder: "v1.0.0" });
-          if (n) gitActions.createTag(n, r.sha);
+          if (n && sameRepo()) gitActions.createTag(n, r.sha);
         },
       });
       items.push({ separator: true });
@@ -193,8 +213,9 @@
       items.push({
         label: "Create local branch…",
         action: async () => {
+          const sameRepo = sameRepoAfterPrompt();
           const n = await dialogs.prompt({ title: `New branch from ${r.name}`, label: "Branch name" });
-          if (n) gitActions.createBranch(n, r.sha);
+          if (n && sameRepo()) gitActions.createBranch(n, r.sha);
         },
       });
       items.push({ separator: true });
@@ -205,13 +226,14 @@
           const slash = r.name.indexOf("/");
           const remote = r.name.slice(0, slash);
           const branch = r.name.slice(slash + 1);
+          const sameRepo = sameRepoAfterPrompt();
           const ok = await dialogs.confirm({
             title: "Delete remote branch",
             message: `Delete "${r.name}" on the remote? This removes it for everyone with access to ${remote}.`,
             confirmLabel: "Delete",
             danger: true,
           });
-          if (ok) gitActions.deleteRemoteBranch(remote, branch);
+          if (ok && sameRepo()) gitActions.deleteRemoteBranch(remote, branch);
         },
       });
     } else {
@@ -221,13 +243,14 @@
         label: "Delete tag",
         danger: true,
         action: async () => {
+          const sameRepo = sameRepoAfterPrompt();
           const ok = await dialogs.confirm({
             title: "Delete tag",
             message: `Delete tag "${r.name}"?`,
             confirmLabel: "Delete",
             danger: true,
           });
-          if (ok) gitActions.deleteTag(r.name);
+          if (ok && sameRepo()) gitActions.deleteTag(r.name);
         },
       });
     }
@@ -264,8 +287,9 @@
       {
         label: "Create branch here…",
         action: async () => {
+          const sameRepo = sameRepoAfterPrompt();
           const n = await dialogs.prompt({ title: `New branch at ${sha.slice(0, 7)}`, label: "Branch name" });
-          if (n) gitActions.createBranch(n, sha).then((ok) => { if (ok) gitActions.checkout(n); });
+          if (n && sameRepo()) gitActions.createBranch(n, sha).then((ok) => { if (ok) gitActions.checkout(n); });
         },
       },
     ];

From 2709753fbf3140dd6468f982b2c463b71eb79802 Mon Sep 17 00:00:00 2001
From: Ash Shah <494shah@gmail.com>
Date: Sun, 9 Aug 2026 17:42:16 -0700
Subject: [PATCH 40/41] fix: bind a confirmed action to the repository it was
 confirmed against
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Every confirmation in gitActions is awaited with no timeout, and the work that
follows reads `appState.repo` when it RUNS, not when the dialog opened. Switch
repositories mid-prompt and the confirmed action lands on the new one.

The discard snapshot guard does not cover this: `expected_diff` pins the DIFF,
not the repository. Two clones or worktrees holding the same path with the same
diff pass the check, and the wrong copy is irreversibly discarded.

Codex flagged discardHunk and discardLines. The same gap is in every awaited
dialog in the file, so all nine are bound rather than the two reported:

  runDestructive           every caller (reset, rebase, amend, reword, ...)
  runDestructiveRebase     ditto
  discardHunk              reported
  discardLines             reported
  discard (files)          destructive
  clean (untracked)        destructive
  force push --force-with-lease
  create pull request
  runRemote credential retry — `fn` re-reads the repo, so a switch during the
    sign-in prompt would push to a remote the user never chose

Refusing rather than retargeting is deliberate: the user authorised an action
against what they were looking at, and silently applying it elsewhere is a
different action. This is the third appearance of the shape — guard, unbounded
await, act — after the diff snapshot and the sidebar ref actions, so the audit
covered the whole file rather than the reported sites.

Reported by Codex review on the v0.4.0 promotion (#30).

npm run check 530 files 0 errors; npm test 393 passed; cargo test 232 + 7.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 src/lib/gitActions.ts | 53 +++++++++++++++++++++++++++++++++++--------
 1 file changed, 43 insertions(+), 10 deletions(-)

diff --git a/src/lib/gitActions.ts b/src/lib/gitActions.ts
index a9aa500..2e0374a 100644
--- a/src/lib/gitActions.ts
+++ b/src/lib/gitActions.ts
@@ -544,6 +544,28 @@ function discarded(ok: boolean): boolean {
   return ok;
 }
 
+/**
+ * Bind an action to the repository the user actually confirmed it against.
+ *
+ * Every confirmation here is awaited with no timeout, and the work that follows reads
+ * `appState.repo` when it runs — not when the dialog opened. Switch repositories mid-prompt and
+ * the confirmed action lands on the new one. The discard guards do not save us: `expected_diff`
+ * pins the DIFF, not the repository, so two clones or worktrees holding the same path with the
+ * same diff pass that check and the wrong copy is irreversibly discarded.
+ *
+ * Capture before the await, verify after it, refuse if it moved. Refusing rather than retargeting
+ * is deliberate: the user authorised an action against what they were looking at, and silently
+ * applying it somewhere else is not the same action.
+ */
+function sameRepoAfterPrompt(): () => boolean {
+  const opened = appState.repo;
+  return () => {
+    if (appState.repo === opened) return true;
+    appState.status = "Repository changed while that dialog was open — nothing was done.";
+    return false;
+  };
+}
+
 // Run a working-copy op (non-destructive): guard → run → refresh working changes + graph.
 async function runWorktree(label: string, fn: () => Promise<unknown>): Promise<boolean> {
   if (!isTauri()) {
@@ -588,13 +610,14 @@ async function runDestructive(
     appState.status = "Open a repository first.";
     return false;
   }
+  const sameRepo = sameRepoAfterPrompt();
   const { confirmed, backup } = await dialogs.confirmDestructive({
     title: label,
     consequence,
     confirmLabel: label,
     backupDefault: appState.autoBackupDestructive,
   });
-  if (!confirmed) return false;
+  if (!confirmed || !sameRepo()) return false;
   try {
     appState.status = `${label}…`;
     const res = await fn(backup);
@@ -630,13 +653,14 @@ async function runDestructiveRebase(
     appState.status = "Open a repository first.";
     return false;
   }
+  const sameRepo = sameRepoAfterPrompt();
   const { confirmed, backup } = await dialogs.confirmDestructive({
     title: label,
     consequence,
     confirmLabel: label,
     backupDefault: appState.autoBackupDestructive,
   });
-  if (!confirmed) return false;
+  if (!confirmed || !sameRepo()) return false;
   try {
     appState.status = `${label}…`;
     const res = await fn(backup);
@@ -687,9 +711,12 @@ async function runRemote(
     let outcome = await fn((l) => appState.pushRemoteLog(l));
 
     if (outcome.authFailed) {
-      // Auth failed — prompt for credentials and retry once.
+      // Auth failed — prompt for credentials and retry once. `fn` reads `appState.repo` when
+      // invoked, so a switch during the prompt would retry against the NEW repository with the
+      // credentials just entered — pushing to a remote the user never chose.
+      const sameRepo = sameRepoAfterPrompt();
       const creds = await dialogs.confirmCredentials({ title: `${label}: sign in` });
-      if (creds) {
+      if (creds && sameRepo()) {
         outcome = await fn((l) => appState.pushRemoteLog(l), creds);
       }
       // If user cancelled the credentials dialog, fall through with the original outcome.
@@ -922,13 +949,14 @@ export const gitActions = {
     // spanning the entire file, so a hunk discard can revert every unstaged change in
     // it — a boundary the user cannot see from the dialog.
     const n = changedLines;
+    const sameRepo = sameRepoAfterPrompt();
     const confirmed = await dialogs.confirm({
       title: "Discard hunk",
       message: discardMessage(n, "changed line", path, revertsToIndex),
       confirmLabel: "Discard",
       danger: true,
     });
-    if (!confirmed) return false;
+    if (!confirmed || !sameRepo()) return false;
     return discarded(
       await runWorktree(`Discard hunk in ${path}`, () =>
         api.discardHunk(appState.repo, path, hunkIndex, expectedDiff, appState.effectiveDiffContext),
@@ -951,13 +979,14 @@ export const gitActions = {
       return false;
     }
     const n = selected.length;
+    const sameRepo = sameRepoAfterPrompt();
     const confirmed = await dialogs.confirm({
       title: "Discard lines",
       message: discardMessage(n, "line", path, revertsToIndex),
       confirmLabel: "Discard",
       danger: true,
     });
-    if (!confirmed) return false;
+    if (!confirmed || !sameRepo()) return false;
     return discarded(
       await runWorktree(`Discard ${n} line(s) in ${path}`, () =>
         api.discardLines(
@@ -1040,13 +1069,14 @@ export const gitActions = {
       return false;
     }
     const n = paths.length;
+    const sameRepo = sameRepoAfterPrompt();
     const confirmed = await dialogs.confirm({
       title: "Discard changes",
       message: `Permanently discard changes to ${n} file${n === 1 ? "" : "s"}. This cannot be undone. (Stash instead to keep them.)`,
       confirmLabel: "Discard",
       danger: true,
     });
-    if (!confirmed) return false;
+    if (!confirmed || !sameRepo()) return false;
     return runWorktree(`Discard ${n} file(s)`, () => api.discard(appState.repo, paths));
   },
 
@@ -1060,13 +1090,14 @@ export const gitActions = {
       return false;
     }
     const n = paths.length;
+    const sameRepo = sameRepoAfterPrompt();
     const confirmed = await dialogs.confirm({
       title: "Remove untracked files",
       message: `Permanently discard changes to ${n} file${n === 1 ? "" : "s"}. This cannot be undone. (Stash instead to keep them.)`,
       confirmLabel: "Discard",
       danger: true,
     });
-    if (!confirmed) return false;
+    if (!confirmed || !sameRepo()) return false;
     return runWorktree(`Clean ${n} file(s)`, () => api.clean(appState.repo, paths));
   },
 
@@ -1134,6 +1165,7 @@ export const gitActions = {
       return false;
     }
     if (forceWithLease) {
+      const sameRepo = sameRepoAfterPrompt();
       const ok = await dialogs.confirm({
         title: "Force push",
         message:
@@ -1141,7 +1173,7 @@ export const gitActions = {
         confirmLabel: "Force push",
         danger: true,
       });
-      if (!ok) return false;
+      if (!ok || !sameRepo()) return false;
     }
 
     // Determine the current branch + whether it already has an upstream tracking ref.
@@ -1225,8 +1257,9 @@ export const gitActions = {
       .branchSubjects(appState.repo, bases[0], 20)
       .catch(() => [] as string[]);
     const prefill = prefillFromSubjects(subjects, branch);
+    const sameRepo = sameRepoAfterPrompt();
     const v = await dialogs.openCreatePr(branch, bases, prefill.title, prefill.body);
-    if (!v) return;
+    if (!v || !sameRepo()) return;
     await run("Create pull request", async () => {
       const number = await api.githubPrCreate(appState.repo, v.title, v.body, v.base, v.draft);
       // The auto-push may have just created the branch's upstream.

From f2fee34c48219f25e9e6e1fc898797d763f8c11a Mon Sep 17 00:00:00 2001
From: Ash Shah <494shah@gmail.com>
Date: Sun, 9 Aug 2026 17:59:30 -0700
Subject: [PATCH 41/41] fix: capture the repository before the first await, not
 before the dialog
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two P1s on the previous commit, both the same mistake: the capture has to sit
at the point the user's intent is fixed, and I put it immediately before the
prompt instead. Where an earlier await exists in the same flow, a switch during
THAT await is recorded as the "original" repo and the guard waves the action
through.

- `runRemote` awaits the first push/pull attempt before any credentials prompt.
  Captured before that attempt, so an auth failure arriving after a switch can
  no longer authorise a retry against the new repository — which would have
  pushed to a remote the user never chose, with the credentials just entered.
- `createPullRequest` awaits `branchSubjects` before opening the dialog, while
  `branch` and `bases` were read from the repo BEFORE it. Captured before that
  lookup, so the guard compares against the repo those selections came from.

The audit script had the same blind spot as the code: it checked for a capture
near the dialog rather than ahead of every await in the flow. Rewritten to walk
back to the enclosing function and reject a capture with any earlier await —
and to strip comments and string bodies first, because its own first version
flagged the word "await" inside the comments added here.

Both invariants now hold: 9 captures, none preceded by a real earlier await;
9 awaited dialogs, all with a guarded use.

npm run check 530 files 0 errors; npm test 393 passed; cargo test 232 + 7.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 src/lib/gitActions.ts | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/src/lib/gitActions.ts b/src/lib/gitActions.ts
index 2e0374a..90bbc96 100644
--- a/src/lib/gitActions.ts
+++ b/src/lib/gitActions.ts
@@ -705,6 +705,10 @@ async function runRemote(
     appState.status = "Open a repository first.";
     return false;
   }
+  // Capture before the FIRST attempt, not before the credentials prompt: a switch during
+  // that first await would otherwise be recorded as the "original" repo and the guard would
+  // wave the retry through.
+  const sameRepo = sameRepoAfterPrompt();
   appState.startRemoteProgress(label);
   try {
     // First attempt: no credentials (system helper / SSH agent / keychain).
@@ -712,9 +716,8 @@ async function runRemote(
 
     if (outcome.authFailed) {
       // Auth failed — prompt for credentials and retry once. `fn` reads `appState.repo` when
-      // invoked, so a switch during the prompt would retry against the NEW repository with the
-      // credentials just entered — pushing to a remote the user never chose.
-      const sameRepo = sameRepoAfterPrompt();
+      // invoked, so a switch anywhere in this flow would retry against the NEW repository with
+      // the credentials just entered — pushing to a remote the user never chose.
       const creds = await dialogs.confirmCredentials({ title: `${label}: sign in` });
       if (creds && sameRepo()) {
         outcome = await fn((l) => appState.pushRemoteLog(l), creds);
@@ -1252,12 +1255,15 @@ export const gitActions = {
         (n): n is string => !!n && others.includes(n),
       ) ?? null;
     const bases = preferred ? [preferred, ...others.filter((n) => n !== preferred)] : others;
+    // Capture before the first await: `branch` and `bases` were read from the CURRENT repo
+    // above, and a switch during the subjects lookup would otherwise be recorded as the
+    // original — creating a PR in the new repo from the old one's selections.
+    const sameRepo = sameRepoAfterPrompt();
     // Best-effort prefill from the commit subjects on base..HEAD.
     const subjects = await api
       .branchSubjects(appState.repo, bases[0], 20)
       .catch(() => [] as string[]);
     const prefill = prefillFromSubjects(subjects, branch);
-    const sameRepo = sameRepoAfterPrompt();
     const v = await dialogs.openCreatePr(branch, bases, prefill.title, prefill.body);
     if (!v || !sameRepo()) return;
     await run("Create pull request", async () => {