Backlog: H6 done eaa9bd54bdf2

- [x] H3 Theme switch (dark, light, auto) in the header and under Settings, remembered in the cookie; check every page in light mode.

- [x] H4 Profile and organisation pages: generated identicon avatar, display name, bio, linked keys, repositories, recent activity, organisation members and teams.

- [x] H5 Diff view: split (side by side) toggle remembered per user, collapse per file, hide whitespace changes, intra-line word highlighting.

- [ ] H7 Stars and watch counts, explore sorting (activity, stars, name) and filtering, repository topics.

- [ ] H8 Proposal and issue lists: filters (author, label, target, assignee), sort orders, pagination, counts in tabs.

- [ ] H9 File view: file tree sidebar, `y` for a permalink to the state, line range copy, blame age shading and "blame the state before this change".

- 2026-09-28 O5 done. **Real bug fixed**: concurrent commands overwrote `.oxy/ops/head`, so the loser's operation (and its commit on the bookmark) vanished; a two-workspace test lost about half its commits every run. The head now moves by compare-and-swap under a short `.oxy/ops/lock`, and a mover that lost the race records a merge op (two parents, three-way merged view; bookmarks keep both sides' heads), as spec §12.1 described; undo refuses on a moved head. Tests: concurrent two-workspace commits with pushes lose nothing (5/5 runs), deterministic merge of two ops from one parent; two real oxy processes x 25 commits keep all 50 (39 merges). Spec §12.1 updated. Hub redeployed.

- 2026-09-28 H5 done: word-level marks within paired changed lines, `?w=1` hides whitespace-only changes (change, compare, proposal files), collapsible files (over 400 rows start closed), unified/split toggle remembered in a `diff` cookie, collapse/expand all. Tests: two renderer unit tests and `diffs_mark_words_hide_whitespace_and_collapse`; split view checked by screenshot; hub spec §6.8.1; deployed.

- 2026-09-28 O6 done: `oxy doctor [--offline] [--json]` (op log and stale locks, identity object/secret/expiry, author defaults, each remote: plain HTTP, token, CA file, reachability and repository id) with a next step per problem; every failed remote request now carries a hint (untrusted certificate, 401, 403, 404, refused, DNS, timeout) and transport errors no longer repeat the URL; clearer messages for different-repository remotes, pull-first pushes (still contains "pull first", which oxygen-vscode matches), unauthorized keys, and no repository. Tests: hint table and doctor scenarios. Clean on oxygen and oxygenhub checkouts. Spec §21.2, guide. Hub redeployed.