diff --git a/CHANGELOG b/CHANGELOG
index c707658..3e006d4 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -3,6 +3,14 @@
 We'll document all notable changes in this file, including bug fixes, enhancements, and dependency updates.
 Dates should be in`YYYY-MM-DD` format and versions are in [semantic versioning](http://semver.org/) format.
 
+## v0.10.4 2026-10-05
+
+### Fixed
+
+- Process pages no longer show "Internal Error" to people who aren't logged in.
+- Process pages now list the changes suggested for that process.
+- People outside an organization no longer see edit controls on its processes.
+
 ## v0.10.3 2026-10-03
 
 ### Fixed
diff --git a/package-lock.json b/package-lock.json
index 67e0994..6aff18a 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
 	"name": "adminima",
-	"version": "0.10.3",
+	"version": "0.10.4",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "adminima",
-			"version": "0.10.3",
+			"version": "0.10.4",
 			"dependencies": {
 				"@supabase/ssr": "^0",
 				"@sveltejs/adapter-vercel": "^7",
diff --git a/package.json b/package.json
index 82f0858..5b057b1 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "adminima",
-	"version": "0.10.3",
+	"version": "0.10.4",
 	"private": true,
 	"scripts": {
 		"dev": "vite dev",
diff --git a/src/lib/Oops.svelte b/src/lib/Oops.svelte
index bf44279..c783d0e 100644
--- a/src/lib/Oops.svelte
+++ b/src/lib/Oops.svelte
@@ -8,13 +8,14 @@
 	let { text = undefined, inline = false, children }: Props = $props();
 </script>
 
-<div class:inline>
+<!-- A span when inline, since a div inside a paragraph is invalid HTML and breaks hydration. -->
+<svelte:element this={inline ? 'span' : 'div'} class="oops" class:inline>
 	{#if text}<span>{typeof text === 'string' ? text : 'Error'}</span>{/if}
 	<span class="sub">{@render children?.()}</span>
-</div>
+</svelte:element>
 
 <style>
-	div {
+	.oops {
 		display: flex;
 		flex-direction: column;
 		background: var(--error);
diff --git a/src/lib/ReferenceView.svelte b/src/lib/ReferenceView.svelte
index 6f9f3f0..e818c7b 100644
--- a/src/lib/ReferenceView.svelte
+++ b/src/lib/ReferenceView.svelte
@@ -23,6 +23,9 @@
 	<RoleLink {role} />
 {:else if process}
 	<ProcessLink {process} />
+{:else if !context().member}
+	<!-- Non-members may not be able to see the org's roles, so just show the text the author wrote. -->
+	{segment.text}
 {:else}
 	<!-- Say so, rather than rendering a link that silently goes nowhere. -->
 	<Oops inline text="Unknown role or process: {segment.target}" />
diff --git a/src/routes/org/[orgid]/process/[processid]/+page.svelte b/src/routes/org/[orgid]/process/[processid]/+page.svelte
index 460f90b..a9ea82b 100644
--- a/src/routes/org/[orgid]/process/[processid]/+page.svelte
+++ b/src/routes/org/[orgid]/process/[processid]/+page.svelte
@@ -67,10 +67,12 @@
 
 	// This mirrors the row-level security policy: only admins and people with an accountable or responsible role can edit this policy.
 	let isAdmin = $derived(orgContext().admin);
+	let isMember = $derived(orgContext().member);
 	let accountable = $derived(
 		$user !== null &&
 			process !== null &&
-			(process.accountable === null || personRoles.includes(process.accountable))
+			// If no one is accountable, anyone in the org can edit it, not anyone logged in.
+			(process.accountable === null ? isMember : personRoles.includes(process.accountable))
 	);
 	let responsible = $derived(
 		$user !== null &&
diff --git a/src/routes/org/[orgid]/process/[processid]/+page.ts b/src/routes/org/[orgid]/process/[processid]/+page.ts
index 89b37d7..b41fd24 100644
--- a/src/routes/org/[orgid]/process/[processid]/+page.ts
+++ b/src/routes/org/[orgid]/process/[processid]/+page.ts
@@ -22,7 +22,7 @@ export async function load({ parent, params }) {
 	] = await Promise.all([
 		Organization.queryProcessHows(supabase, process.id),
 		Organization.queryRoles(supabase, org.id),
-		Organization.queryProcessChanges(supabase, org.id),
+		Organization.queryProcessChanges(supabase, process.id),
 		Organization.queryConcerns(supabase, org.id),
 		Organization.queryPersonRoles(supabase, org.id, uid),
 		Organization.queryProfiles(supabase, org.id)