[witbrock]

Merge decision: ready — blob-backed file concepts can open a readable Markdown preview in a closable Von tab or a separate browser tab.

User outcome

File concept headers now offer Preview in Von and Preview in browser tab, alongside the existing download action. Both destinations use the same authorised preview route, with an original-file download link.

Material changes

• Reuse the download route's actor resolution and canonical file-byte access checks.
• Render UTF-8 Markdown using the existing sanitiser. A document CSP and sandbox prevent uploaded content from executing scripts, loading embedded resources or submitting forms.
• Reuse dynamic tab insertion/navigation; reopening a preview activates it, and closing returns to the preceding tab. Previews are removed on authentication changes.
• Explain unavailable files, unsupported formats, invalid encoding and the 2 MiB synchronous-preview limit; downloads remain available.

Evidence

• 15 backend tests: rendering, original-byte round trip, denied/unauthenticated access, sanitisation, unsupported/oversized/invalid/empty inputs and existing upload/download/delete behaviour.
• 50 frontend tests across file actions, tab ID collisions and content sizing.
• Changed-file ESLint: no errors (15 existing warnings); Python 3.11 grammar check passed.
• Playwright at localhost:5097, using candidate frontend modules/CSS and real Flask preview/download routes with synthetic authenticated session and in-memory storage: both destinations, desktop/mobile, close/return, three Markdown tables, no page errors or page-width overflow. Download matched the supplied source SHA-256 aeef69cc7bf598a9fcb2549d26a41ca958aa6af3b745a112826cda633ef04996. Evidence retained in the worker's .run/file-preview/; private source contents/screenshots are not published.

Ship boundary

Minimum criteria are readable Markdown in both destinations with preserved download/access behaviour. Script execution, leaked denied-file contents or broken preview navigation would stop shipment; none was observed in the bounded checks.

The browser evidence uses a local fixture, not production data access or public OAuth. Other formats, linked bundle asset resolution, persistent preview tabs and public deployment are outside this delivery. No database/schema or infrastructure changes.