(touched): open every clicked file in Touched, with markdown formatted by default

[jbr-sekoia]

Request

1. A markdown file opened from Touched can be read formatted, not only as source.
2. Markdown opens formatted by default, whether the file is opened from a click in the terminal or from Touched.
3. One feature instead of two: clicking a file opens the Touched panel with that file selected and open in it.

Current state (375decb)

• A click on a path in the terminal goes through openFileInPanel (public/file-panel.js:913). A file changed in git opens in the Changes editor; any other file opens in a 'file' tab rendered by the panel's ViewerPanel, which has a preview for markdown but starts in source (no storageKey).
• A click on a Touched row goes through openTouchedFile (public/touched-files-view.js:264) to openTouchedEditor (public/file-panel.js:1245), which builds a Changes-type tab. It has no markdown preview.
• The same gesture, opening a file, is served by two editors, and the preview exists in one of them only.

Decisions taken

• A click on a local session's file opens Touched with the file selected and its content in the Touched editor. The 'file' tab type and the panel's ViewerPanel go, once what depends on them (held dirty tabs, unsaved-edits check on quit, the CLI's open-file route, path:line) has moved. The Memory and .work-files viewers keep their own ViewerPanel.
• A clicked file that the file tools did not touch is added to the top of the list, marked as opened rather than touched, under the same guards as today's click route.
• Markdown gets a formatted mode in that editor, on by default, with the user's choice remembered. A path:line click opens the source at that line.
• Remote sessions are unchanged: path links are already refused there, and Touched is local only.

The specification, with acceptance criteria, follows in a comment once it has been reviewed.

[jbr-sekoia]

Spec: open every clicked file in Touched, markdown formatted by default (#472)

• Repository: /home/jean-baptiste-renard/workspace/tools/switchboard (fork devsuitup/switchboard), branch main — VERIFIED
• HEAD: 375decbf8c14543b7f8ee7783da85618116cc7de — VERIFIED (git rev-parse HEAD)
• Read at: 2026-10-05T10:18:15+02:00; revised for review 1 at 2026-10-05T10:43:45+02:00, same HEAD — VERIFIED (date -Iseconds, git rev-parse HEAD)
• Ticket: issue (touched): open every clicked file in Touched, with markdown formatted by default #472, body read with gh issue view 472; the brief's "already established" list is treated as claims too — VERIFIED
• Baseline: node --test over the 9 files most concerned (touched, file-tab, goto-line, unsaved-guard, path-links-wiring, touched-wiring, context-menu, mcp-open-file, touched-editor-ipc): tests 213, pass 211, fail 0, skipped 2 — VERIFIED
• Lint baseline, npx eslint public/file-panel.js public/touched-files-view.js public/viewer-toolbar.js: 0 errors, 11 warnings — VERIFIED

1. Claims measured at HEAD

#	Claim (source)	Status	Evidence
C1	A terminal path click goes through openFileInPanel (brief, issue)	STILL PRESENT	public/file-panel.js:913-921 — VERIFIED
C2	A file changed in git opens in the Changes editor	STILL PRESENT	file-panel.js:915-916 → locateChangesRow :923-933 (IPC git-changes-locate, main.js:1928-1937) → openChangesTabAt :935-940 — VERIFIED
C3	Any other file opens in a 'file' tab rendered by fpViewerPanel, language:'auto', no storageKey, so preview starts off; a preview button exists for markdown	STILL PRESENT	file-panel.js:159-164 (constructor, no storageKey), :1070-1079 (render); viewer-panel.js:67 (previewMode false without storageKey), :84 (preview: true), :330 (button shown for markdown) — VERIFIED
C3a	(implied) ViewerPanel's markdown test covers .md and .markdown	REFUTED	viewer-panel.js:658-662: md and mdx only; .markdown is not detected — VERIFIED
C4	Other callers: terminal-context-menu.js:69, terminal-manager.js:988/1023/1032	STILL PRESENT	the four lines read; 988 and 1023 are file:// routes (OSC 8 linkHandler, WebLinksAddon), 1032 the path-link provider, 69 the menu's "Open in panel" — VERIFIED
C5	A Touched row click → openTouchedFile → readFileForPanel(path, {editor:true}) → openTouchedEditor, a Changes-type tab with returnList = the Touched tab	STILL PRESENT	touched-files-view.js:264-292, :274; file-panel.js:1245-1264 — VERIFIED
C6	The Touched editor has no markdown preview	STILL PRESENT	grep -c "marked|markdown" public/file-panel.js → 0; renderChangesDiff :1896-1930 — VERIFIED
C7	MCP / IDE-emulation openFile enters the panel as a 'file' tab	STILL PRESENT	mcp-bridge.js:233-259 sends mcp-open-file with content read by fs.readFileSync; preload.js:183-184; file-panel.js:499-501 → openFileTab — VERIFIED
C8	The Memory and .work-files viewers keep their own ViewerPanel	STILL PRESENT	app.js:31, app.js:38; a third instance exists at activity-trace-panel.js:24 (viewer-panel.md:3 says "2 callsites") — VERIFIED
C9	Remote: "path links are already refused there"	STILL PRESENT for path links; REFUTED for file:// links and the context menu	path links: terminal-path-target.js:98-100 answers remote. file:// and "Open in panel": terminal-manager.js:986-988, :1021-1023, terminal-context-menu.js:68-69 call openFileInPanel with no remote check; git-changes-locate refuses the remote target (main.js:1930, requireLocalTarget), then read-file-for-panel (main.js:983-1010) reads the local disk at that path, with no session involved — VERIFIED by reading; not driven live — ASSUMED for the end-to-end effect
C10	Touched is local only	STILL PRESENT	session-touched-files.js:305 returns reason: 'remote' — VERIFIED
C11	docs/touched-files.md:45: "A row opens in the same file viewer as a path link"	REFUTED	a row opens the Changes-type editor (C5), an unchanged-file path link opens ViewerPanel (C3) — VERIFIED
C12	docs/ide-emulation.md:65-68: "The panel refuses credential paths and files over 2 MB" for files Claude opens	REFUTED for MCP openFile	mcp-bridge.js:240-245 reads with no sensitive-path or size check; openFileTab shows data.content (file-panel.js:611) without readFileForPanel — VERIFIED
C13	viewer-panel.md:59 places a sanitize sink at viewer-panel.js:397	REFUTED (stale line)	the sinks are viewer-panel.js:654, viewer-toolbar.js:47, jsonl-viewer.js:61 (grep -n DOMPurify.sanitize public/*.js) — VERIFIED
C14	openFileTab supports a Touched returnList	GONE in practice	file-panel.js:601-602, but no caller passes returnList: callers are :500, :841, :920 only — VERIFIED

Defects found at HEAD on the routes this work replaces:

#	Defect	Evidence
X1	A terminal link to a git-changed file while a Touched editor is open titles the editor with the new file and fills it with the old one; its Save target stays the old file	probe in scratchpad (a copy of the dom-file-panel-touched.test.js harness): type=changes returnList=touched selected=src/b.js absolutePath=/work/a.txt readFile=["/work/a.txt","/work/a.txt"] editorCurrent="body of /work/a.txt". Cause: openChangesTabAt keeps any 'changes' tab (file-panel.js:937) and readChangesPair reads tab.absolutePath when set (:1282-1283) — VERIFIED
X2	A link clicked in a panel shell opens into the shell's own panel state, which is never displayed	probe: ownerTab=undefined shellTab=file panelOpen=false; the shell entry carries sessionId: panelSessionId (panel-terminal.js:258-259), terminal-manager.js:954 uses it, openFileTab renders only for currentPanelSessionId (file-panel.js:619) — VERIFIED
X3	A link click over an unanswered MCP diff destroys the diff's editor and replaces the tab without answering the CLI	openFileTab → destroyCurrentTab (file-panel.js:605, :892-900) never calls mcpDiffResponse; openChangesTab (:1233) the same — VERIFIED by reading; that the CLI then waits is ASSUMED (consistent with viewer-panel.md:164)

2. Boundary

Item	Owner
The open route from terminal and IDE openFile into Touched; opened rows; formatted markdown in the Touched editor; removal of the 'file' tab	this work (#472) — VERIFIED (issue body)
Touched for remote sessions (list from mirrored transcripts, remote stat, remote open)	#454, open issue, no PR — VERIFIED (gh issue view 454)
Restore on click startup mode	PR #441, touches CHANGELOG.md, public/style.css only among the files here — VERIFIED (gh pr list --json files)
Background agents view	PR #374, touches main.js, preload.js (new lines at 20 and 125), public/style.css, public/terminal-manager.js (lines 91 and 1139 hunks, not the link routes at 980-1035) — VERIFIED (gh pr diff 374)

Files touched by both this work and a neighbour: CHANGELOG.md (every PR adds under ## Unreleased: textual conflict, rebase only), public/style.css (different selectors), public/terminal-manager.js (different hunks), preload.js (only if the optional gitChangesLocate removal is taken; different hunk) — VERIFIED for hunk locations, ASSUMED for the absence of semantic overlap.

Landing order:

1. Round A — formatted markdown in the Touched editor (D4), standalone — ASSUMED (recommended split).
2. Round B — the merged open route and the removal of the 'file' tab (D1-D3, D5, D6) — ASSUMED.
3. (sessions): the Touched tab for remote sessions #454 after Round B: it edits touched-files-view.js and the "Remote sessions" section of .ai/contexts/touched-files.md, both rewritten here — ASSUMED.

3. Scope

Out of scope	Owned by
Touched for remote sessions	#454 — VERIFIED
Formatted markdown in the Changes list's own editor (a Changes row with no returnList)	follow-up issue, to be filed — ASSUMED
The Memory, Work Files and Activity trace ViewerPanels (app.js:31, :38, activity-trace-panel.js:24)	unchanged; existing owners — VERIFIED (instances located)
Pruning ViewerPanel features that only fpViewerPanel used (snapshot, _detachedSaves, onDetachedSave, saveNow)	follow-up issue, to be filed — ASSUMED
Removing the then-unused git-changes-locate IPC, gitChangesLocate, locateChangesFile and their tests (test/git-changes-file*.test.js)	follow-up issue, to be filed — ASSUMED
The MCP openDiff tab ('diff' type), its Accept/Reject, its save	unchanged; IDE emulation — VERIFIED (file-panel.js:566-590, :1098-1182 stay)
Links inside rendered markdown (<a href>): http(s) goes to the browser, everything else is blocked by will-navigate	unchanged; main.js:336-345 — VERIFIED
Parsing Bash commands to list more touched files	rejected in touched-files.md:24-27 — VERIFIED

4. Behaviour

Settled by the owner: Q1 = (b), MCP openFile goes through openTouchedPath with origin: 'mcp' and is re-read with {editor: true}; Q2 = (a), no open for a remote session — VERIFIED (coordinator message, round 2).

D1 — one route into Touched

1. openFileInPanel(sessionId, filePath, {line}) (file-panel.js:913) keeps its signature and its four callers (C4); its body becomes openTouchedPath(sessionId, filePath, {line, origin: 'link'}), a new function in touched-files-view.js, reached behind typeof as initTouchedView already is (file-panel.js:305) — ASSUMED (design).
2. The MCP mcp-open-file listener (file-panel.js:499-501) calls openTouchedPath(sessionId, data.filePath, {origin: 'mcp'}); data.content no longer exists (D1.7) — ASSUMED (design).
3. ownerId is panelTerminalOwnerOf(sessionId) || sessionId (panel-terminal.js:46-51): a panel shell's link opens in its owner's panel, fixing X2 — ASSUMED (design); the owner is the session switchPanel shows and whose transcripts Touched reads — VERIFIED (resolve-terminal-paths resolves the shell through its owner, terminal-path-target.js:93-97).
4. openTouchedPath(sessionId, filePath, {line, origin}), in order — ASSUMED (design):
   1. Remote (origin 'link' only): await window.api.resolveTerminalPaths(sessionId, [filePath]); when the single answer has reason === 'remote', return with no read and no panel change. Any other answer, accepted or not, continues: readFileForPanel applies the guards. This is one IPC already exposed (preload.js:200), handled at main.js:1907-1922 — VERIFIED. At HEAD it answers remote only when the remote descriptor has a cwd: resolveGitChangesTarget returns {ok: false, error: 'remote session has no known working directory'} with no kind otherwise (git-changes-target.js:303-307), and resolveTerminalPathsCwd turns that into no-cwd (terminal-path-target.js:93-104) — VERIFIED. Round B therefore decides remoteness from the folder (D1.9): that failure carries kind: 'remote', and resolveTerminalPathsCwd tests kind === 'remote' before ok. The sidebar DOM (sessionItemEl) is not consulted: a sidebar search takes rows out of the DOM (sidebar.js:483-488) — VERIFIED. Origin 'mcp' skips this step: remote sessions never get the bridge (docs/ide-emulation.md:46) — VERIFIED.
   2. Unanswered diff in the slot (type === 'diff' && !resolved): set state.pendingTouchedOpen = {filePath, line, origin} (a later click replaces it) and return. See D6 for its lifetime.
   3. Touched not in the slot (currentTab neither type 'touched' nor returnList.type 'touched'): openTouchedTab(ownerId, {restoreStash: false}): a fresh Touched tab and its list request, not awaited; the stashes stay where they are (D1.6). The existing destroyCurrentTab call inside it stashes a dirty Changes or Touched buffer as today — VERIFIED (touched-files-view.js:204, file-panel.js:891).
   4. Call openTouchedFile(ownerId, listTab, filePath, {line, origin}).
5. openTouchedFile(sessionId, tab, filePath, {line, origin = 'row'}) — ASSUMED (design):
   1. Same file in the editor (filePathKey(current.absolutePath) === filePathKey(filePath), replacing the === early return at touched-files-view.js:268, VERIFIED): no question, no read. With a line: set tab.pendingLine = line and tab.formatted = false, re-render; consumeChangesPendingLine (file-panel.js:2008-2013, VERIFIED) applies it. Without a line: change nothing, re-render.
   2. A stash exists for that path (state.touchedStashes has filePathKey(filePath), D1.6): restore it into a Touched editor carrying restoredEdits (the existing notice, file-panel.js:1949, VERIFIED), with no read. Its returnList is the current listTab (the Touched list in the slot when the open arrives), not the list the entry was stashed from: restoreChangesEdits today copies stash.returnList (file-panel.js:871, VERIFIED) and gains a returnList override for this case. A dirty editor on another file in the slot: origin 'link'/'row' handles it as in 5.3 (asks); origin 'mcp' or a replay stops there, both buffers stay as they are (the editor untouched, the entry still stashed), no question, and the file is listed as an opened row without a read (the stash proves it was opened before).
   3. Another file, origin 'link' or 'row': confirmDiscardChangesEdits before the read and again if the buffer changed during it (existing, touched-files-view.js:269, :286, VERIFIED).
   4. Another file, origin 'mcp' or a replay (D6): never a question. Read; on refusal stop (D2, refusal message); on ok add the opened row (D2); then, if the slot holds a dirty Touched editor on another file — checked after the read, so edits typed during it count — stop there: the editor is untouched and the file is only listed. Otherwise open it; a clean editor is replaced.
   5. The read is readFileForPanel(filePath, {editor: true}) for every origin (existing, :274, VERIFIED). openTouchedEditor(sessionId, absolutePath, pair, returnList, {line}) stores tab.pendingLine (today it sets none, file-panel.js:1245-1264, VERIFIED).
6. Touched stashes — ASSUMED (design). state.touchedStash (one slot, file-panel.js:852, VERIFIED) becomes state.touchedStashes, a Map keyed by filePathKey(absolutePath), oldest first. A single slot is not enough once a link may open a file while a stash exists: editing that file and then opening Changes would overwrite the first stash. Each entry is the object stashChangesEdits builds today plus type: 'touched-stash' and filePath: absolutePath. stashChangesEdits on a Touched editor sets the entry for its path; the Changes stash stays a single changesStash. Restoring removes the entry. The Touched toggle (openTouchedTab with the default restoreStash: true) restores the newest entry, as today's single slot is restored (touched-files-view.js:205-215, VERIFIED); there is no current list then, so the entry keeps its own returnList. The diff-ending hand-off (D6) restores the same way. Each entry exists only because the user typed into that file, so there is no count bound.
7. mcp-bridge.js stops reading the file: handleOpenFile (mcp-bridge.js:233-259, VERIFIED) sends mcp-open-file with {filePath} only — no content, and no preview/startText/endText, which no renderer code reads (grep -rn "startText\|endText\|data.preview" public/ prints nothing, VERIFIED). The renderer's guarded read is the only read; credential bytes never cross IPC on this route. The CLI tool call carries no line (args: preview, startText, endText, mcp-bridge.js:234) — VERIFIED.
8. The 'file' tab type, fpViewerPanel and everything only it needs are removed (§5) — ASSUMED (design).
9. Remoteness from the folder (main-side, Round B) — ASSUMED (design), callers VERIFIED:
   • git-changes-target.js:307: the remote-folder branch with no descriptor cwd returns {ok: false, kind: 'remote', error: 'remote session has no known working directory'}.
   • git-changes-target.js:311-314, the live-session branch, which today accepts any live activeSessions entry with a cwd as kind: 'local' (VERIFIED). When the folder is not cached (getCachedFolder returns null, so the remote-folder test at :303 is skipped), an attached remote session reaches it: registerRemoteAttachSession stores kind: 'remote-attach' with the remote cwd (main.js:2384-2398, VERIFIED). New rule, tested before exited and before cwd: if (session && session.kind && session.kind !== 'local-pty') return {ok: false, kind: 'remote', error: 'remote session'}. The kinds an activeSessions entry carries are 'local-pty' (main.js:2751) and 'remote-attach' (main.js:2389) — VERIFIED (grep -rn "kind: '" --include=*.js . outside node_modules and test/; session-transitions.js:422 re-keys the same object). Every kind other than 'local-pty' is refused the same way; an entry without kind stays local, which keeps the stubs in test/git-changes-target.test.js:101-110 ({exited: false, cwd}) green. Testing it before exited matters: an exited attach entry would otherwise fall to resolveSessionRealCwd on the local projects directory, fail without kind, and answer no-cwd — ASSUMED (design); reachability of an uncached attached session is not established — ASSUMED.
   • terminal-path-target.js:93-104, resolveTerminalPathsCwd: if (target && target.kind === 'remote') return {ok: false, reason: 'remote'} before the ok test, replacing target.ok && target.kind && target.kind !== 'local'.
   • Every other caller of resolveGitChangesTarget tests ok before reading kind, so the extra field on a failure changes nothing for them: requireLocalTarget returns a failed target unchanged (git-changes-file.js:48-49; callers main.js:1861, :1877, :1930, :1941); checkSubagentRepo (git-changes-target.js:256) passes it through to git-changes-status/git-changes-diff (main.js:1828-1856), whose renderer reads kind only on success (file-panel.js:1310-1318); resolveSubagentTarget (:99-100), listSubagentWorktrees (:189-190) and the subagent parent check (:260-261) test ok; resolvePanelTerminalCwd (panel-terminal-target.js:20-23) keeps only error on a failure, so a panel shell over a remote session still answers no-cwd (test/terminal-path-target.test.js:164-170 unchanged), and remote sessions have no panel shell (docs/terminal.md:142).
   • The existing tests stay green: test/git-changes-target.test.js:96-98 asserts ok and the error text only (gains assert.equal(result.kind, 'remote')); test/terminal-path-target.test.js:146-149 ('unknown', a local miss) still answers no-cwd.

Where each dependent behaviour moves:

Today (file-panel.js)	After
heldFileTabs, holdFileTabIfDirty, takeHeldFileTab, dropSavedHeldTabs, the held bar #file-panel-held (:146-151, :648-674, :823-845) — VERIFIED	Gone; state.touchedStashes (D1.6) keeps every dirty Touched buffer a route replaced — ASSUMED (design)
A held tab comes back when the slot ends (endCurrentTab, :809-821, every caller) — VERIFIED	endCurrentTab(sessionId, state, {pending = null, restoreStash = false} = {}). A pending open is replayed first (through openTouchedPath as origin 'mcp'); else, with restoreStash, the newest touchedStashes entry through openTouchedTab; else hide the panel. Callers: closeDiffByDiffId and closeAllDiffs (the CLI ending its diff) pass {pending, restoreStash: true}; Accept/Reject with a pending open passes {pending, restoreStash: true}; the panel's X on a diff passes {pending} only, so it replays a pending open and never restores a stash. Every other caller passes nothing (the panel's X on any other tab, toggleTouchedTab off, toggleChangesTab off, file-panel.js:321-349, :1186-1193, touched-files-view.js:190-197, VERIFIED callers): hide the panel, as today; the stashes stay in the map for the quit check, D1.5.2 and the Touched toggle — ASSUMED (design, owner decision)
Unsaved-on-quit: collectUnsavedFileTabs returns [] without fpViewerPanel (:681), lists the current tab when type 'file' or absolutePath, plus heldFileTabs (:680-690) — VERIFIED	Lists the current tab when it carries absolutePath (unchanged), plus every touchedStashes entry of every session; the fpViewerPanel guard goes. fileTabHasUnsavedEdits answers entry.content !== entry.savedContent for type 'touched-stash' (an entry is only created when they differ, :851, VERIFIED). heldTabLabels and the dialog's li.title read filePath, which the entry carries (:730-736, :2273, VERIFIED). saveUnsavedFileTab saves an entry with saveFileForPanel(entry.filePath, entry.content, entry.savedContent, {git: entry.gitFile, version: entry.version}), the arguments handleChangesSave sends (:2093, VERIFIED); on ok it deletes the entry (what it held is on disk); on refusal it returns the reason as for a tab — ASSUMED (design)
beforeunload veto and onUnsavedCheck (:166-178) — VERIFIED	Kept as is; they read collectUnsavedFileTabs — VERIFIED (same function)
reopenFileTab (:625-632), same-file open re-reads and reveals a line — VERIFIED	D1.5.1; external writes reach the editor through watch-file and syncOpenChangesFile (:517-526, :1325-1361, VERIFIED)
pendingLine on file tabs (:612-615, :1076-1079) — VERIFIED	tab.pendingLine on the Touched editor, consumed by consumeChangesPendingLine — VERIFIED (function exists; codemirror-setup.js:582 exports cmRevealLine)
MCP openFile → openFileTab (:499-501) — VERIFIED	D1.2, D1.5.4, D1.7
Close button / Escape on a dirty file tab asks (:328-329, :361) — VERIFIED	The Touched editor's existing confirmDiscardChangesEdits path (:327, :360) — VERIFIED

D2 — opened rows

• Model: state.touchedOpened, an array of absolute paths, newest first, on the per-session object getSessionState returns (file-panel.js:536-547), so it survives Refresh, closing and reopening Touched, session switches, and rekeyFilePanelState (:556-562, moves the whole object) — VERIFIED for those code paths, ASSUMED for the design.
• Not persisted: nothing writes filePanelState to disk (grep filePanelState public/*.js outside the panel files: only app.js:475, the rekey) — VERIFIED.
• Bound: at most TOUCHED_OPENED_MAX = 50 entries; a new one beyond it drops the oldest; re-adding an existing path (by filePathKey) moves it to the top — ASSUMED (value and rule chosen here).
• When a row is added: only after readFileForPanel(filePath, {editor: true}) answers ok, for origins 'link' and 'mcp'. A refused read adds nothing — ASSUMED (design).
• Guards: the editor read applies everything the viewer read does (.git segment, sensitive path, regular file, 2 MiB, NUL, UTF-8: main.js:985-1000) and, through readTouchedChangesFile → resolveTouchedRepo (git-changes-file.js:316-346), also resolveTouchedPath's refusals (control and \p{Cf} characters, over 4096, ~, UNC). A row therefore only ever holds a path that passed the Touched path rules — VERIFIED (code read).
• Narrower than today, two cases — VERIFIED (code read); accepted as Touched's existing rules — ASSUMED (design, owner decision for the second):
  • A path git refuses to open (exit 128 not saying "not a git repository", e.g. dubious ownership) is a refusal (git-changes-file.js:342-346, touched-files.md:254-256), where the viewer opened it.
  • A symbolic link opens read-only: the editor read answers {ok: true, git: false, readOnly: true} (git-changes-file.js:325-328), Save is hidden (file-panel.js:1902) and the notice says "Symbolic link — read-only." (:1945). The viewer showed it editable, and its save was refused main-side (main.js save-file-for-panel, isSymbolicLink). Stated in docs/touched-files.md, docs/terminal.md and the changelog (§5).
• Deduplication and selection by filePathKey: at render time an opened path whose filePathKey equals that of any entry in data.cachedFiles || data.files is not drawn. tab.selection is compared with filePathKey on both sides wherever rows are marked (touched-files-view.js:289, :337, :380, today exact ===, VERIFIED), so on Windows a link spelled c:\w\a.js selects the touched row C:\w\a.js — ASSUMED (design).
• Rendering: above the touched rows, a .changes-subagent-header "Opened, not touched by the file tools", then one .touched-file-row.touched-opened.touched-openable per path: a state label opened, the path in .touched-file-path (unicode-bidi: isolate, style.css:5021-5024, VERIFIED), no time, no tools, title "Opened from a link. The file tools did not touch it." Everything by textContent — ASSUMED (design).
• Drawn whatever the list's state: loading, error (no-transcript for a plain terminal, session-touched-files.js:307), or empty. Today renderTouchedContent returns before any row when data is null (touched-files-view.js:392-393) — VERIFIED; the opened rows are drawn before that return, and the list signature (:377) gains a revision counter bumped on every change to touchedOpened — ASSUMED (design).
• Not counted: touchedSummaryText (:298-318) is unchanged; "N files touched" never includes opened rows — ASSUMED (design).
• Click on an opened row: openTouchedFile with origin 'row', which re-reads through the guards — ASSUMED (design).
• Trust model: opened rows never come from a transcript and never reach main as a list; session-touched-files is unchanged; "listing is not opening" (touched-files.md:69-75) still holds, since the only open is readFileForPanel — ASSUMED (design).
• Refusal message: for origins 'link' and 'mcp', tab.openError is "Could not open the file: ", without the path, because that path did not pass resolveTouchedPath and may contain format characters; a row click keeps today's <path>: <reason> (:282, path from main's resolved list) — ASSUMED (design).

D3 — git-changed files

• The Touched editor shows the git diff: read-file-for-panel with {editor: true} returns git: true and original = HEAD (readTouchedChangesFile, staged: true, git-changes-file.js:365-378); applyChangesPair sets noDiff only when !pair.git || original === current (file-panel.js:1274-1277); ensureChangesEditor then builds the side-by-side, inline or plain view from changesDiffMode (:1963-2005) — VERIFIED.
• Decision: a click on a git-changed file goes to Touched; locateChangesRow and openChangesTabAt are removed from the click route (X1 disappears with them) — ASSUMED (design).
• What differs from the Changes route, stated in the docs — VERIFIED (code read):
  • The base is HEAD. Changes compares an unstaged file with the index (changes-view.md:617-620, repointSelectedFile file-panel.js:1363-1372): for a partially staged file the two diffs differ.
  • Touched finds the repository from the file's own directory, not the session's cwd (touched-files.md:231-233).
  • Changes falls back to a read-only git diff text for a file it cannot edit (file-panel.js:1443-1459); Touched shows the refusal instead (invalid UTF-8, binary HEAD blob) or plain content (mixed line endings, TOUCHED_PLAIN_REASONS, git-changes-file.js:20).
• The Changes list is not opened by a click any more; the Changes header toggle stays the way to it — ASSUMED (design).

D4 — formatted markdown in the Touched editor

• Detection: one helper isMarkdownPath(filePath) in viewer-toolbar.js, extension lower-cased, md, mdx or markdown; ViewerPanel._isMarkdown (viewer-panel.js:658-662) may delegate to it — ASSUMED (design). C3a explains the third extension.
• Renderer: one helper renderMarkdownPreview(el, text) in viewer-toolbar.js, el.innerHTML = DOMPurify.sanitize(window.marked.parse(text)) on one line, the form the invariant in viewer-panel.md:59 requires. toggleMarkdownPreview's editorView.state.doc (viewer-toolbar.js:46) cannot be reused as is: a side-by-side MergeView has no .state, its buffer is view.b.state.doc (readChangesEditorContent, file-panel.js:2047-2054) — VERIFIED. window.marked comes from the CodeMirror bundle (codemirror-setup.js:585-586), so rendering waits for loadCodeMirrorBundle, as the editor does — VERIFIED.
• Chrome: a button #changes-diff-format-btn in buildChangesDiffChrome (file-panel.js:1825-1894) with aria-pressed, and a <div id="changes-diff-preview" class="markdown-preview" tabindex="0"> sibling of #changes-diff-host in #changes-diff-view. tabindex="0" lets it be the target of a keydown after a click, so the Escape handler's closest('#changes-diff-view') test (file-panel.js:135-136, VERIFIED) matches; toggling to formatted focuses it. A #changes-diff-preview rule in style.css adds min-height: 0 to .markdown-preview's flex: 1; overflow-y: auto (style.css:2677-2685, which has none, VERIFIED) so that a long document scrolls inside the column-flex #changes-diff-view (:5103-5109, VERIFIED). The button shows only when tab.returnList?.type === 'touched' and isMarkdownPath(tab.absolutePath) — ASSUMED (design).
• Default and persistence: one key, localStorage.touchedMarkdownFormatted; 'false' means source, anything else (absent, unreadable, throwing storage) means formatted; read and written in try/catch like touchedListRatio (file-panel.js:1749-1755, :1806-1809), default a named constant — ASSUMED (design); the guarded pattern exists — VERIFIED.
• Per open: tab.formatted = isMarkdownPath(path) && storedPreference && !line, computed in openTouchedEditor and again when a stash entry is restored (the stash does not carry formatted; restoreChangesEdits fills a fresh createChangesTab(), file-panel.js:865-886, touched-files-view.js:206-209, VERIFIED). A path:line open is source at that line whatever the preference, and does not write the preference; D1.5.1 covers a repeated click — ASSUMED (design).
• The buffer lives in source: the editor is created and kept in the hidden host while formatted; formatted shows readChangesEditorContent(tab) ?? tab.current, so unsaved edits are rendered; toggling never destroys the editor; Save and Reload stay visible and work — ASSUMED (design).
• Formatted vs diff: formatted wins on open; the diff-mode button is hidden while formatted; the user gets the diff by toggling formatted off, which shows the stored changesDiffMode view, and that choice is remembered for the next markdown file — ASSUMED (design).
• Re-render: every renderChangesDiff re-renders the preview when formatted, so a watcher reload (syncOpenChangesFile destroys and rebuilds, file-panel.js:1358-1360, VERIFIED) shows the new disk content — ASSUMED (design).

D5 — remote sessions

• Path links: unchanged, refused main-side (C9) — VERIFIED.
• Touched list: unchanged, reason: 'remote' (C10) — VERIFIED.
• file:// links and "Open in panel" in a remote session (C9): no open, no read, no panel change (Q2 = (a)), decided main-side by D1.4.1 from the session's folder, so a remote session whose mirrored descriptor has no cwd is refused too (D1.9) — ASSUMED (design). The remote open belongs to (sessions): the Touched tab for remote sessions #454 — VERIFIED (issue body).

D6 — panel states when a click arrives

Panel shows	Result
nothing (closed)	Panel opens on Touched (list request) with the file in the editor — ASSUMED (design)
the panel shell only	Touched above the shell; setPanelTerminalShellOnly(!tab) already switches layout (file-panel.js:1057) — VERIFIED (call)
Touched list	the file opens below it, row selected — ASSUMED (design)
Touched editor, clean, other file	replaced, no question (confirmDiscardChangesEdits returns true when clean, :1540-1544) — VERIFIED
Touched editor, dirty, other file	'link'/'row': "This file has unsaved edits. Discard them?"; no keeps everything and reads nothing (existing, touched-files-view.js:269) — VERIFIED. 'mcp'/replay: no question, the file is only listed (D1.5.4) — ASSUMED (design)
Touched editor, same file	no question; line revealed if given (D1.5.1) — ASSUMED (design)
something other than Touched, with dirty touchedStashes entries	the clicked file opens in a fresh Touched tab (D1.4.3, restoreStash: false); the entries stay stashed and come back with the restoredEdits notice when their file is opened again (D1.5.2) or the Touched toggle restores the newest; no question about edits not on screen — ASSUMED (owner decision)
the user closes the panel (X) on any tab (a diff included), turns Touched off or turns Changes off, with touchedStashes entries	the panel closes as today; no stash is restored (restoreStash is never passed by these routes); on a diff with a pending open, the X replays that open only; the entries stay for the quit check, D1.5.2 and the Touched toggle — ASSUMED (owner decision)
Changes list or editor	Touched replaces it; a dirty Changes buffer goes to changesStash and comes back when Changes is reopened (destroyCurrentTab default stash, :888-891; restoreChangesEdits, :865-886) — VERIFIED
an answered MCP diff	replaced, as today — VERIFIED (destroyCurrentTab)
an unanswered MCP diff	the diff stays, nothing is answered; the open waits in pendingTouchedOpen (fixes X3) — ASSUMED (design)
another session's panel (grid view click in a non-shown terminal)	the open lands in that session's state and shows when that session is shown, as today (currentPanelSessionId checks) — VERIFIED (:619, :1260)

pendingTouchedOpen lifetime — ASSUMED (design):

• It is replayed only on the diff-ending hand-off, four routes: closeDiffByDiffId and closeAllDiffs (the CLI, file-panel.js:942-962, VERIFIED); handleClose on a diff (the user's close, which answers reject, :330-331, VERIFIED); and Accept or Reject in the diff UI (handleDiffAction, :1157-1182, VERIFIED: it answers, sets resolved and today keeps the tab) when a pendingTouchedOpen is set: the user has answered, so the diff tab ends there as handleClose ends it (editor destroyed, currentTab = null) and the open replays. With no pending open, Accept/Reject behaves as today and the answered diff stays until the CLI closes it (viewer-panel.md:123). The CLI's later close_tab/closeAllDiffTabs for a diff that has already ended is a no-op: closeDiffByDiffId returns unless the slot holds a diff with that diffId (:953-956), closeAllDiffs unless the slot holds a diff (:946) — VERIFIED. Each route reads state.pendingTouchedOpen and clears it before destroyCurrentTab, then calls endCurrentTab: the CLI routes and Accept/Reject with {pending, restoreStash: true}, the X on a diff with {pending} only (it replays the pending open and never restores a stash, D1 table); the order matters because both CLI routes call destroyCurrentTab and then endCurrentTab (:947-949, :959-961, VERIFIED).
• destroyCurrentTab on a type 'diff' tab clears state.pendingTouchedOpen. So any other route that takes the diff out of the slot drops the deferred open: openTouchedTab (Touched toggle), openChangesTab, openDiffTab (touched-files-view.js:204, file-panel.js:1233, :570, VERIFIED all call destroyCurrentTab, never endCurrentTab).
• A replay runs as origin 'mcp', whatever origin was stored: the replay is triggered by the session or by a close, not by a click on that file, so it never asks (viewer-panel.md:144). The stored origin decides only D1.4.1: a stored 'link' replay still runs the remote check.

Other edge cases:

• Header: Touched is pressed for its list or an editor carrying its returnList, Changes is not (touched-files-view.js:182, file-panel.js:1059) — VERIFIED.
• A click while a Touched read is in flight is ignored (tab.opening, touched-files-view.js:267) — VERIFIED (existing); kept — ASSUMED (design).
• A read that resolves after the tab was replaced or the session closed its panel is dropped (:279-280) — VERIFIED.
• A file deleted between the link check and the click: the read fails, nothing is added, the refusal shows — ASSUMED (design). A file deleted after it was opened: the existing watcher path sets fileError ("This file can no longer be read") — VERIFIED (:1336-1339, :1951).
• Over 2 MiB, binary, not UTF-8: refused by both the link check and the read (terminal-path-target.js:56-58, main.js:993-1000) — VERIFIED.

5. What is removed, what is updated

Removed from public/file-panel.js (Round B) — VERIFIED (each located):
fpViewerPanel, fpViewerOwner (:30-31); the #file-panel-viewer container and constructor (:153-164); heldBarEl and #file-panel-held (:146-151); openFileTab, reopenFileTab (:593-632); holdFileTabIfDirty, dropSavedHeldTabs, takeHeldFileTab (:648-674); renderHeldBar (:823-845); showFileTabInViewer (:1040-1050); locateChangesRow, openChangesTabAt (:923-940); the 'file' branches of handleClose, returnToPanelList, destroyCurrentTab, renderTabContent, fileTabHasUnsavedEdits, saveUnsavedFileTab, endCurrentTab; #file-panel-viewer from the Escape selector (:136). heldTabLabels stays: the unsaved dialog uses it (:730).

public/style.css: remove only the #file-panel-viewer, selector from the list at :4641; the #file-panel-diff rule it shares (flex: 1; display: flex; flex-direction: column; min-height: 0, :4642-4647) stays, since the MCP diff tab's layout depends on it. #file-panel-held has no rule (grep -n file-panel-held public/style.css prints nothing) — VERIFIED (sed -n 4641,4647p).

mcp-bridge.js: handleOpenFile sends {filePath} and no longer reads the file (D1.7) — ASSUMED (design).
git-changes-target.js:307 and terminal-path-target.js:93-104: remoteness from the folder (D1.9); test/git-changes-target.test.js:96-98 gains a kind assertion and test/terminal-path-target.test.js gains T17c — ASSUMED (design).

eslint.config.js, every new cross-file name, by block — VERIFIED (blocks read at :207, :230, :245, :380-406), ASSUMED (additions):

• Shared renderer globals, next to toggleMarkdownPreview (:230): isMarkdownPath, renderMarkdownPreview.
• public/file-panel.js block (:380-385, today initTouchedView, renderTouchedTab, hideTouchedView): openTouchedPath, openTouchedTab, panelTerminalOwnerOf.
• public/touched-files-view.js block (:386-406): filePathKey; openTouchedTab and openTouchedPath are defined in this file and need no entry; isMarkdownPath and renderMarkdownPreview come from the shared list; stashChangesEdits only if the stash code moves into this file.

Tests to rewrite or delete (counts measured with node --test <file>) — VERIFIED (counts and grep grep -rn "openFileTab\|file-panel-viewer\|heldFileTabs" test/):

• test/dom-file-panel-file-tab.test.js (55 tests): deleted; the behaviours that survive are covered by the new tests in §6.
• test/dom-file-panel-goto-line.test.js (5): "an unchanged file opens in the viewer" and "a changed file opens its diff" become Touched-editor assertions; the read-only-diff note test goes (no read-only diff on this route).
• test/dom-file-panel-unsaved-guard.test.js (8): rebuilt on a dirty Touched editor and touchedStashes entries.
• test/dom-file-panel-changes.test.js: 12 calls to openFileTab as "something else opens" (:856, :1242, …, :1906) become openDiffTab; the 5 openFileInPanel tests (:1819-1909) move to the Touched route; :1864 (asserts #file-panel-viewer is flex) asserts the Touched editor instead.
• test/dom-file-panel-touched.test.js: :733 (heldFileTabs size) asserts touchedStashes has no entry; :828 and :921 (openFileTab as the replacing action; :924 asserts type === 'file') use openDiffTab and assert type === 'diff'; :840-846 (#file-panel-viewer display) drop that id from the list; :1108 (openFileTab as a temporary open) uses openDiffTab then closeDiffByDiffId.
• test/panel-terminal.test.js:1015 (openFileTab to trigger a refit) uses openTouchedTab.
• test/mcp-bridge-open-file.test.js:43-57: the first test asserts data.filePath resolved and !('content' in data) (today data.content === 'a0\n', :55), and a file that cannot be read still answers ok.

Docs (Round B unless noted):

• docs/touched-files.md: opened rows; a terminal click opens here; symlinks read-only; markdown formatted (Round A) — ASSUMED (content).
• docs/terminal.md:84-88 ("in the Changes view … in the file viewer otherwise"): Touched for every file; symlinks read-only; no open from a remote session — VERIFIED (text read).
• docs/ide-emulation.md:65-68 "File viewer" (C12): files Claude opens go to Touched with the panel's checks — VERIFIED (text read).
• docs/changes-view.md: the "File links" route — ASSUMED (section not read in full).
• .ai/contexts/touched-files.md: opened rows, the route, stashes, the formatted mode, "Open" decision (:196) — VERIFIED (sections read).
• .ai/contexts/viewer-panel.md: "One viewer, several file tabs", "An open aimed at a file tab", "Held tabs", "Unsaved edits on quit" rewritten; "The ok answer" (:202-204, "no open is declined or deferred") rewritten for the listed-only and deferred cases; callsite count (C8); the markdown-sink list (C13) gains renderMarkdownPreview — VERIFIED (sections read).
• .ai/contexts/changes-view.md:861 (openFileInPanel → git-changes-locate) and :897 (openFileTab as an MCP-driven open) — VERIFIED (lines read).
• .ai/contexts/panel-terminal.md:222 (openFileInPanel in a list of panel callers) — VERIFIED (line read).
• .ai/contexts/terminal-path-links.md:79-89 (the two routes for path:line) — VERIFIED (read).
• CHANGELOG.md, ## Unreleased, ### Changed (rule: docs/changelog.md) — VERIFIED (rule read). Proposed: Round A, "Markdown files open formatted in Touched, with a toggle back to the source that is remembered. ((touched): open every clicked file in Touched, with markdown formatted by default #472)"; Round B, "Clicking a file in the terminal, or a file Claude opens, shows it in Touched, at the top of the list as opened when the file tools did not touch it, with its diff against HEAD when it changed. A path:line link opens the source at that line. Symbolic links open read-only, and files Claude opens get the panel's checks: credential paths, binary files and files over 2 MB are refused. ((touched): open every clicked file in Touched, with markdown formatted by default #472)" — ASSUMED (wording).

6. Acceptance criteria

All commands run from the repository root, in the primary checkout — VERIFIED (house rule, .ai/shared-guidelines.md "Testing").

#	Command	Pass
A1	node --test test/dom-file-panel-touched.test.js	ℹ fail 0 — ASSUMED
A2	npm test	ℹ fail 0 — ASSUMED
A3	npx eslint .	0 errors — ASSUMED
A4	`grep -nE "fpViewerPanel	openFileTab
A5	grep -n "marked.parse" public/*.js | grep -v "DOMPurify.sanitize(window.marked.parse"	exactly one line, public/jsonl-viewer.js:59: const html = window.marked.parse(escaped); (that sink is sanitised on :61). At HEAD it prints exactly that line — VERIFIED. A new sink written as el.innerHTML = window.marked.parse(x) adds a line and fails it — ASSUMED
A6	node --test test/changelog.test.js	ℹ fail 0 — ASSUMED
A7	node --test test/mcp-bridge-open-file.test.js (Round B)	ℹ fail 0 with the rewritten first test — ASSUMED
A8	task e2e (Linux) or the CI e2e job	the new journey and the existing Touched journey pass — ASSUMED

New tests, in test/dom-file-panel-touched.test.js so they reuse setupDom (:51-158). Each: input → observable result; the mutation that reddens it. None was run (the code does not exist yet) — ASSUMED for every "reddens" claim below. One mutation of existing coverage was run: replacing readFileForPanel(filePath, { editor: true }) by readFileForPanel(filePath) in a scratch copy of touched-files-view.js fails "a present file opens through readFileForPanel and the shared Changes editor" and one Escape test (pass 70, fail 2) — VERIFIED; the new route reuses openTouchedFile, so no new test re-asserts {editor: true}.

Round A (D4); load the real marked.umd.js and purify.min.js into the window as test/jsonl-viewer-sanitize.test.js:24-25 does — VERIFIED (precedent):

Test	Input → expected	Mutation that reddens it
F1 markdown opens formatted	row /work/README.md, content # Title → #changes-diff-preview h1 text Title, #changes-diff-host hidden, format button aria-pressed="true"	default 'false' when the key is absent
F2 not markdown, no toggle	row /work/a.txt → format button hidden, preview hidden	drop the isMarkdownPath test from the button's visibility
F3 extensions	README.markdown, x.MDX → formatted	remove markdown from the extension set (or drop the lower-casing for MDX)
F4 one remembered key	click toggle, open another .md → localStorage.touchedMarkdownFormatted === 'false', second file in source	skip the setItem
F5 unsaved buffer rendered	editor setText('# Edited'), toggle source→formatted → h1 Edited, Save enabled	render tab.savedContent instead of readChangesEditorContent(tab)
F6 sanitised	content [x](javascript:alert(1)) <img src=x onerror=alert(1)> → no a[href^="javascript:"], no [onerror] in the preview	drop DOMPurify.sanitize in renderMarkdownPreview
F7 storage throwing	getItem/setItem throw → formatted, toggle works, no exception	read the key without try
F8 toggling keeps the editor	toggle twice → the same editor object (ctx.editors.length unchanged), buffer kept	destroy the editor on toggle
F9 Changes list editor unaffected	Changes row README.md (no returnList) → no format button	show the button whenever the path is markdown
F10 Escape from the preview	formatted .md open; keydown Escape dispatched on #changes-diff-preview → the editor closes, currentTab.type === 'touched'	drop tabindex and make the preview a plain div: dispatch then has to target body and nothing closes (write the test to dispatch on document.activeElement after preview.focus())
F11 restored stash recomputes formatted	dirty Touched README.md in source after a toggle, preference then set back to formatted; openDiffTab, closeDiffByDiffId → the restored editor is formatted and its preview shows the unsaved text	carry formatted in the stash entry (the restored tab comes back in source)

Round B (D1-D3, D5, D6):

Test	Input → expected	Mutation that reddens it
T1 link opens Touched with an opened row	list [a.txt]; openFileInPanel('s1','/work/notes.txt') → currentTab.returnList.type === 'touched', absolutePath === '/work/notes.txt', first row .touched-opened with that path and selected	skip adding to state.touchedOpened
T2 opened rows are not counted	after T1 → summary starts 1 file touched	count touchedOpened in touchedSummaryText
T3 deduplicated with a touched row	openFileInPanel('s1','/work/a.txt') → one row for that path, the touched one, selected, no .touched-opened	remove the render-time filter
T3w Windows spelling selects the touched row	window.api.platform = 'win32'; touched row path String.raw`C:\w\a.js` ; openFileInPanel('s1', String.raw`c:\w\a.js`) → no .touched-opened, the touched row has selected. The paths must be raw or escaped ('c:\\w\\a.js'): a plain 'c:\w\a.js' is c:wa.js (node -e "console.log('c:\w\a.js')" prints c:wa.js, VERIFIED), which contains no separator	compare tab.selection with === at the row marking
T3x mixed separators	as T3w with the link 'c:/w\\a.js' (a forward slash, then an escaped backslash) against the touched row 'C:\\w\\a.js' → the touched row selected, no .touched-opened	fold case in filePathKey and leave separators unfolded
T4 survives Refresh and close/reopen	T1, click #touched-refresh-btn, toggle Touched off and on → the opened row is still first	keep the list on the Touched tab object instead of the session state
T5 per session	T1 on s1; switchPanel('s2'), open Touched → no .touched-opened	one module-level array instead of state.touchedOpened
T6 refused read	readImpl → {ok:false, error:'access to sensitive path denied'} → no opened row, no editor, #touched-summary .changes-error contains the reason and not the path	add the row before the read answers
T7 list failure does not block	touchedImpl → {ok:false, reason:'no-transcript', error:'this session has no transcript on disk'} → the editor opens, the opened row is drawn, the error shows	keep the early if (!data) return ahead of the opened rows
T8 dirty editor asks	row A open and dirty; openFileInPanel for B with confirm → false → editor still A, calls.readFile unchanged	call openTouchedEditor without confirmDiscardChangesEdits on the link origin
T9 same file, line	A open and dirty; openFileInPanel('s1', A, {line: 7}) → no confirm call, no new read, cmRevealLine stub called with 7	keep the early return on the same path before pendingLine
T9b same file, no line, stays formatted	formatted README.md open; openFileInPanel('s1', README) and a click on its own row → still formatted, no read	set formatted = false on every same-file open
T10 path:line on markdown is source	.md, preference formatted, {line: 12} → host visible, preview hidden, reveal 12, key not written	ignore line when computing tab.formatted
T11 git-changed file goes to Touched	gitChangesLocate stub reporting changed → never called; gitChangesFile never called; currentTab.returnList.type === 'touched'; the mode button visible	restore the locateChangesRow branch
T12 panel shell → owner	stub panelTerminalOwnerOf('shell-1') → 'owner'; switchPanel('owner'); openFileInPanel('shell-1', p) → owner's state holds the editor, sessionTouchedFiles called with owner, panel open	drop the owner mapping
T13 unanswered diff kept, then replayed	openDiffTab('s1', 'd1', …); openFileInPanel('s1', p) → currentTab.type === 'diff', mcpDiffResponse not called; closeDiffByDiffId('s1','d1') → Touched editor on p	let openTouchedPath call openTouchedTab over the diff
T13b deferred open dropped by another route	openDiffTab; openFileInPanel('s1', p); click #touched-toggle-btn (Touched replaces the diff); click it again (closes) → panel closed, calls.readFile empty, no editor on p	do not clear pendingTouchedOpen in destroyCurrentTab for a diff
T13c replay never asks	dirty Touched A stashed by openDiffTab; openFileInPanel('s1', B) during the diff; closeDiffByDiffId → confirm never called, editor on B, A still in touchedStashes	replay with the stored 'link' origin through the confirm branch
T14 stash survives a diff and returns	dirty Touched A; openDiffTab; closeDiffByDiffId → editor A with the unsaved text and the restoredEdits notice	remove the touchedStashes restore from endCurrentTab
T14b link while a stash exists opens the clicked file	dirty Touched A; Changes toggle (A stashed); openFileInPanel('s1', B) → confirm never called, editor on B, A still stashed; click row A → editor A with the unsaved text, no read of A	let the link route restore the newest stash (restoreStash: true)
T14c two stashes kept	as T14b, then edit B and click the Changes toggle → touchedStashes holds A and B, both with their text	keep a single touchedStash slot
T15 quit check covers the stash	dirty Touched A; openDiffTab; askAboutUnsavedEdits() → dialog lists a.txt (li.title /work/a.txt); Save → saveFileForPanel('/work/a.txt', 'unsaved', 'file body', {git: true, version: 'v1'}), resolves true, entry deleted	leave touchedStashes out of collectUnsavedFileTabs
T16 MCP open over a dirty editor never asks	dirty Touched A; MCP handler with {filePath: B} → confirm not called, editor still A, B listed as opened	route MCP through the 'link' origin
T16b MCP open refused shows nothing of the file	MCP handler with {filePath: '/home/u/.ssh/id_rsa', content: 'SECRET'}; readImpl → {ok:false, error:'access to sensitive path denied'} → no opened row, no editor, SECRET absent from document.body.innerHTML	render data.content when present
T17 remote, decided main-side	resolveTerminalPaths stub → [{ok:false, reason:'remote'}], no .session-item for the session in the DOM; openFileInPanel('r1', '/x/a.txt') → no readFileForPanel call, panel not opened	decide remoteness from sessionItemEl(id)?.dataset.remoteAlias (null here, so treated as local)
T17b a non-remote refusal still reads	resolveTerminalPaths stub → [{ok:false, reason:'missing'}] → readFileForPanel called once	return on any ok: false answer
T17c remote with no known cwd (main)	test/terminal-path-target.test.js: cwdDeps({}, {r1: {ok: false, kind: 'remote', error: 'remote session has no known working directory'}}) → resolveTerminalPathsCwd('r1', deps) deep-equals {ok: false, reason: 'remote'}; and test/git-changes-target.test.js: a remote folder whose descriptor has no cwd → kind === 'remote', ok === false	test ok before kind in resolveTerminalPathsCwd (answers no-cwd), or drop kind from git-changes-target.js:307
T17d remote with no known cwd (renderer, real chain)	in dom-file-panel-touched.test.js, window.api.resolveTerminalPaths = (id, texts) => { const w = require('../terminal-path-target').resolveTerminalPathsCwd(id, {getSession: () => undefined, resolveTarget: () => ({ok: false, kind: 'remote', error: 'remote session has no known working directory'}), resolvePanelCwd: () => ({ok: false})}); return Promise.resolve(texts.map(() => ({ok: false, reason: w.reason}))); } (the shape main.js:1915 returns); openFileInPanel('r1', '/x/a.txt') → no readFileForPanel call, panel not opened	revert resolveTerminalPathsCwd to test ok first (it answers no-cwd and the renderer reads the local disk)
T18 closing keeps the stashes	two dirty Touched stashes A and B (as T14c), Changes shown; click #changes-toggle-btn (off) → panel closed, touchedStashes.size === 2, no editor restored; same with the panel X and with the Touched toggle off over a clean Touched list	restore the newest stash in endCurrentTab when restoreStash is not passed
T19 MCP over a dirty editor never restores a stash	dirty Touched A in the slot, stash entry for B; MCP openFile B → confirm not called, editor A unchanged, B still in touchedStashes, B listed as opened, readFileForPanel not called for B	let D1.5.2 fall into the 5.3 confirm for the 'mcp' origin
T20 restore takes the current list	stash A from list tab L1 (Touched editor A dirty, Changes toggle); link B opens a fresh Touched list L2; click row A → currentTab.returnList === L2, editor A with its unsaved text	restore with stash.returnList (gives L1)
T21 Accept replays a pending open	openDiffTab('s1','d1',…); openFileInPanel('s1', p); click .file-panel-accept-btn → mcpDiffResponse called once with accept, slot is the Touched editor on p; then closeDiffByDiffId('s1','d1') → no change, no second read	keep the answered diff in the slot when a pending open exists
T21b Accept without a pending open keeps the diff	openDiffTab; click Accept → currentTab.type === 'diff', resolved === true (unchanged behaviour)	hand off on every answer
T22 X on a diff never restores a stash	dirty Touched A stashed (Changes toggle), then openDiffTab('s1','d1',…) unanswered, no pending open; click #file-panel-diff .fp-close-btn (the diff toolbar's close, file-panel.js:212-217) → mcpDiffResponse called with reject, panel closed (#file-panel without open), touchedStashes still holds A, no editor restored	pass restoreStash: true from handleClose
T22b X on a diff replays a pending open only	as T22, plus openFileInPanel('s1', p) while the diff shows; X → slot is the Touched editor on p, A still stashed, confirm not called	drop pending from handleClose's call
T17e uncached attached remote session (main)	test/git-changes-target.test.js: getCachedFolder: () => null, activeSessions: new Map([['r1', {kind: 'remote-attach', exited: false, cwd: '/srv/app'}]]) → ok === false, kind === 'remote'; the same with exited: true	remove the kind test from the live-session branch (answers kind: 'local', cwd: '/srv/app'), or move it after !session.exited (the exited variant fails)

E2E (one journey, e2e/changes.spec.js, after the existing Touched journey at :102-140, VERIFIED location) — ASSUMED (design):

• Plain terminal (openPlainTerminal, which returns nothing, e2e/fixtures.js:158-162, VERIFIED); the id is read with page.evaluate(() => currentPanelSessionId), the top-level let in file-panel.js:27 (VERIFIED declaration; reachability from page.evaluate ASSUMED).
• Fixture README.md with # Title and 300 paragraph lines, then page.evaluate(([id, p]) => openFileInPanel(id, p), [id, readme]).
• Assert: #touched-list .touched-opened count 1; #changes-diff-preview visible with an h1; its bounding box bottom ≤ #file-panel-content's bottom; scrollHeight > clientHeight on the preview; the list box above it; after the toggle, a .cm-editor visible in #changes-diff-host.
• Mutation: drop min-height: 0 from the #changes-diff-preview rule → the preview grows past the panel and the bottom assertion fails.

7. Constraints the implementer inherits

Copied from .ai/shared-guidelines.md ("When you finish work", "Testing", "Patterns") — VERIFIED (text read):

• "Comment sweep. Writing comments while coding is fine, but a second pass must remove them before the PR: rationale, measurements, and design notes go to context engineering (.ai/contexts/*.md) or an ADR (docs/decisions/), never in the code. What may remain in code: at most a one-line pointer to that doc (e.g. // see .ai/contexts/subagent-observability.md), and that's the ceiling (maintainer rule, PRs perf(sidebar): discrete steps() indicator animations + ADR 0002 #127/fix(sidebar): live running indicator for subagents #130)."
• "Changelog. Every PR that changes behaviour adds its entry under ## Unreleased in CHANGELOG.md, written to the rule in docs/changelog.md; a PR users see nothing of takes the no-changelog label instead."
• "task check (lint + test). 0 errors. Pre-existing warnings are fine."
• "Squash to clear commits. No Co-Authored-By. Imperative subject, brief why-body."
• "gh pr create against devsuitup/switchboard:main (the fork's main, not upstream's). Title format: (area): short imperative."
• "When the PR is ready to merge … request the maintainer account devsuitup as reviewer: gh api -X POST repos/devsuitup/switchboard/pulls/<n>/requested_reviewers -f 'reviewers[]=devsuitup'."
• "Renderer tests use jsdom via test/dom-setup.js + vm.runInContext to evaluate public/*.js in isolation."
• "Pitfall: installSpies: false is required when the eval defines functions you also spy on — function declarations from eval overwrite property spies."
• "Always test in the primary checkout …, not inside .claude/worktrees/agent-*."
• "Default value for a setting | SETTING_DEFAULTS in setting-defaults.js — never a literal at the call site." The formatted preference is a panel localStorage key like touchedListRatio, not a Settings value; it takes a named constant as DEFAULT_TOUCHED_LIST_RATIO does (file-panel.js:62) — VERIFIED (precedent), ASSUMED (classification).

Copied from .ai/contexts/viewer-panel.md:59 — VERIFIED:

• "Every markdown→innerHTML sink in this app must be DOMPurify.sanitize(marked.parse(...)), never marked.parse(...) alone."

Copied from .ai/contexts/viewer-panel.md:144 — VERIFIED:

• "Nothing a session triggers shows a modal, and no route drops unsaved edits without the user saying so." D1.5.4 and the replay rule (D6) keep it.

Copied from .ai/contexts/touched-files.md:69-73 — VERIFIED:

• "Listing is not opening. Only a row with openable === true and state === 'present' has a click handler. It calls readFileForPanel with {editor: true}; the main handler retains its sensitive-path, regular-file, size and binary guards." Opened rows are a second kind of row: their click calls the same function and the same guards (D2).

Copied from .ai/contexts/terminal-path-links.md:24 — VERIFIED:

• "Only a path the panel has established it can open becomes a link." The editor read is stricter than the link check (D2, "Narrower than today"), so a few underlined paths will be refused on click with a message; today such a refusal is silent (file-panel.js:919) — VERIFIED.

What must not break, by path — VERIFIED (each exists and passes at baseline): test/touched-editor-ipc.test.js, test/touched-files-wiring.test.js, test/terminal-path-links-wiring.test.js, test/terminal-context-menu.test.js, test/dom-file-panel-diff-save.test.js, e2e/changes.spec.js Touched journey. test/mcp-bridge-open-file.test.js changes on purpose (§5).

Service conventions (package.json): "test": "node scripts/run-tests.js", "lint": "eslint .", "e2e": "playwright test -c e2e/playwright.config.js", engines.node ">=20 <23"; this workstation runs Node v24.21.0, outside that range — VERIFIED.

8. Whether this fits one go

It does not fit a single dispatch — ASSUMED (judgement from the volume measured):

• Round A (D4: two helpers in viewer-toolbar.js, chrome, preview rule and render in file-panel.js, F1-F11, docs, changelog) fits one dispatch — ASSUMED.
• Round B removes about 15 functions, turns the stash into a map, changes mcp-bridge.js, deletes a 55-test file and rewrites about 35 tests across 6 more files (§5) — VERIFIED (counts), ASSUMED (dispatch size).
• What forces a second round on B: the e2e journey runs only in the CI e2e job or a local Electron launch (docs/e2e.md), and the Windows CI leg exercises filePathKey folding (file-panel.js:641-646), which a Linux run does not — VERIFIED (doc and code), ASSUMED (that a rework cycle follows).

9. Open questions

None. Q1 and Q2 are settled by the owner and written into D1.2, D1.4.1, D1.5.4, D1.7 and D5 — VERIFIED (coordinator message).