Phase 10 complete — all gates green, committed as `6ec6181`.

**Implemented**
- `GET /api/documents/content?source=…&path=…` (`app/api/docs.py`, `DocContent` in `app/schemas.py`) — DB-only lookup, 404 `{detail:"document not found"}`, `format` from lowercased suffix (`text` fallback)
- Extracted the escape-first markdown renderer to `frontend/assets/markdown.js` (classic script, relative `<script src>` on `index.html` + `document.html`); rendering unchanged
- New dark-themed viewer page `frontend/document.html` + `document.js`: back link (history-aware), title, meta badges (source/format/mono path/indexed/chunks), md → ≤46rem rendered column, other formats → escaped `<pre class="doc-raw">`, designed 404 not-found card, landmarks/skip-link/`aria-live`/focus-to-main
- Chat source chips + Sources-table path links → viewer in a new tab (`target="_blank" rel="noopener"`, percent-encoded URLs); no-CDN + emoji guards extended to the viewer; README UI section

**Verification**
- `uv run pytest --cov=app --cov-report=term-missing` → 201 passed, **99%** on `app/` (>90%)
- `uv run ruff check .` → clean; `uv run pyright` → 0 errors
- `uv run pytest tests/e2e/test_document_viewer.py -v --no-cov` → 5 passed (isolated)
- All 9 existing story E2E suites re-run in isolation → all pass (incl. XSS-proofing E2E: `<script>` fixture renders escaped, no dialog)

**Notable**
- E2E source values are `docs` (imported-dir basename) with slash-bearing paths — exactly what the query encoding handles; updated the now-stale chip-href assertion in the phase-03 suite (`/sources.html` → encoded viewer URL) and kept the cell-level `title` (phase-02 contract) alongside the link's.

**Next pending phase:** none — `10_story_document_viewer.md` was the last in `todo/` (roadmap complete).