# Proof audit PASS1 — paused sidebar video

Scope: [#23089](https://git.cafe/pingdotgg/t3code/issues/23089), branch `fix/issue-23089`, worktree `/home/ubuntu/wt/issue-23089`. Before: [968dd51](https://git.cafe/pingdotgg/t3code/commit/968dd51704441138559a3fe9c348719f2b11e0c6). After: [d8d6747](https://git.cafe/pingdotgg/t3code/commit/d8d674784e4279e847b450e5908dc29db17a6be0). Lead updated the pinned pair after merging current main without conflicts. The seven-file fix diff is identical; before is now the actual merge-base of the integrated head. Capture exactly this pair.

This is a capture plan, not certification that captures or tests passed. Read complete seven-file diff, component implementations, callers, asset refresh/state plumbing, server asset branches, reproduction notes and fake-provider script. No browser, server, tests, repository edits, commits, or forge comments were performed in PASS1. Only this authorized scratch artifact is written.

## Assumptions and rendering contract

- Shared web runtime is the visible surface. Desktop shell and native mobile are unchanged; neither requires its own runtime capture. Provider adapters, MCP/scheduling, settings, command palette and keybindings are unchanged. File-link and file-browser entry points converge on `RightPanelSurfaceContent` → `FilePreviewPanel` → `WorkspaceVideoPreview`.
- Required rendering combinations C: 1440×900 light; 1440×900 dark; 390×844 light; 390×844 dark, CSS pixels. Use the same browser/tool and exact browser version before/after; state them in the deliverable. Specify no device emulation, DPR 1, browser zoom 100%, default OS/font scaling 100%, no mobile text inflation. If the capture tool requires different settings, declare actual values and use them identically on both sides and PASS2 recapture. Narrow width means web responsive layout, not native mobile.
- Full app viewport/panel, identical panel size, scroll, fixture names, MP4 bytes, initial player state, theme, font availability and action sequence. Keep the active tab foreground. Separate before/after worktrees at pinned SHAs, fresh clean threads, own browser tabs and isolated `.t3` data. Parent's existing 6606/14646 server is context only; do not relabel its current head as before or reuse its failed-setup thread.
- Real app seed: copy original MP4 into each sandbox's same relative `.t3/fixture.mp4`; configure only sandbox settings with a public-safe adaptation of `/tmp/issue-23089-codex159.mjs`. First genuine provider turn emits a normal file link; click it into the sidebar. Following provider turns actually execute `wc -l README.md` and `head -n 5 README.md`, reporting command items through the normal provider/orchestration path. No injected workspace mutation/projection is a substitute. The existing script hardcodes the old worktree in its emitted link: adapt cwd/link per sandbox before capturing and disclose that adaptation.
- Original MP4 SHA256: `0cd83d944a6ca7822b4a8306cecc60a36e859b041f6702c6a1ad9ead78924451` (5.055s). Changed MP4: `b670602fa00934ca27c4351bb0efe7ea7a07fae57284e44226025eeed7c51254` (52.208333s). Files currently `/tmp/23089-original.mp4` and `/tmp/23089-changed.mp4`. Original's near-end seek is 5.0s: explicitly confirm paused before commands, do not let ended/playback races substitute for the paused case. Initial 'paused0' means first-frame initialization near 0.1s, not an exact-zero assertion.

## Matrix (six rows)

| ID / fixture | Diff reach and data | Real-app seed / scripted sequence and required observation | Minimum evidence / test boundary |
|---|---|---|---|
| R1 — unchanged paused0 → paused5 | Directly affected: `WorkspaceVideoPreview` now uses server revision and `MediaVideoPlayer` pins at metadata load. Covers metadata-loading → first frame, already-played paused state, repeated re-signing with unchanged bytes. | Open linked original MP4, show initially paused near 0.1s. Run the two actual read-only commands, separately, through fake provider; wait for each completed turn and resulting refresh. Play, seek 5.0s, pause; repeat the two commands. Show full panel and command completion. After should preserve frame/playhead and avoid new emptied/loadstart cycles in both paused stages; before should expose reported reload/reset. Capture initial metadata load too. Correlate a read-only media-event/currentTime/src log with recording; hash file before/after. | **Recording**, matched before/after at all four C combinations. R1–R3 can be chapters of the SAME four recording pairs (8 files total), with timestamps, rather than separate clips per stage. Existing browser regression covers nonzero same-revision source retention, but generated WebM component test does not replace real-app MP4 recording. |
| R2 — real changes while paused | Directly affected: revision changes on dev/inode/size/mtimeNs/ctimeNs; suffix/revision reaches player. In-place write and atomic replacement are distinct server identity paths. | Continue R1 sequence: at a paused nonzero position, overwrite fixture IN PLACE with changed valid MP4, preserving inode, then complete command to refresh. Observe new scene/duration. Restore original, settle, seek/pause again, then write changed MP4 to sibling and atomically rename over fixture, confirm inode changed, complete command and observe changed content. Same order/bytes/timing milestones on both SHAs. Record stat/hash transcript. No claim of exactly one reload unless event trace proves it. | **Recording**, chapters in same four C pairs. Existing new `AssetAccess` test checks same revision/re-sign, in-place revision change and same-content atomic replacement revision change; existing adjacent test checks old token readability/replacement rejection. Focused tests can prove same-content replacement identity without adding another visual permutation. They are inspected, not run by PASS1. |
| R3 — active playback defers revision adoption | Affected shared state transition: loaded source held while `playingVideo === video`, released on pause/ended when revision differs. | Continue with a stable longer changed clip, play, replace with original while active and complete command; visibly retain playing source until pause, then adopt original. Use same file-operation sequence both sides and ensure playback has not naturally ended before the command. Show old/new duration plus correlated source/revision events. `ended` is an equivalent release transition suitable for a focused test, not another width/theme permutation. | **Recording**, chapter in same four C pairs. Existing browser test does NOT cover active change, pause deferral or ended; if not recorded, mark active deferral unverified. Add/execute focused behavioral test in implementation phase for ended if claiming it verified. |
| R4 — remaining shared-player callers, plus draft sidebar | Indirectly affected metadata pinning: `ChatMarkdownVideo` (local signed asset with stable `mediaIdentity`, direct remote/attachment markdown with copyMarkdown/src key); `UserVideoAttachment` (visible preload, muted no-controls onOpen overlay); `ExpandedVideo` (metadata preload, asset or direct src, autoplay default true); `PullRequestGitHubVideo` and direct-video branch in `PullRequestMarkdown` (visible preload, revision omitted). Draft sidebar uses absolute `draft-workspace-file` and changed server finalizer. All non-sidebar callers omit revision, defaulting to null: do not claim actual-file revision tracking there. | In sandbox, same MP4: emit embedded local-video markdown as well as ordinary link, include stable direct media URL variant; attach MP4 to a normal user message, scroll thumbnail into view and open expanded dialog, play/seek/pause, close/reopen. Open same file in an unsent draft via file browser to exercise absolute draft resource. PR markdown appears in summary/editor, timeline/comments, review annotations and guide prose via the same `PullRequestMarkdown`; consolidate equivalent containers, but show both signed GitHub-media and direct video if seeded. Existing copied PR record/unsaved editor or local read-only fixture source may seed without publishing; that route is NOT established here. No forge writes. | **Recording**, one caller-sweep before/after per C combination (may append to R1–R3 recordings). Include offscreen→visible thumbnail, initial load, autoplay/no-autoplay and controls/overlay. PR subpaths not seeded must be explicitly unverified, not silently treated as covered by sidebar. Focused player tests can cover no-revision retention and preload branches; not a substitute for claiming real-app caller captures. Draft null mutation vs post-command mutation shares layout, so one draft smoke is sufficient within sweep. |
| R5 — stale held URL, then latest failure/retry | Reachable from newly pinned paused sources: `onError` releases held stale URL when latest differs; latest failure shows alert+retry for controls player, overlay remains for onOpen caller; loading src null/sourceFailed paths unchanged markup. | Retain original source, obtain new signed URL without changing revision, then fail the held media request only (expire or narrowly intercept exact old URL in capture browser), trigger real media reload/read, allow latest request. Show recovery to latest with no lasting alert. Then fail latest as well, show unavailable/Retry video, remove fault, retry. Publish exact fault-injection method; never block all asset routes indiscriminately. Natural token expiration need not be waited out. | **Recording** if real-app recovery/error UI is claimed, proportionate supplementary pair at 1440/light; repeat narrow/dark only if distinct layout problem appears. Can instead be **focused tests only**, with runtime recovery explicitly unverified. Existing browser test revokes held object URL and checks latest src/no alert; it does not prove real signed-token expiry, successful decoding of renewed source, or latest-failure/retry completion. Server token tests cover identity rejection. Do not mistake src assertion for playback proof. |
| R6 — older-server fallback and transport branches | Direct compatibility branch in sidebar: optional revision absent → workspaceMutationId (null/non-null), URL query suffix `?`/`&`. Asset state propagation and optional contract field; server revision applies to media-file and absolute draft-workspace-file only. Ordinary workspace-file, relative draft, attachment, remote/GitHub assets omit revision. Image/audio/HTML/PDF views retain their existing source logic. | Focused state/schema/server tests can prove revision present/absent propagation and fallback/suffix behavior. For runtime claim, real app response interception strips ONLY optional revision, then execute R1 sequence against normal asset service; label mixed-version simulation. Expected old conservative refresh remains; do not demand retention without a revision. Include ordinary file-kind negative assertions in focused tests rather than a media-layout cross-product. | **Recording** if mixed-version interaction is demonstrated; otherwise focused tests only and explicitly runtime-unverified. No new compatibility/state-propagation test is present in the inspected diff; do not claim coverage from R1. No additional static visual row required for unchanged non-video surfaces. |

## Minimum capture and interpretation

Four matched before/after real-app recordings cover R1–R3 at C; caller sweep R4 can be appended to each, avoiding separate per-event/per-command recordings. Each must show opening the same MP4, play, seek, pause and two real read-only commands, plus unchanged/changed media chapters. R5–R6 may be scoped to focused tests with the precise runtime limitations above; any claimed interaction/time proof requires a recording. This small state fix does not justify multiplying command kind × provider × path spelling × independent loading stages × all callers' container locations. Providers only drive the common completed-command invalidation; no provider adapter changed.

No standalone static rows are required. If still frames are extracted for Before | After comparisons, use matched milestones and full viewport, label both SHAs and C settings, and provide TWO diff images per pair: threshold 0 (any pixel delta amplified) and an explicit per-channel threshold, suggested N=16/255. State exact algorithm/units. Never infer absence of timed reloads from a still or 'nothing else changed' from threshold 16. Native controls, playhead and command timestamps are dynamic: explain each delta; identical event milestones are more useful than pretending wall-clock video frames align. Include a written 'what else changed' list tied to recording timestamps/diff images. Missing captures remain unverified in PASS2.

Publish public-safe seed/provider/capture scripts, fixture bytes or stable public downloads with hashes, operation/stat/event transcripts and rendering contract as linked evidence; DO NOT commit evidence fixtures or scripts. User's explicit no-commit direction is compatible with EVIDENCE.md's linked-from-PR alternative and overrides the brief's committed-fixture wording. Strip auth, pairing URLs, private thread content and fake-provider raw request logs before uploads. Existing repro recordings contain failed setup turns and are leads, not final evidence.

PASS1 public-upload gate checked 2026-10-21 about 21:42 UTC using `cafe issue view 23089 --repo pingdotgg/t3code --json` and `cafe issue comments 23089 --repo pingdotgg/t3code --json`: comments list empty, `next:null`, `truncated:false`; no MEMBER/OWNER comment within prior 24 hours. No upload blocker observed.

FRICTION: baseline | current local main merge-base differs from supplied pinned before SHA | capture exact supplied SHA and label it; do not silently update base.
FRICTION: fixture portability | fake provider emits hardcoded old-worktree absolute link | adapt sandbox cwd and emitted path identically, publish adapted script outside repo.
FRICTION: proof scope | existing tests inspect src and revision but not all real-app timing/recovery | retain recordings for core flow and name focused-test-only/runtime-unverified branches.
FRICTION: caller seeding | signed/direct PR video app seed route not demonstrated | establish a local read-only app seed or explicitly mark those caller paths unverified; no forge mutations.

VERDICT: SUFFICIENT (matrix ready)