fix(web): paused sidebar videos keep their place during commands#23127

Problem

A local MP4 paused in the sidebar reloads when unrelated read-only agent commands complete. A video paused at five seconds resets to the first-frame preview even though its bytes have not changed.

Change

Return an optional revision from the media file's existing open-file stats and use it for the sidebar video's revision. Keep the loaded video source across unchanged revisions and URL re-signing, while retaining real-file updates, active-playback deferral, retry, and stale-source recovery. Older servers retain the existing workspace-change fallback. HTML, PDF, audio, and image refresh behavior is unchanged.

Scope and approval

Fixes #23089 GitCafe: https://git.cafe/pingdotgg/t3code/issues/23089 Triaged bug via the automated issue flow. Reproduced in the real web app on Linux using a fake provider that executes two actual read-only shell commands. The fix changes media refresh state and optional result metadata; signing claims and authorization are unchanged.

Verification

• Red-first Chromium regression failed on main: a new URL for unchanged paused media replaced its loaded source. It passes on the fixed head, including stale-source fallback and changed revisions.
• Whole focused files: AssetAccess.test.ts (25), client-runtime assets.test.ts (1), FilePreviewPanel.test.ts (13), and MediaVideoPlayer.browser.test.tsx (1): 40 tests pass.
• Scoped typechecks: contracts, client-runtime, server, web: pass.
• Targeted lint: pass with one pre-existing no-inline-schema-compile warning outside the changed test. Scoped Knip exports check and git diff --check: pass.
• Two independent code reviews: Codex GPT-6.1-Sol and Claude Opus 5.5 returned MERGE; evidence is checked separately below.

Independent proof audit: SUFFICIENT against the six-row matrix. Full evidence index. Before is merge-base 968dd51704441138559a3fe9c348719f2b11e0c6; after is d8d674784e4279e847b450e5908dc29db17a6be0. Real Linux web app, Chrome154, DPR2, 1440×900 and390×844, light and dark. Separate worktrees and isolated state; same MP4 and scripted commands.

Core result: unchanged paused video remains at5s with zero emptied/loadstart events after four read-only turns; baseline resets to0.1s. Real edits and atomic replacements update the preview; active playback defers the update until pause.

Limitations: desktop/Electron and native mobile were not run. Signed/direct PR video callers, ended release, true signed-token expiry/retry, older-server no-revision fallback and remote/tunnel propagation are runtime-unverified. R5 has focused object-URL test coverage; R6 has no dedicated compatibility test. Caller desktop-light frames differ despite equal paused2s event state; no decoded-frame equality is claimed. These gaps were disclosed to the proof auditor.

R1–R3 recordings and full-viewport milestone sheets

Every row below covers R1, R2 and R3 as chapters in the same recording. SHA under Before is 968dd51704441138559a3fe9c348719f2b11e0c6; under After is d8d674784e4279e847b450e5908dc29db17a6be0. The sheets stack four whole frames: initialized, after unchanged paused5 commands, changed-file refresh, active-play edit. They supplement the recordings; a still cannot prove reload absence.

Actual unchanged-stage event counts (after initial load, four read-only turns):

The baseline event totals include intermediate source churn and canceled/coalesced loads from completed commands and checkpoints. They are observations from these runs, not a claim of exactly two loads per command. All final after traces retain source-1 through R1; actual changes adopt sources2/3/4, and source4 persists throughout active playback until pause releases it to source5. Stat hashes remain original across the unchanged stage.

R4 caller recordings

R4 sweeps start before the user upload/send, then local and remote markdown playback/seek2/pause, attachment offscreen→visible, expanded autoplay/seek2/pause/close/reopen. The attachment remains muted, controls=false, preload=metadata; markdown players controls=true. Draft recording opens Files→.t3/fixture.mp4 in an unsent draft and seeks/pauses2s. Draft smoke is one equivalent layout at1440/light as the matrix permits. PR container variants cannot be certified by these chat callers.

Core chapter index (visible caption clock)

Full caller and draft chapter timestamps: chapters.md.

What else changed

Diff algorithm: per pixel maximum absolute R/G/B channel difference; bright magenta if >0 or >16 8-bit levels (16/255), black otherwise. No alignment, masking, crop, or subthreshold-equality claim. SHA headers themselves differ and are included. Exact sampled times, native frame sizes and differing-pixel counts are in the linked manifest/bundle.

• Intended R1 difference: baseline transient blank/loading frames and resets to first preview frame; after stays on the selected flower frame at5s. Source IDs differ after baseline churn. This changes video contents/playhead/controls timing, not panel styling. See each core recording’s R1 captions and first two sheet frames.
• R2: both replace flower with Sintel and duration5.055→52.208333; reset/loading moments vary. The scene near Sintel’s opening is dark; black or spinner stills are transient refresh samples, not proof of failed decoding. Confirm loadedmetadata/ready4 in the event logs and later playback chapter.
• R3: both retain the long clip while playing, then return to flower on pause. Exact animated frames differ because playback/command completion timing is not frozen. The ended route was not exercised.
• Sandbox UI: before breadcrumb/project is issue-23089-before; after is issue-23089. Detached baseline versus fix branch labels and sandbox change counts can differ when their panels are visible. Main sidebar is hidden for core/draft. Caller sweeps may show sandbox file/change sidebar; after contains the seven-file +138/−5 fix while baseline has0. No maintainer projects/private threads are seeded.
• R4 desktop-light: local signed markdown has currentTime2/ready4 in both logs, but the sampled after image resembles the initial flower frame while before shows the2s frame. Native controls differ too. The cause (rendering/capture timing versus player behavior) is not established; do not certify frame equality from these captures.
• Time labels, relative ages, worked durations, step elapsed captions, source-ID counts, focus/cursor/hover and native control visibility differ. Browser recording start/stream lag differs slightly. Chat scroll follows the same steps but small content/timing differences shift lines. R4 local/remote videos can show briefly loading at different encoded frames. These are unmasked in both diffs.
• The capture-only bottom caption and SHA headers are added identically but contain different elapsed times/SHAs/source observations. They can cover the lower composer edge. These are not shipped UI changes.
• No new product labels, colors, layout, typography or controls are introduced by the fix. This statement is based on the seven-file diff; unmasked image deltas are not all attributable to the feature. Non-feature differences above mean strict frozen-clock evidence equality was not achieved and requires PASS2 judgment.

Rebuildable public data and checks

Original: 23089-original.mp4 — SHA256 0cd83d944a6ca7822b4a8306cecc60a36e859b041f6702c6a1ad9ead78924451,5.055s. Changed: 23089-changed.mp4 — SHA256 b670602fa00934ca27c4351bb0efe7ea7a07fae57284e44226025eeed7c51254,52.208333s. Original is MDN flower; changed is W3 Sintel trailer.

public-evidence-bundle.zip contains public-safe provider adaptations, capture scripts, file-operation/stat/hash transcripts, media events with source IDs only, persisted read-only-command outputs, chapter timestamps, rendering manifest, test outputs and SHA256 inventory. chapters.md provides every narrated step/time. sheets-manifest.json lists every extracted frame/time/diff count. No raw signed URLs, credentials, private thread content, databases or server logs are included.

Focused commands (after checkout’s own vp, Vitest5.0.5): cd apps/server && ../../node_modules/.bin/vp test run src/assets/AssetAccess.test.ts (25 pass); cd apps/web && ../../node_modules/.bin/vp test run src/components/media/MediaVideoPlayer.browser.test.tsx (1 pass); cd apps/web && ../../node_modules/.bin/vp test run src/components/files/FilePreviewPanel.test.ts (13 pass). No repo-wide checks. The player test uses generated WebM/object URLs and asserts source retention, revision replacement, revoked-held-URL fallback src/no alert. It does not establish live signed-URL recovery/decoding.

Implemented by Claude Opus 5.5 through Claude Agent SDK; triage, verification and independent review by GPT-6.1-Sol through Codex.