[Serph91P]

Summary

Closes #950.

• Keep the displayed recording, video source and every share/download/delete action on the same loaded media identity across both existing route forms, component reuse, history navigation and delayed responses.
• Reset previous recording/dialog/player/action state synchronously. Ignore obsolete load/action completions, including returning to the same ID. Remount only the nested video player; enable actions only after the current media is ready.
• Keep the already-integrated Player deletion attempts navigation to unregistered route name Videos #949 /videos delete destination and login return-navigation fix intact. Both additive REAL regression steps remain in CI.
• B1: emit the unchanged static player glyph geometry as a hashed SVG asset using Vite's standard ?no-inline. No player-script/style changes in B1, no changed dependencies/chunking/compression/budgets. The asset is included in total output and offline precache.

Final delivery / current develop acceptance

Regularly merged into develop as 9e5d4e1c5a9f493ce1e76fc343931890afef735c. Its genuinely new current pip-audit failure on oauthlib4.0.0 (GHSA-3jp2-3mrg-2vxc/CVE-2026-49272) was fixed by scoped #1046 / PR #1047, regular merge 486899b5325541d0327c68c162bf81f2b8c1bf42, exact tested tree 7f580954d5001e78154cb7f1d9a594217fc95e62. Only oauthlib4.0.1/native lock+requirements/one additive floor assertion changed; no other dependency, product, workflow, scanner or gate relaxation. #842 implementation remained untouched.

Final acceptance complete; #950 and #1046 are CLOSED/COMPLETED with all criteria checked. Fresh full actual backend/SQLite/file/download2/share2/delete2/SVG-MIME/SW-offline journey repeated successfully on the correction with locked Python3.14.4/oauthlib4.0.1. Correction CI23/23 success with7RequiredApp15368; all 22 current final-merge checks succeed and three original target pipelines completed/success: Tests42128314090, Security42128314099, existing develop automation42128314084, attempt2. All original counts/gates below were re-executed on the final composition:688units/49foundation/5REALplayer/8login/244mainbrowser+46existingSKIP/1092backend+20existingSKIP/48distinctPGmigrations/stablekey/HTTPsurface, REAL+MOCK budgets and both UX06 measurements.

Actual current original Security reports: pip 75/0skip/0vuln; npm 18moderate/2low/0high-critical (earlier25moderate below is historical), Bandit0H/2M/66L/1skip,5existingDockerfilealerts. TrivyHC passes with existing SBOM/EOL warnings. GitleaksPR1047 scanned1commit/735bytes without findings; final merge scan0bytes, neither establishes full-tree cleanliness. Unchanged native CI retries handled a slow AzureAPT install and a SARIF upload interruption; no failure/timeout is presented as a pass. The original oauthlib4.0.0 postmerge runs remain historical RED, superseded by the verified corrected develop evidence. See closing acceptance. No manual release or deployment; #900/#943/#842/overall completion remain open.

Premerge integrated verification (historical exact head)

Base develop@0fa9ee5e087021c7387d30abd02a065ce0dfe110; head 845ced0e02020709844f4a7deb88664e5c246ea0; tree bad3908d8d810e85a02c190b34ca3b007b41e0aa. This head contains the completed #1042/PR1043, PR974, #946/PR1044 and foundation integrations. The GitHub CI merge tree matches the tested tree.

• Fresh owner run: 688 units passed / 4 existing mode skips, 49 foundation tests passed; types, ESLint (0 errors / 135 existing warnings), design tokens and generated foundation output passed.
• 5 REAL Chromium cases passed: the four original route/race/history/reset cases and exact glyph geometry/rendering/MIME regression. Independent initial review and bounded B1 review approved without findings. Original cross-engine glyph comparisons remain verified evidence, not a new device/platform acceptance claim.
• Two deterministic MOCK builds: 85 files. Fresh explicit REAL/MOCK provenance, output/precache, unchanged raw/gzip/HLS/aggregate budgets and both actual UX06 loading measurements passed. Application JS: MOCK 1,196,483 raw / 380,556 gzip; REAL 1,193,366 / 379,615. Limits remain 1,196,533 / 381,000. MOCK reserve is only 50 raw / 444 gzip bytes.
• Fresh real-backend browser journey: actual app factory/auth/video/stream routers and cleanup worker, Python 3.14.4 locked dependencies, ffmpeg-generated disposable SQLite/three MP4 fixtures, network-isolated browser container, zero API response fulfills. Decoded playback, both route forms and back/forward without document reload; downloaded file-2 SHA256 matched source-2; exactly share-2/delete-2. Independent SQLite readback retained streams/metadata [1,3] and share target 2; file 2 removed, files 1 and 3 retained with unchanged hashes; successful /videos destination; zero page errors.
• B1 actual-backend delivery: hashed SVG returned image/svg+xml, 1,914 bytes, byte-identical to source and served HTTP 200 offline from the installed service worker.
• 23/23 exact-head checks passed, including 7 required GitHub Actions checks (App 15368). Original logs read: Tests, Security, existing PR automation. Backend 1092 passed / 20 skipped / 2 subtests, 12 migration tests; main browser suite 244 passed / 46 existing skips; foundation browser 6+1+6; both applications healthy after concurrent fresh PostgreSQL boot, 48/48 distinct successful migrations, persisted key unchanged after restart, HTTP surface passed.

Security and limits

Original current reports compared with the matching base's Security run. npm findings are identical: 25 moderate / 2 low / 0 high or critical; pip audit 75 dependencies / 0 skipped / 0 vulnerabilities; Bandit 0 high / 2 medium / 66 low / 1 existing skip, identical apart from generation time. Trivy HIGH/CRITICAL gates pass; SBOM/EOL-detection warning limits remain. Gitleaks SARIF has zero results, but the original scan reports zero scanned bytes: not a full-tree secrets-clean claim. Five existing Dockerfile alerts on main and six original Hadolint log messages remain; no suppressions, alert dismissals or all-clean claim. Existing broader security work remains separate.

Only #950 is being delivered. #900 original reload/draft preservation, #943 operational acceptance, provider/physical-device/production-PWA acceptance and overall open-issue completion are not declared solved. No manual release or deployment is requested or performed; the existing develop automation remains unchanged.

Historical evidence (not current counts)

At the original independently reviewed head b671475f, 443 units / 44 foundation / 4 REAL player cases and 22 checks passed; base RED reproduced 8 unit and 4 browser failures. Subsequent integration exceeded the original unchanged MOCK budget and was not accepted. The independent B1 review reproduced current inline-control RED 1,197,423 raw / 381,216 gzip, then verified the current external-asset GREEN measurements above. Earlier test/security counts are historical only.