# PLAY3 verification

The fix preserves a native seek made after natural completion on both Play paths. `play()` and `resume()` reconcile native movement before reading the player snapshot. The existing movement reconciler changes `ended` to `paused` when the media moved. Target selection, persistence, and public interfaces retain their existing rules.

The production diff adds five lines and removes two in `PlayerController.ts`. The other changes are controller tests and four Obsidian journeys. There are no UI, schema, API, URI, or quit-handler changes.

## Runtime reproduction and recovery

Baseline commit `311fe480503bae2c2200f513742b09d0205111df` failed all four cases on Linux in isolated Obsidian 1.14.4. The cases cover the player button and direct controller `play()`, both before native events and after those events before the checkpoint. The test fixture serves a 60-second WAV in the `Position Edges` feed at `http://podnotes.test:<ephemeral port>/position-edges/feed.xml`.

For Play before events, the observed output changed as follows.

```text
#465 player button, events delivered=false: {"before":60,"seek":12,"after":0}
#465 player button, events delivered=false: {"before":60,"seek":12,"after":12}
```

For Play after events, `before` is 12 and `after` changes from 0 to 12. Each fixed journey then confirms playback advances from 12 and pauses with unfinished progress persisted between 12 and 15 seconds. Existing sync journeys also pass, including restart at zero with no newer progress and resume at 30 with an unfinished synced record.

The screenshot probe uses the 60-second `Fixtures/Local Fixture.wav` in this worktree's isolated vault. It lets playback finish naturally, assigns native time 12, presses the player button in the same JavaScript task, then pauses. The before screenshot shows 0:00. The after screenshot shows 0:12. Both screenshots were opened and inspected.

Additional runtime probes confirm that Play between `media.load()` and its queued `emptied` event preserves 12 seconds on both paths. Native readiness is zero and native time is zero immediately after reset, then playback recovers at 12.008218 and 12.018543. A natural finish emitted `pause` before `ended`, both at 60 seconds with `ended === true`. This supports excluding a proposed extra end-handler cleanup.

Commands for the focused run and evidence are recorded below.

```sh
TMPDIR=/data/home/tmp/podnotes-play3 fnm exec --using 22 -- npm run test:e2e -- tests/e2e/playback-position-edges.test.ts tests/e2e/synced-progress-handoff.test.ts
TMPDIR=/data/home/tmp/podnotes-play3 fnm exec --using 22 -- node .obsidian-e2e-artifacts/play3/normal-session.mjs fixed
TMPDIR=/data/home/tmp/podnotes-play3 fnm exec --using 22 -- node .obsidian-e2e-artifacts/play3/repro-screen.mjs after
TMPDIR=/data/home/tmp/podnotes-play3 fnm exec --using 22 -- node .obsidian-e2e-artifacts/play3/runtime-guards.mjs
```

The initial focused run passed all nine tests. After the test-only review correction, a fresh Claude Opus 5.5 delegate passed the same nine final journeys on 1.14.4 and all 190 tests on a fresh 1.13.7 vault. Runtime errors are checked by the existing harness, including its persistent uncaught-renderer-error journal.

## Application checks

Node v22.23.2 runs all npm commands through `fnm exec --using 22`. All eight acceptance commands exited zero.

| Command | Result |
| --- | --- |
| `npm run lint` | Passed |
| `npm run format:check` | Passed |
| `npm run typecheck` | Passed |
| `npm run build` | Passed |
| `npm run test` | 2,570 tests in 122 files passed, Svelte checks passed |
| `npm run test:tooling` | 13 tests in two files passed |
| `npm run docs:build` | 18 pages built, 112 legacy fragments resolve |
| `npm run size` | Passed |

The production bundle changed from 312,126 to 312,213 raw bytes, an increase of 87. Level-9 gzip changed from 99,037 to 99,051 bytes, an increase of 14. The 100,000-byte gzip gate has 949 bytes remaining. These are deterministic artifact sizes, not performance claims.

The same normal listening session produced three attempted and three completed `data.json` writes before and after, with zero failures or in-flight writes. Each side ran once. The recorder wrapped the adapter's exact plugin data path and remained intact, with no plugin reload. The session played for 12 seconds, paused, sought 30, played two seconds, and paused. Final observed time was 31.940207 on master and 31.97439 after the fix. This verifies the write count for that session, not all possible sessions.

## Regression tests and mutations

Seven regression cases failed on unchanged source. Four cover both Play paths and both event timings. The others cover a dirty native seek beating sync, automatic queueing after a native seek, and a finished video's native seek surviving reset. Ten additional guard cases pass on master and protect existing contracts. The final test-first commit was run against unchanged source and produced seven failures and 158 passes across all 165 controller cases, including both later reset guards. This is a disclosed exception to the brief's request that every new unit test fail on master.

The mutation driver applies each wrong alternative independently, runs the controller suite, restores the fixed source in `finally`, and exits nonzero if a mutant survives or has no named test failures. All eleven mutants fail. `mutants-final.log` lists every failing test.

| Wrong alternative | Named failing test |
| --- | --- |
| no reconcile in play() | synced progress handoff > play() of the same episode after a natural end starts at a seek from the browser's controls whose events have not arrived (#465) |
| no reconcile in resume() | synced progress handoff > resume() after a natural end starts at a seek from the browser's controls whose events have not arrived (#465) |
| reconcile without normalizing ended to paused | synced progress handoff > resume() after a natural end starts at a seek from the browser's controls whose events have not arrived (#465) |
| normalize only, no reconcile in play() or resume() | synced progress handoff > resume() after a natural end starts at a seek from the browser's controls whose events have not arrived (#465) |
| play() reads its status before reconciling | synced progress handoff > play() of the same episode after a natural end starts at a seek from the browser's controls whose events have not arrived (#465) |
| play() reconciles before validating its options | synced progress handoff > play() rejecting a negative time after a natural end leaves the player as it was |
| target selection: ended && !moved, with restartTime honoring moved | switching episodes (#353) > saves and queues an episode that a seek from the browser's controls moved after its natural end |
| ended Play uses the element's position | synced progress handoff > resume() after a natural end continues a re-listen synced afterwards (#463) |
| a local move beats an explicit time | synced progress handoff > play() with a time of 0 after a natural end starts there, not at a seek from the browser's controls |
| noteStoppedMove without holdsMedia() | synced progress handoff > resume() before a reset element reports emptied preserves the position |
| noteStoppedMove checks a session instead of holdsMedia() | synced progress handoff > resume() before a reset element reports emptied preserves the position |

## Quit-position issue #436 remains open

A real quit and restart on master restored 0.784822 seconds after quitting at 2.994167 seconds, losing 2.209345 seconds. A synchronous localStorage record survived that clean restart. This proves the storage candidate for that path, but not a safe adoption policy.

Saved episode progress contains no timestamp or revision. A local timestamp or `data.json` modification time cannot order progress from two devices. Comparing a recovery tail to the current store checkpoint is also insufficient because the store can be ahead of the last completed write. That completed base belongs to `DataFileWriter` and is private.

Writing the local tail into the progress store during startup would mark it as local progress. The atomic local-wins merge could then reject newer sync that arrives after startup. A safer candidate would stay outside the progress store, remain clean, and yield to later sync until playback or another local intent begins. It would need episode and library matching, a comparison with the last completed writer base, consumption and invalidation rules, and writer coordination. That is a separate recovery state with more lifecycle work than this small quit-only fix.

Options for follow-up are a per-device recovery candidate with those rules, or atomic file replacement and quit-task coordination after platform guarantees are established. Neither option should weaken #376's guarantee that no `data.json` write starts after quit or pagehide.

QuickAdd history was checked. Commit `64f8b1d6` for #2195 waits for work already queued at quit. Its base-snapshot merges in `d418f01f` and `46753e48` inform the persistence analysis. No quit localStorage-tail precedent was found.

## Design and review decisions

Independent Claude and GPT designs selected the same existing state transition. The cross-judge chose the three-edit implementation. A target-selector-only alternative was rejected because it misses automatic queueing after a post-end seek. An extra `onEnded` cleanup was excluded after the implementation review identified the real browser's pause event, and the runtime probe confirmed that order.

The no-comments audit found zero added comments, suppressions, or flags. Nothing was deleted or restored, and no encoding or architecture change was needed.

The deslop pass found no added casts, defensive guards, wrappers, or comments to remove. New tests reuse the controller suite's existing helpers. The runtime test uses the project's harness and controls.

Claude Fable 5.1 raised one warning about a wall-clock precondition in the real-app test and one comment nit. The timing warning was resolved by removing that precondition and naming the journey after native seek events. Deterministic unit cases retain the before-checkpoint contract. The comment nit is dismissed because code and behavior tests express the invariant. GPT 6 Astra reported no findings. Neither reviewer found a production defect, and Claude explicitly upheld the #436 deferral.

The cross-model trail audit by Claude Opus 5.5 found missing evidence pointers, two guards without a baseline run, and report wording to correct. These are recorded in `trail-audit.md` and resolved in append-only log rows. The audit did not identify a production or design defect.

## Principle decisions

- Fix Root Causes placed reconciliation before either Play path chooses its target.
- Foundational Thinking and Model the Domain reused `ended` and `paused` instead of adding another playback flag.
- Prove It Works required real Obsidian reproduction and verification on the same controls.
- Explain the Number limited the write-count claim to the identical measured session and checked recorder integrity and actual playback.

## Dispatch ledger

| Step | Provider and model |
| --- | --- |
| How investigation | claudeAgent/claude-opus-5-5 |
| Why investigation | claudeAgent/claude-opus-5-5 |
| Claude design | claudeAgent/claude-fable-5-1 |
| GPT design | codex_pool/gpt-6-astra |
| Design judgment | claudeAgent/claude-opus-5-5 |
| Implementation | claudeAgent/claude-opus-5-5 |
| Comment audit | claudeAgent/claude-opus-5-5 |
| Final Claude review | claudeAgent/claude-fable-5-1 |
| Final GPT review | codex_pool/gpt-6-astra |
| Decision-trail audit | claudeAgent/claude-opus-5-5 |
| Final runtime verification after the review correction | claudeAgent/claude-opus-5-5 |
| Runtime verification | In-thread, required firsthand by the playbook |
| Two reset guards and e2e wait correction | In-thread, small test-only corrections |

The changes are committed on the assigned `fix/position-edges` branch. `origin/master` is the comparison base. The `origin` CLI is unavailable, so GitHub CLI handles PR operations. No published documentation was edited. At the next release, `docs/src/content/docs/podcasts.md` should describe Play after completion, the precedence of a native seek, restart at zero without newer progress, and unfinished synced progress.

## Full fresh-vault run on Obsidian 1.14.4

All 190 tests in 25 files passed. The runner provisioned a fresh vault after the previous fixture vault was archived. The run stopped its instance cleanly. This run preceded the removal of the review-flagged e2e precondition. Production source did not change. The final test version subsequently passed nine focused journeys on 1.14.4 and all 190 tests in 25 files on fresh Obsidian 1.13.7. The independent verifier observed the same 12-second seek result, zero-second finished replay and 30-second synced resume on both versions. No retries or source edits were needed.

## Final state

Head `d2c2bfff891f03643373962fec7c55f915857c85` contains the fix after test commit `3258e03c`. The final tracked tree is clean. A fresh fetch confirmed `origin/master` remains at `311fe480503bae2c2200f513742b09d0205111df`, so no merge was needed. The built bundle still matches `fixed-bundle.sha256` after both Obsidian builds ran it.

Both full app runs stopped their instances. The independent verifier and parent each confirmed the final dry-run has no PIDs for this worktree. Other worktrees were untouched. All delegated tasks are terminal with no pending child runs.

All trail-audit flags are resolved in `audit-resolution.md` and the append-only `decisions.tsv`. No production finding remains. The only follow-up is the deliberately deferred #436 recovery design and the documentation update listed for release.