Document the grid source rules

CURRENT.md

@@ -40,6 +40,12 @@ mobile draft at 390px.
   - [x] C11 preview caching: Discord-hosted image/GIF previews (WebP 320px, hash-addressed, 5 MiB
     cap, one attempt) run after every walk in both modes. Live run `...-20260916090722`:
     `previewed: 2`; thumbs served over `/api/media/<scrape>/<item>/thumb` (200).
+  - [x] C23 Grid and viewer source fixes. The grid now prefers the cached still (or local file) for
+    every kind, and only falls back to a first-frame video, served through the same-origin stream
+    endpoint instead of hotlinked CDN/redirector URLs (fixes fxtwitter/YouTube previews that ORB
+    blocked while the cached thumb sat unused). The viewer shows a muted first frame for videos
+    without a still, and stream refreshes the signed URL only when the stored one fails (4xx). Live:
+    stream returned 206 video/webm for a thumbnail-less video; YouTube rows keep their cached thumb.
   - [x] C22 Media grid polish: per-kind status row
     (`(Images/Videos) | Downloaded I/V | Cached I/V | Loaded I/V`), GIF tiles with a translucent
     GIF label that play the animated original on hover (cached previews are static ffmpeg frames),

docs/media.md

@@ -155,9 +155,11 @@ that deletion is irreversible. The delete button is disabled for a 5 second coun
   play icon top-right. The play action embeds a YouTube, Vimeo, Twitch, or Streamable player, or
   plays a direct mp4/webm/m4v; when neither is possible it opens the external-site warning, since
   the page is the only way to watch. Playback and **View full** go through
-  `/api/media/<scrape>/<item>/stream`, which serves the local file or re-fetches the source message
-  for a fresh signed URL, so expired CDN links still play. Embed `videoUrl`s (gifv/Tenor mp4s) are
-  stored as `play_url` and used directly. The full link is a separate button that opens the
+  `  /api/media/<scrape>/<item>/stream`, which serves the local file or re-fetches the source message
+  for a fresh signed URL, so expired CDN links still play. The grid prefers the cached still; a
+  video without one gets its first frame through the same-origin stream endpoint, which avoids
+  cross-origin blocking and URL expiry. Embed `videoUrl`s (gifv/Tenor mp4s) are stored as
+  `play_url` and used through the stream. The full link is a separate button that opens the
   original page with the warning. Length comes from Discord's attachment duration and, for
   downloads, an ffprobe probe. GIF tiles carry a translucent **GIF** label top-left; the cached
   preview is a static frame and the animated GIF plays while hovering. The status row reads