@tribe-nest/forge 3.41.1 → 3.42.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tribe-nest/forge",
-  "version": "3.41.1",
+  "version": "3.42.0",
   "publishConfig": {
     "access": "public"
   },
@@ -31,7 +31,7 @@
     "@stripe/react-stripe-js": "^3.8.0",
     "@stripe/stripe-js": "^7.6.1",
     "@tanstack/react-query": "^5.62.7",
-    "@tribe-nest/media-client": "^0.1.0",
+    "@tribe-nest/media-client": "^0.2.1",
     "@tribe-nest/media-protocol": "^1.0.0",
     "axios": "^1.7.9",
     "lucide-react": "^0.510.0",

package/src/_tests/publishedResolvability.spec.ts

@@ -30,12 +30,23 @@ import { join } from "path";
  * creator site, while the whole suite stayed green and the starter's release
  * notes announced the feature.
  *
- * So there are two properties here and they are separate:
+ * So there are three properties here and they are separate:
  *
  *  1. every bare import in the published tree names a package the consumer's
  *     install will actually produce (a dependency, or a peer that npm installs
- *     because it is NOT marked optional), and
- *  2. every workspace package Forge depends on is one npm will publish.
+ *     because it is NOT marked optional),
+ *  2. every workspace package Forge depends on is one npm will publish, and
+ *  3. the RANGE Forge declares for a workspace package accepts the version that
+ *     package is actually at.
+ *
+ * The third failed too, and silently. Forge went on declaring
+ * `"@tribe-nest/media-client": "^0.1.0"` after that package moved to `0.2.0`,
+ * and `^0.1.0` does not accept `0.2.x`. Inside the monorepo nothing shows it -
+ * the symlink means every build, every spec and every `check-types` run sees
+ * the 0.2 source - while a creator site resolved 0.1.1 from npm and got a
+ * `useRemoteTrack` that never detached a media element, so a remount left an
+ * orphan still playing the call's audio. The published surface was a minor
+ * version behind the surface the tests were green against.
  *
  * Specs are excluded: they never ship (`files` is `["src"]`, but a consumer
  * never imports a `.spec` file), and they legitimately reach for vitest, jsdom
@@ -47,6 +58,7 @@ const PACKAGES_ROOT = join(FORGE_ROOT, "..");
 
 type PackageJson = {
   name: string;
+  version?: string;
   private?: boolean;
   files?: string[];
   exports?: Record<string, unknown>;
@@ -181,4 +193,70 @@ describe("what a creator site's install has to produce", () => {
   it("still exports the media entry the Forge manifest advertises", () => {
     expect(forge.exports?.["./media"]).toBe("./src/ui/media/index.ts");
   });
+
+  /**
+   * The declared range has to accept the version the package is AT.
+   *
+   * Deliberately hand-rolled rather than reaching for `semver`: this package
+   * declares its dependencies honestly (that is the whole subject of this
+   * file), and `semver` is only present here as somebody else's transitive.
+   * The cost is that only the range forms this repo actually uses are
+   * understood - anything else fails loudly rather than passing vacuously,
+   * which is the right way round for a guard.
+   */
+  const satisfies = (range: string, version: string): boolean => {
+    const parse = (value: string): [number, number, number] => {
+      const parts = value.split(".").map((n) => Number.parseInt(n, 10));
+      if (parts.length !== 3 || parts.some((n) => !Number.isFinite(n))) {
+        throw new Error(`not a plain semver version: ${value}`);
+      }
+      return [parts[0]!, parts[1]!, parts[2]!];
+    };
+    const atLeast = (a: [number, number, number], b: [number, number, number]) =>
+      a[0] !== b[0] ? a[0] > b[0] : a[1] !== b[1] ? a[1] > b[1] : a[2] >= b[2];
+
+    const [major, minor, patch] = parse(version);
+    if (range === "*") return true;
+    if (/^\d/.test(range)) return range === version; // exact pin
+    if (range.startsWith("^")) {
+      const floor = parse(range.slice(1));
+      if (!atLeast([major, minor, patch], floor)) return false;
+      // Caret on a 0.x version pins the MINOR, which is where a pre-1.0
+      // package puts its breaking changes. `^0.1.0` does not accept `0.2.0`,
+      // and that is exactly the case this test exists for.
+      return floor[0] === 0 ? minor === floor[1] : major === floor[0];
+    }
+    throw new Error(`unsupported range form "${range}" - teach this helper before using it`);
+  };
+
+  it("declares a range that accepts each workspace package's current version", () => {
+    const workspaceDeps = Object.entries(forge.dependencies ?? {}).filter(([name]) =>
+      name.startsWith("@tribe-nest/"),
+    );
+    expect(workspaceDeps.length).toBeGreaterThan(0);
+
+    const stale = workspaceDeps
+      .map(([name, range]) => {
+        const dependency = readPackage(join(PACKAGES_ROOT, name.replace("@tribe-nest/", "")));
+        return { name, range, version: dependency.version };
+      })
+      .filter(({ range, version }) => !satisfies(range, version!))
+      .map(({ name, range, version }) => `${name}: declared ${range}, package is at ${version}`);
+
+    expect(stale).toEqual([]);
+  });
+
+  it("the range check itself knows that a 0.x caret pins the minor", () => {
+    // Without this the test above is only as good as a helper nobody checked,
+    // and the bug it guards is precisely a 0.x caret being read as permissive.
+    expect(satisfies("^0.1.0", "0.1.1")).toBe(true);
+    expect(satisfies("^0.1.0", "0.2.0")).toBe(false);
+    expect(satisfies("^0.2.1", "0.2.1")).toBe(true);
+    expect(satisfies("^0.2.1", "0.2.0")).toBe(false);
+    expect(satisfies("^1.0.0", "1.0.1")).toBe(true);
+    expect(satisfies("^1.0.0", "2.0.0")).toBe(false);
+    expect(satisfies("1.0.1", "1.0.1")).toBe(true);
+    expect(satisfies("1.0.1", "1.0.2")).toBe(false);
+    expect(() => satisfies(">=1.0.0", "1.0.0")).toThrow();
+  });
 });

package/src/data/queries/useAuthActions.ts

@@ -1,6 +1,14 @@
 import { useForge } from "../../provider/ForgeProvider";
 import { useMutation } from "@tanstack/react-query";
 
+/**
+ * Where a Forge site's reset-password page lives.
+ *
+ * Every functional page on a code website is under `/i/`, and the emailed link
+ * is built from whatever the site sends here.
+ */
+export const DEFAULT_RESET_PASSWORD_PATH = "/i/reset-password";
+
 // Stateless account actions (no session state) — kept out of PublicAuthContext.
 //
 // ## Why these hit `/public/sessions/*` and not `/public/accounts/*`
@@ -33,8 +41,8 @@ import { useMutation } from "@tanstack/react-query";
 export function useForgotPassword() {
   const { client, profileId } = useForge();
 
-  return useMutation<unknown, unknown, { email: string; origin?: string; profileId?: string }>({
-    mutationFn: async ({ email, origin, profileId: overrideProfileId }) => {
+  return useMutation<unknown, unknown, { email: string; origin?: string; profileId?: string; resetPath?: string }>({
+    mutationFn: async ({ email, origin, profileId: overrideProfileId, resetPath }) => {
       const contextId = overrideProfileId ?? profileId;
       if (!contextId) {
         // Better than posting without it: the endpoint would 400 on schema
@@ -47,6 +55,11 @@ export function useForgotPassword() {
         // The reset link is built server-side from this, and the association
         // endpoint requires it (the global one treated it as optional).
         origin: origin ?? (typeof window !== "undefined" ? window.location.origin : undefined),
+        // And the PATH, because the backend cannot guess it. Its default is
+        // `apps/client`'s `/reset-password`, which does not exist on a code
+        // website - every functional page there is under `/i/`, so the emailed
+        // link 404'd for everyone on the current default storefront.
+        resetPath: resetPath ?? DEFAULT_RESET_PASSWORD_PATH,
       });
       return res.data;
     },

package/src/ui/styled/ForgotPasswordForm.tsx

@@ -6,12 +6,18 @@ import { useForgeTheme } from "../theme/ForgeThemeProvider";
 export interface ForgotPasswordFormProps {
   /** Href for the "Back to login" / "Login" links. */
   loginHref: string;
+  /**
+   * The path the emailed reset link points at, on this site's own origin.
+   * Defaults to `/i/reset-password`, which is where the starter puts it. Pass
+   * one only if the site moved that route.
+   */
+  resetPath?: string;
 }
 
 const msg = (e: unknown) => (e as { response?: { data?: { message?: string } } })?.response?.data?.message;
 
 /** Themed forgot-password request form, built on `useForgotPassword`. */
-export function ForgotPasswordForm({ loginHref }: ForgotPasswordFormProps) {
+export function ForgotPasswordForm({ loginHref, resetPath }: ForgotPasswordFormProps) {
   const t = useForgeT();
   const theme = useForgeTheme();
   const forgotPassword = useForgotPassword();
@@ -50,7 +56,11 @@ export function ForgotPasswordForm({ loginHref }: ForgotPasswordFormProps) {
     setError("");
     setIsSubmitting(true);
     try {
-      await forgotPassword.mutateAsync({ email, origin: window.location.origin });
+      await forgotPassword.mutateAsync({
+        email,
+        origin: window.location.origin,
+        ...(resetPath ? { resetPath } : {}),
+      });
       setIsSuccess(true);
     } catch (err) {
       setError(msg(err) || t("forge.forgot_password_form.error"));

package/src/ui/styled/_tests/broadcastStage.spec.ts

@@ -314,3 +314,44 @@ describe("programTracks", () => {
     expect(tracks.audioProducerIds).toEqual(["a2"]);
   });
 });
+
+describe("the relay lane", () => {
+  const base = {
+    realtimeAvailable: true,
+    credentialsReady: true,
+    credentialsError: null,
+  } as const;
+
+  it("prefers the relay over the plane when both are offered", () => {
+    expect(chooseBroadcastStage({ ...base, moqAvailable: true })).toBe("moq");
+  });
+
+  it("is not a fallback: a working relay is the best lane there is", () => {
+    expect(broadcastFellBack({ ...base, moqAvailable: true })).toBe(false);
+  });
+
+  it("falls to the plane when the relay lane is over and a plane is offered", () => {
+    expect(chooseBroadcastStage({ ...base, moqAvailable: true, moqFailed: true })).toBe("realtime");
+  });
+
+  // The shape of a relay-only instance: `viewer-token` answered with `moq` and
+  // `credentials: null`. Falling to "realtime" here would mount a room that
+  // does not exist and show a black rectangle for ever.
+  it("falls to hls when the relay is over and there is no plane behind it", () => {
+    expect(
+      chooseBroadcastStage({ ...base, moqAvailable: true, moqFailed: true, planeAvailable: false }),
+    ).toBe("hls");
+    expect(
+      broadcastFellBack({ ...base, moqAvailable: true, moqFailed: true, planeAvailable: false }),
+    ).toBe(true);
+  });
+
+  it("still draws nothing while the ticket is in flight", () => {
+    expect(chooseBroadcastStage({ ...base, credentialsReady: false, moqAvailable: true })).toBe("pending");
+  });
+
+  it("leaves every existing caller unchanged", () => {
+    expect(chooseBroadcastStage(base)).toBe("realtime");
+    expect(chooseBroadcastStage({ ...base, realtimeAvailable: false })).toBe("hls");
+  });
+});

package/src/ui/styled/broadcast/BroadcastMoqStage.tsx

@@ -0,0 +1,124 @@
+import { useEffect, useRef } from "react";
+
+/**
+ * The relay stage: a broadcast watched over MoQ.
+ *
+ * The player is a VENDORED bundle (`vendor/moq-watch.bundle.js`), not an npm
+ * dependency, because Forge ships source: its `exports` point at `./src/*.ts`
+ * with no build step, so anything it depends on is something every creator site
+ * has to resolve too, and `@moq/json` peer-depends on zod 4 against this repo's
+ * zod 3. See `scripts/build-moq-player.mjs`.
+ *
+ * Loaded LAZILY by the player, never imported on this file's module path,
+ * for the same reason `BroadcastRealtimeStage` is: Forge renders inside
+ * TanStack Start on Cloudflare Workers, and `@moq/watch` reaches for
+ * WebTransport, WebCodecs and a decoder worker the moment it is evaluated.
+ * An effect is code no server ever runs.
+ *
+ * The element is created imperatively rather than written as JSX because it is
+ * a custom element: JSX would need an ambient declaration in every consuming
+ * app, and `document.createElement` needs none.
+ */
+
+export type BroadcastMoqStageProps = {
+  /** The relay URL with the viewer ticket already on it. */
+  url: string;
+  /** The broadcast name beneath the ticket's root. */
+  name: string;
+  muted: boolean;
+  /**
+   * The lane is over: the player should fall back.
+   *
+   * Reported upward rather than handled here for the same reason the plane
+   * stage reports its room state upward: falling back means unmounting this
+   * component, and a component cannot unmount itself. There is one
+   * `chooseBroadcastStage` and it lives above.
+   */
+  onFailed: (reason: string) => void;
+};
+
+export function BroadcastMoqStage({ url, name, muted, onFailed }: BroadcastMoqStageProps) {
+  const hostRef = useRef<HTMLDivElement>(null);
+  // Held in a ref so the effect below does not re-run when the player
+  // re-renders with a new closure, which would tear down a working player.
+  const onFailedRef = useRef(onFailed);
+  onFailedRef.current = onFailed;
+
+  useEffect(() => {
+    const host = hostRef.current;
+    if (!host) return;
+
+    let cancelled = false;
+    let element: HTMLElement | undefined;
+
+    const mount = async () => {
+      try {
+        // Imported for its side effect: the module registers <moq-watch>.
+        await import("./vendor/moq-watch.bundle.js");
+      } catch (error) {
+        // The chunk did not load at all. Identical in consequence to a refused
+        // ticket, and it falls back the same way.
+        onFailedRef.current(`moq player failed to load: ${(error as Error).message}`);
+        return;
+      }
+      if (cancelled) return;
+
+      element = document.createElement("moq-watch");
+      element.setAttribute("url", url);
+      element.setAttribute("name", name);
+      if (muted) element.setAttribute("muted", "");
+      /**
+       * `always`, not the default.
+       *
+       * The default is a visibility THRESHOLD ("20%") driven by an
+       * IntersectionObserver, and until it is met the renderer reports itself
+       * hidden, which disables the decoder, which never subscribes to the video
+       * track. A player inside a tab that has not been scrolled, or measured
+       * before layout settles, shows black for ever rather than late.
+       */
+      element.setAttribute("visible", "always");
+      element.style.width = "100%";
+      element.style.height = "100%";
+      element.style.display = "block";
+
+      /**
+       * The nested canvas the renderer paints into, and it is REQUIRED.
+       *
+       * `<moq-watch>` finds its render target by querying its own children. With
+       * no canvas there is no target, so the renderer is never visible, so
+       * `video.in.enabled` stays false and the decoder never subscribes. Every
+       * symptom of this is silent: the connection is established, the catalog
+       * arrives with the video rendition, the config resolves, and the relay
+       * shows only a `catalog.json` subscription and never a `video` one.
+       */
+      const canvas = document.createElement("canvas");
+      canvas.style.width = "100%";
+      canvas.style.height = "100%";
+      canvas.style.display = "block";
+      element.appendChild(canvas);
+
+      // A relay that refuses the ticket, or a broadcast that is not there,
+      // surfaces as an error event rather than a throw: the element owns its
+      // own reconnect loop and never rejects the caller.
+      element.addEventListener("error", () => {
+        onFailedRef.current("the relay connection failed");
+      });
+
+      host.replaceChildren(element);
+    };
+
+    void mount();
+
+    return () => {
+      cancelled = true;
+      // `replaceChildren()` disconnects the element, and its
+      // `disconnectedCallback` closes the connection and the decoders. Leaving
+      // it attached would keep a QUIC session and a decode pipeline alive for a
+      // stage the viewer has already left.
+      host.replaceChildren();
+      element = undefined;
+    };
+  }, [url, name, muted]);
+
+  return <div ref={hostRef} className="h-full w-full bg-black" />;
+}

package/src/ui/styled/broadcast/BroadcastPlayer.tsx

@@ -28,7 +28,26 @@ import {
 // `mediasoup-client`, and a value import here would put a browser-only package
 // on the server path of every site that loads `@tribe-nest/forge/ui`. It is
 // reached through the `import()` in the effect below, which no server runs.
+import type { BroadcastMoqStageProps } from "./BroadcastMoqStage";
 import type { BroadcastRealtimeStageProps } from "./BroadcastRealtimeStage";
+
+/** The relay lane's half of a `viewer-token` response. */
+type BroadcastMoqCredentials = { url: string; name: string; expiresAt: string; path: string };
+
+/**
+ * Renders the lazily-loaded relay stage.
+ *
+ * A named component rather than `<moqStage ... />` inline: a component read out
+ * of state and rendered directly is a new type on every render that produces a
+ * different one, which unmounts and remounts the player underneath. Naming it
+ * here keeps the element type stable across renders.
+ */
+function MoqStageRenderer({
+  Stage,
+  ...props
+}: BroadcastMoqStageProps & { Stage: ComponentType<BroadcastMoqStageProps> }) {
+  return <Stage {...props} />;
+}
 import { BroadcastPollPanel } from "./BroadcastPollPanel";
 import { useBroadcastPoll } from "../../headless/broadcast/useBroadcastPoll";
 import type { BroadcastPoll } from "../../../data/queries/useBroadcasts";
@@ -132,9 +151,13 @@ export interface BroadcastPlayerProps {
  *
  * ## Why the quality picker is not on the new path
  *
- * The plane has no simulcast. Every viewer receives the program feed's single
- * encoding, so High, Medium and Low would be three controls that change
- * nothing. A control that lies about what it does is worse than no control.
+ * The plane DOES publish three simulcast layers now (`REALTIME_PROGRAM_VIDEO`),
+ * so the old reason for leaving the picker off - "there is only one encoding,
+ * three buttons would all do nothing" - no longer holds. What holds instead is
+ * that the node's own layer choice tracks the viewer's actual bandwidth, and a
+ * manual override is a way to pin yourself to a layer your connection cannot
+ * carry. The picker below stays on the v1 Cloudflare path, which is where it
+ * was built and where it is wired.
  */
 export function BroadcastPlayer({ broadcast, broadcastPass, renderPlayer }: BroadcastPlayerProps) {
   const t = useForgeT();
@@ -178,6 +201,17 @@ export function BroadcastPlayer({ broadcast, broadcastPass, renderPlayer }: Broa
   const [PlaneStage, setPlaneStage] = useState<ComponentType<BroadcastRealtimeStageProps> | null>(null);
   const [credentialsReady, setCredentialsReady] = useState(false);
   const [credentialsError, setCredentialsError] = useState<BroadcastCredentialsError | null>(null);
+  /**
+   * The relay lane, as `viewer-token` reported it.
+   *
+   * Held separately from the plane credentials because the two are independent
+   * answers: an instance may offer a relay and no plane, a plane and no relay,
+   * or both. `planeAvailable` reads the plane's half off the same response.
+   */
+  const [moqStage, setMoqStage] = useState<ComponentType<BroadcastMoqStageProps> | null>(null);
+  const [moqCredentials, setMoqCredentials] = useState<BroadcastMoqCredentials | null>(null);
+  const [moqFailed, setMoqFailed] = useState(false);
+  const [planeAvailable, setPlaneAvailable] = useState(true);
   const [roomState, setRoomState] = useState<BroadcastRoomState | undefined>(undefined);
   /** The ticket the probe already minted, spent on the SDK's FIRST attempt. */
   const primedCredentials = useRef<BroadcastViewerCredentials | null>(null);
@@ -223,6 +257,24 @@ export function BroadcastPlayer({ broadcast, broadcastPass, renderPlayer }: Broa
         if (cancelled) return;
         primedCredentials.current = credentials;
         setPlaneStage(() => module.BroadcastRealtimeStage);
+        // A response with no `mediaUrl` is a relay-only instance. Recording it
+        // is what stops the chooser falling to a plane room that is not there
+        // if the relay lane later gives up.
+        setPlaneAvailable(Boolean((credentials as { mediaUrl?: string }).mediaUrl));
+        const moq = (credentials as { moq?: BroadcastMoqCredentials }).moq ?? null;
+        setMoqCredentials(moq);
+        if (moq) {
+          import("./BroadcastMoqStage")
+            .then((moqModule) => {
+              if (cancelled) return;
+              setMoqStage(() => moqModule.BroadcastMoqStage);
+            })
+            .catch(() => {
+              if (cancelled) return;
+              // The relay chunk did not load. The lane is over before it began.
+              setMoqFailed(true);
+            });
+        }
         setCredentialsReady(true);
       })
       .catch((error: unknown) => {
@@ -266,11 +318,27 @@ export function BroadcastPlayer({ broadcast, broadcastPass, renderPlayer }: Broa
    */
   const handleRoomState = useCallback((next: BroadcastRoomState) => setRoomState(next), []);
 
+  /**
+   * The relay lane gave up. Never cleared back to false, for the same reason
+   * `roomState` is never cleared: the failure is why we left, so forgetting it
+   * would choose the relay again, mount it again, and watch it fail again.
+   */
+  const handleMoqFailed = useCallback(() => setMoqFailed(true), []);
+
   const stageInput = useMemo(
-    () => ({ realtimeAvailable, credentialsReady, credentialsError, roomState }),
-    [realtimeAvailable, credentialsReady, credentialsError, roomState],
+    () => ({
+      realtimeAvailable,
+      credentialsReady,
+      credentialsError,
+      roomState,
+      moqAvailable: Boolean(moqCredentials && moqStage),
+      moqFailed,
+      planeAvailable,
+    }),
+    [realtimeAvailable, credentialsReady, credentialsError, roomState, moqCredentials, moqStage, moqFailed, planeAvailable],
   );
   const stage = chooseBroadcastStage(stageInput);
+  const showMoq = stage === "moq" && !!moqStage && !!moqCredentials;
   const showPlane = stage === "realtime" && !!PlaneStage;
   // Nothing is mounted while the ticket is in flight. `react-player` builds an
   // hls.js instance on mount and starts fetching immediately, so rendering the
@@ -481,6 +549,19 @@ export function BroadcastPlayer({ broadcast, broadcastPass, renderPlayer }: Broa
       }}
     >
       <div style={{ flex: "1 1 520px", minWidth: 0, ...panel }}>
+        {showMoq && moqStage && moqCredentials && (
+          <MoqStageRenderer
+            Stage={moqStage}
+            url={moqCredentials.url}
+            name={moqCredentials.name}
+            // Not muted: this is the broadcast the viewer came for, and the
+            // plane stage does not mute either. The element paints video to a
+            // canvas independently of its audio emitter, so a browser that
+            // blocks autoplay audio still shows a picture rather than nothing.
+            muted={false}
+            onFailed={handleMoqFailed}
+          />
+        )}
         {showPlane && PlaneStage && <PlaneStage getCredentials={getCredentials} onRoomState={handleRoomState} />}
 
         {stage === "pending" && (
@@ -490,7 +571,26 @@ export function BroadcastPlayer({ broadcast, broadcastPass, renderPlayer }: Broa
         )}
 
         {showHls && (
-          <div data-testid="broadcast-hls-stage" style={{ aspectRatio: "16/9" }}>
+          /*
+            The ratio box, and INSIDE it an absolutely filled box that the
+            player cannot resize.
+
+            `renderPlayer` is host-supplied (the starter passes `react-player`),
+            so this cannot dictate how the player sizes itself - and the
+            conventional `height: "100%"` a player is given resolves against a
+            parent whose height comes from `aspect-ratio`, which is not reliably
+            a definite height. The player then falls back to the stream's
+            intrinsic size and the panel jumps every time HLS changes rendition.
+
+            An absolutely positioned `inset: 0` box HAS a definite height, so a
+            child asking for 100% gets a real answer, and nothing the child does
+            can change the box it is in.
+          */
+          <div
+            data-testid="broadcast-hls-stage"
+            style={{ aspectRatio: "16/9", position: "relative", lineHeight: 0 }}
+          >
+            <div style={{ position: "absolute", inset: 0 }}>
             {renderPlayer ? (
               renderPlayer({ src: broadcast.liveUrl })
             ) : (
@@ -499,9 +599,20 @@ export function BroadcastPlayer({ broadcast, broadcastPass, renderPlayer }: Broa
                 controls
                 autoPlay
                 playsInline
-                style={{ width: "100%", height: "100%", background: "#000" }}
+                // Same reasoning as the realtime stage below: HLS renditions
+                // change resolution mid-stream too, and `height: 100%` off an
+                // `aspect-ratio` parent leaves the box following the source.
+                style={{
+                  display: "block",
+                  width: "100%",
+                  height: "auto",
+                  aspectRatio: "16 / 9",
+                  objectFit: "contain",
+                  background: "#000",
+                }}
               />
             )}
+            </div>
           </div>
         )}
 
@@ -539,9 +650,44 @@ export function BroadcastPlayer({ broadcast, broadcastPass, renderPlayer }: Broa
             onClick={togglePlay}
             onMouseEnter={() => setShowControls(true)}
             onMouseLeave={() => setShowControls(false)}
-            style={{ aspectRatio: "16/9", position: "relative", background: "#000", cursor: "pointer" }}
+            style={{
+              aspectRatio: "16/9",
+              position: "relative",
+              background: "#000",
+              cursor: "pointer",
+              lineHeight: 0,
+            }}
           >
-            <video ref={videoRef} playsInline style={{ width: "100%", height: "100%" }} />
+            {/*
+              The RATIO is on the video element itself, and `height` is `auto`.
+
+              This is the same fix `BroadcastRealtimeStage` carries, and this
+              path is where it was actually needed: it is the one with a quality
+              picker, so the incoming resolution changes whenever the viewer
+              chooses a layer (or the auto policy chooses one for them).
+
+              `height: 100%` did not hold the box still. A percentage height
+              needs a definite parent height, and one derived from the parent's
+              own `aspect-ratio` is not reliably that, so the replaced element
+              fell back to the track's INTRINSIC height and the whole panel
+              jumped on every quality change. `aspect-ratio` with `height: auto`
+              overrides the intrinsic ratio outright: the box is 16/9 of
+              whatever width it is given, whatever arrives on the wire.
+
+              `object-fit: contain` then letterboxes a source that is not 16/9
+              inside that fixed box rather than resizing the box to suit it.
+            */}
+            <video
+              ref={videoRef}
+              playsInline
+              style={{
+                display: "block",
+                width: "100%",
+                height: "auto",
+                aspectRatio: "16 / 9",
+                objectFit: "contain",
+              }}
+            />
             <audio ref={audioRef} />
 
             {(!isAudioLoaded || !isVideoLoaded) && (

package/src/ui/styled/broadcast/BroadcastRealtimeStage.tsx

@@ -48,9 +48,12 @@ import { programTracks, type BroadcastRoomState } from "./broadcastStage";
  * mute plus a blank screen plus a lie about being able to go back. The HLS
  * stage keeps its transport controls because there the buffer makes them true.
  *
- * There is no quality selector either. The plane has no simulcast: every viewer
- * receives the program feed's single encoding, so a picker offering High,
- * Medium and Low would be three buttons that all do the same nothing.
+ * There is no quality selector either, though not for the reason there used to
+ * be: the program feed publishes three simulcast layers, and the node moves a
+ * viewer between them on its own reading of their connection. A manual override
+ * is mostly a way to pin yourself above what your link can carry, so the choice
+ * stays with the node. What this file owes the viewer instead is that the
+ * SWITCH is invisible, which is what the sizing below is about.
  */
 
 export type BroadcastRealtimeStageProps = {