eb-player 2.0.20 → 2.1.0

package/dist/build/ebplayer.bundle.js

@@ -4,7 +4,7 @@
     (global = typeof globalThis !== 'undefined' ? globalThis : global || self, factory(global.EBPlayer = {}));
 })(this, (function (exports) { 'use strict';
 
-    var __EB_PLAYER_VERSION__ = "2.0.20";
+    var __EB_PLAYER_VERSION__ = "2.1.0";
 
     /**
      * Finite State Machine for player playback state transitions.
@@ -883,7 +883,7 @@
      * Copyright 2017 Google LLC
      * SPDX-License-Identifier: BSD-3-Clause
      */
-    const t=globalThis,i=t=>t,s=t.trustedTypes,e=s?s.createPolicy("lit-html",{createHTML:t=>t}):void 0,h="$lit$",o=`lit$${Math.random().toFixed(9).slice(2)}$`,n="?"+o,r=`<${n}>`,l=document,c=()=>l.createComment(""),a=t=>null===t||"object"!=typeof t&&"function"!=typeof t,u=Array.isArray,d=t=>u(t)||"function"==typeof t?.[Symbol.iterator],f="[ \t\n\f\r]",v=/<(?:(!--|\/[^a-zA-Z])|(\/?[a-zA-Z][^>\s]*)|(\/?$))/g,_=/-->/g,m=/>/g,p=RegExp(`>|${f}(?:([^\\s"'>=/]+)(${f}*=${f}*(?:[^ \t\n\f\r"'\`<>=]|("|')|))|$)`,"g"),g=/'/g,$=/"/g,y=/^(?:script|style|textarea|title)$/i,x=t=>(i,...s)=>({_$litType$:t,strings:i,values:s}),b=x(1),w=x(2),E=Symbol.for("lit-noChange"),A=Symbol.for("lit-nothing"),C=new WeakMap,P=l.createTreeWalker(l,129);function V(t,i){if(!u(t)||!t.hasOwnProperty("raw"))throw Error("invalid template strings array");return void 0!==e?e.createHTML(i):i}const N=(t,i)=>{const s=t.length-1,e=[];let n,l=2===i?"<svg>":3===i?"<math>":"",c=v;for(let i=0;i<s;i++){const s=t[i];let a,u,d=-1,f=0;for(;f<s.length&&(c.lastIndex=f,u=c.exec(s),null!==u);)f=c.lastIndex,c===v?"!--"===u[1]?c=_:void 0!==u[1]?c=m:void 0!==u[2]?(y.test(u[2])&&(n=RegExp("</"+u[2],"g")),c=p):void 0!==u[3]&&(c=p):c===p?">"===u[0]?(c=n??v,d=-1):void 0===u[1]?d=-2:(d=c.lastIndex-u[2].length,a=u[1],c=void 0===u[3]?p:'"'===u[3]?$:g):c===$||c===g?c=p:c===_||c===m?c=v:(c=p,n=void 0);const x=c===p&&t[i+1].startsWith("/>")?" ":"";l+=c===v?s+r:d>=0?(e.push(a),s.slice(0,d)+h+s.slice(d)+o+x):s+o+(-2===d?i:x);}return [V(t,l+(t[s]||"<?>")+(2===i?"</svg>":3===i?"</math>":"")),e]};class S{constructor({strings:t,_$litType$:i},e){let r;this.parts=[];let l=0,a=0;const u=t.length-1,d=this.parts,[f,v]=N(t,i);if(this.el=S.createElement(f,e),P.currentNode=this.el.content,2===i||3===i){const t=this.el.content.firstChild;t.replaceWith(...t.childNodes);}for(;null!==(r=P.nextNode())&&d.length<u;){if(1===r.nodeType){if(r.hasAttributes())for(const t of r.getAttributeNames())if(t.endsWith(h)){const i=v[a++],s=r.getAttribute(t).split(o),e=/([.?@])?(.*)/.exec(i);d.push({type:1,index:l,name:e[2],strings:s,ctor:"."===e[1]?I:"?"===e[1]?L:"@"===e[1]?z:H}),r.removeAttribute(t);}else t.startsWith(o)&&(d.push({type:6,index:l}),r.removeAttribute(t));if(y.test(r.tagName)){const t=r.textContent.split(o),i=t.length-1;if(i>0){r.textContent=s?s.emptyScript:"";for(let s=0;s<i;s++)r.append(t[s],c()),P.nextNode(),d.push({type:2,index:++l});r.append(t[i],c());}}}else if(8===r.nodeType)if(r.data===n)d.push({type:2,index:l});else {let t=-1;for(;-1!==(t=r.data.indexOf(o,t+1));)d.push({type:7,index:l}),t+=o.length-1;}l++;}}static createElement(t,i){const s=l.createElement("template");return s.innerHTML=t,s}}function M(t,i,s=t,e){if(i===E)return i;let h=void 0!==e?s._$Co?.[e]:s._$Cl;const o=a(i)?void 0:i._$litDirective$;return h?.constructor!==o&&(h?._$AO?.(false),void 0===o?h=void 0:(h=new o(t),h._$AT(t,s,e)),void 0!==e?(s._$Co??=[])[e]=h:s._$Cl=h),void 0!==h&&(i=M(t,h._$AS(t,i.values),h,e)),i}class R{constructor(t,i){this._$AV=[],this._$AN=void 0,this._$AD=t,this._$AM=i;}get parentNode(){return this._$AM.parentNode}get _$AU(){return this._$AM._$AU}u(t){const{el:{content:i},parts:s}=this._$AD,e=(t?.creationScope??l).importNode(i,true);P.currentNode=e;let h=P.nextNode(),o=0,n=0,r=s[0];for(;void 0!==r;){if(o===r.index){let i;2===r.type?i=new k(h,h.nextSibling,this,t):1===r.type?i=new r.ctor(h,r.name,r.strings,this,t):6===r.type&&(i=new Z(h,this,t)),this._$AV.push(i),r=s[++n];}o!==r?.index&&(h=P.nextNode(),o++);}return P.currentNode=l,e}p(t){let i=0;for(const s of this._$AV) void 0!==s&&(void 0!==s.strings?(s._$AI(t,s,i),i+=s.strings.length-2):s._$AI(t[i])),i++;}}class k{get _$AU(){return this._$AM?._$AU??this._$Cv}constructor(t,i,s,e){this.type=2,this._$AH=A,this._$AN=void 0,this._$AA=t,this._$AB=i,this._$AM=s,this.options=e,this._$Cv=e?.isConnected??true;}get parentNode(){let t=this._$AA.parentNode;const i=this._$AM;return void 0!==i&&11===t?.nodeType&&(t=i.parentNode),t}get startNode(){return this._$AA}get endNode(){return this._$AB}_$AI(t,i=this){t=M(this,t,i),a(t)?t===A||null==t||""===t?(this._$AH!==A&&this._$AR(),this._$AH=A):t!==this._$AH&&t!==E&&this._(t):void 0!==t._$litType$?this.$(t):void 0!==t.nodeType?this.T(t):d(t)?this.k(t):this._(t);}O(t){return this._$AA.parentNode.insertBefore(t,this._$AB)}T(t){this._$AH!==t&&(this._$AR(),this._$AH=this.O(t));}_(t){this._$AH!==A&&a(this._$AH)?this._$AA.nextSibling.data=t:this.T(l.createTextNode(t)),this._$AH=t;}$(t){const{values:i,_$litType$:s}=t,e="number"==typeof s?this._$AC(t):(void 0===s.el&&(s.el=S.createElement(V(s.h,s.h[0]),this.options)),s);if(this._$AH?._$AD===e)this._$AH.p(i);else {const t=new R(e,this),s=t.u(this.options);t.p(i),this.T(s),this._$AH=t;}}_$AC(t){let i=C.get(t.strings);return void 0===i&&C.set(t.strings,i=new S(t)),i}k(t){u(this._$AH)||(this._$AH=[],this._$AR());const i=this._$AH;let s,e=0;for(const h of t)e===i.length?i.push(s=new k(this.O(c()),this.O(c()),this,this.options)):s=i[e],s._$AI(h),e++;e<i.length&&(this._$AR(s&&s._$AB.nextSibling,e),i.length=e);}_$AR(t=this._$AA.nextSibling,s){for(this._$AP?.(false,true,s);t!==this._$AB;){const s=i(t).nextSibling;i(t).remove(),t=s;}}setConnected(t){ void 0===this._$AM&&(this._$Cv=t,this._$AP?.(t));}}class H{get tagName(){return this.element.tagName}get _$AU(){return this._$AM._$AU}constructor(t,i,s,e,h){this.type=1,this._$AH=A,this._$AN=void 0,this.element=t,this.name=i,this._$AM=e,this.options=h,s.length>2||""!==s[0]||""!==s[1]?(this._$AH=Array(s.length-1).fill(new String),this.strings=s):this._$AH=A;}_$AI(t,i=this,s,e){const h=this.strings;let o=false;if(void 0===h)t=M(this,t,i,0),o=!a(t)||t!==this._$AH&&t!==E,o&&(this._$AH=t);else {const e=t;let n,r;for(t=h[0],n=0;n<h.length-1;n++)r=M(this,e[s+n],i,n),r===E&&(r=this._$AH[n]),o||=!a(r)||r!==this._$AH[n],r===A?t=A:t!==A&&(t+=(r??"")+h[n+1]),this._$AH[n]=r;}o&&!e&&this.j(t);}j(t){t===A?this.element.removeAttribute(this.name):this.element.setAttribute(this.name,t??"");}}class I extends H{constructor(){super(...arguments),this.type=3;}j(t){this.element[this.name]=t===A?void 0:t;}}class L extends H{constructor(){super(...arguments),this.type=4;}j(t){this.element.toggleAttribute(this.name,!!t&&t!==A);}}class z extends H{constructor(t,i,s,e,h){super(t,i,s,e,h),this.type=5;}_$AI(t,i=this){if((t=M(this,t,i,0)??A)===E)return;const s=this._$AH,e=t===A&&s!==A||t.capture!==s.capture||t.once!==s.once||t.passive!==s.passive,h=t!==A&&(s===A||e);e&&this.element.removeEventListener(this.name,this,s),h&&this.element.addEventListener(this.name,this,t),this._$AH=t;}handleEvent(t){"function"==typeof this._$AH?this._$AH.call(this.options?.host??this.element,t):this._$AH.handleEvent(t);}}class Z{constructor(t,i,s){this.element=t,this.type=6,this._$AN=void 0,this._$AM=i,this.options=s;}get _$AU(){return this._$AM._$AU}_$AI(t){M(this,t);}}const B=t.litHtmlPolyfillSupport;B?.(S,k),(t.litHtmlVersions??=[]).push("3.3.2");const D=(t,i,s)=>{const e=i;let h=e._$litPart$;if(void 0===h){const t=null;e._$litPart$=h=new k(i.insertBefore(c(),t),t,void 0,{});}return h._$AI(t),h};
+    const t=globalThis,i=t=>t,s=t.trustedTypes,e=s?s.createPolicy("lit-html",{createHTML:t=>t}):void 0,h="$lit$",o=`lit$${Math.random().toFixed(9).slice(2)}$`,n="?"+o,r=`<${n}>`,l=document,c=()=>l.createComment(""),a=t=>null===t||"object"!=typeof t&&"function"!=typeof t,u=Array.isArray,d=t=>u(t)||"function"==typeof t?.[Symbol.iterator],f="[ \t\n\f\r]",v=/<(?:(!--|\/[^a-zA-Z])|(\/?[a-zA-Z][^>\s]*)|(\/?$))/g,_=/-->/g,m=/>/g,p=RegExp(`>|${f}(?:([^\\s"'>=/]+)(${f}*=${f}*(?:[^ \t\n\f\r"'\`<>=]|("|')|))|$)`,"g"),g=/'/g,$=/"/g,y=/^(?:script|style|textarea|title)$/i,x=t=>(i,...s)=>({_$litType$:t,strings:i,values:s}),b=x(1),w=x(2),E=Symbol.for("lit-noChange"),A=Symbol.for("lit-nothing"),C=new WeakMap,P=l.createTreeWalker(l,129);function V(t,i){if(!u(t)||!t.hasOwnProperty("raw"))throw Error("invalid template strings array");return void 0!==e?e.createHTML(i):i}const N=(t,i)=>{const s=t.length-1,e=[];let n,l=2===i?"<svg>":3===i?"<math>":"",c=v;for(let i=0;i<s;i++){const s=t[i];let a,u,d=-1,f=0;for(;f<s.length&&(c.lastIndex=f,u=c.exec(s),null!==u);)f=c.lastIndex,c===v?"!--"===u[1]?c=_:void 0!==u[1]?c=m:void 0!==u[2]?(y.test(u[2])&&(n=RegExp("</"+u[2],"g")),c=p):void 0!==u[3]&&(c=p):c===p?">"===u[0]?(c=n??v,d=-1):void 0===u[1]?d=-2:(d=c.lastIndex-u[2].length,a=u[1],c=void 0===u[3]?p:'"'===u[3]?$:g):c===$||c===g?c=p:c===_||c===m?c=v:(c=p,n=void 0);const x=c===p&&t[i+1].startsWith("/>")?" ":"";l+=c===v?s+r:d>=0?(e.push(a),s.slice(0,d)+h+s.slice(d)+o+x):s+o+(-2===d?i:x);}return [V(t,l+(t[s]||"<?>")+(2===i?"</svg>":3===i?"</math>":"")),e]};class S{constructor({strings:t,_$litType$:i},e){let r;this.parts=[];let l=0,a=0;const u=t.length-1,d=this.parts,[f,v]=N(t,i);if(this.el=S.createElement(f,e),P.currentNode=this.el.content,2===i||3===i){const t=this.el.content.firstChild;t.replaceWith(...t.childNodes);}for(;null!==(r=P.nextNode())&&d.length<u;){if(1===r.nodeType){if(r.hasAttributes())for(const t of r.getAttributeNames())if(t.endsWith(h)){const i=v[a++],s=r.getAttribute(t).split(o),e=/([.?@])?(.*)/.exec(i);d.push({type:1,index:l,name:e[2],strings:s,ctor:"."===e[1]?I:"?"===e[1]?L:"@"===e[1]?z:H}),r.removeAttribute(t);}else t.startsWith(o)&&(d.push({type:6,index:l}),r.removeAttribute(t));if(y.test(r.tagName)){const t=r.textContent.split(o),i=t.length-1;if(i>0){r.textContent=s?s.emptyScript:"";for(let s=0;s<i;s++)r.append(t[s],c()),P.nextNode(),d.push({type:2,index:++l});r.append(t[i],c());}}}else if(8===r.nodeType)if(r.data===n)d.push({type:2,index:l});else {let t=-1;for(;-1!==(t=r.data.indexOf(o,t+1));)d.push({type:7,index:l}),t+=o.length-1;}l++;}}static createElement(t,i){const s=l.createElement("template");return s.innerHTML=t,s}}function M(t,i,s=t,e){if(i===E)return i;let h=void 0!==e?s._$Co?.[e]:s._$Cl;const o=a(i)?void 0:i._$litDirective$;return h?.constructor!==o&&(h?._$AO?.(false),void 0===o?h=void 0:(h=new o(t),h._$AT(t,s,e)),void 0!==e?(s._$Co??=[])[e]=h:s._$Cl=h),void 0!==h&&(i=M(t,h._$AS(t,i.values),h,e)),i}class R{constructor(t,i){this._$AV=[],this._$AN=void 0,this._$AD=t,this._$AM=i;}get parentNode(){return this._$AM.parentNode}get _$AU(){return this._$AM._$AU}u(t){const{el:{content:i},parts:s}=this._$AD,e=(t?.creationScope??l).importNode(i,true);P.currentNode=e;let h=P.nextNode(),o=0,n=0,r=s[0];for(;void 0!==r;){if(o===r.index){let i;2===r.type?i=new k(h,h.nextSibling,this,t):1===r.type?i=new r.ctor(h,r.name,r.strings,this,t):6===r.type&&(i=new Z(h,this,t)),this._$AV.push(i),r=s[++n];}o!==r?.index&&(h=P.nextNode(),o++);}return P.currentNode=l,e}p(t){let i=0;for(const s of this._$AV) void 0!==s&&(void 0!==s.strings?(s._$AI(t,s,i),i+=s.strings.length-2):s._$AI(t[i])),i++;}}class k{get _$AU(){return this._$AM?._$AU??this._$Cv}constructor(t,i,s,e){this.type=2,this._$AH=A,this._$AN=void 0,this._$AA=t,this._$AB=i,this._$AM=s,this.options=e,this._$Cv=e?.isConnected??true;}get parentNode(){let t=this._$AA.parentNode;const i=this._$AM;return void 0!==i&&11===t?.nodeType&&(t=i.parentNode),t}get startNode(){return this._$AA}get endNode(){return this._$AB}_$AI(t,i=this){t=M(this,t,i),a(t)?t===A||null==t||""===t?(this._$AH!==A&&this._$AR(),this._$AH=A):t!==this._$AH&&t!==E&&this._(t):void 0!==t._$litType$?this.$(t):void 0!==t.nodeType?this.T(t):d(t)?this.k(t):this._(t);}O(t){return this._$AA.parentNode.insertBefore(t,this._$AB)}T(t){this._$AH!==t&&(this._$AR(),this._$AH=this.O(t));}_(t){this._$AH!==A&&a(this._$AH)?this._$AA.nextSibling.data=t:this.T(l.createTextNode(t)),this._$AH=t;}$(t){const{values:i,_$litType$:s}=t,e="number"==typeof s?this._$AC(t):(void 0===s.el&&(s.el=S.createElement(V(s.h,s.h[0]),this.options)),s);if(this._$AH?._$AD===e)this._$AH.p(i);else {const t=new R(e,this),s=t.u(this.options);t.p(i),this.T(s),this._$AH=t;}}_$AC(t){let i=C.get(t.strings);return void 0===i&&C.set(t.strings,i=new S(t)),i}k(t){u(this._$AH)||(this._$AH=[],this._$AR());const i=this._$AH;let s,e=0;for(const h of t)e===i.length?i.push(s=new k(this.O(c()),this.O(c()),this,this.options)):s=i[e],s._$AI(h),e++;e<i.length&&(this._$AR(s&&s._$AB.nextSibling,e),i.length=e);}_$AR(t=this._$AA.nextSibling,s){for(this._$AP?.(false,true,s);t!==this._$AB;){const s=i(t).nextSibling;i(t).remove(),t=s;}}setConnected(t){ void 0===this._$AM&&(this._$Cv=t,this._$AP?.(t));}}class H{get tagName(){return this.element.tagName}get _$AU(){return this._$AM._$AU}constructor(t,i,s,e,h){this.type=1,this._$AH=A,this._$AN=void 0,this.element=t,this.name=i,this._$AM=e,this.options=h,s.length>2||""!==s[0]||""!==s[1]?(this._$AH=Array(s.length-1).fill(new String),this.strings=s):this._$AH=A;}_$AI(t,i=this,s,e){const h=this.strings;let o=false;if(void 0===h)t=M(this,t,i,0),o=!a(t)||t!==this._$AH&&t!==E,o&&(this._$AH=t);else {const e=t;let n,r;for(t=h[0],n=0;n<h.length-1;n++)r=M(this,e[s+n],i,n),r===E&&(r=this._$AH[n]),o||=!a(r)||r!==this._$AH[n],r===A?t=A:t!==A&&(t+=(r??"")+h[n+1]),this._$AH[n]=r;}o&&!e&&this.j(t);}j(t){t===A?this.element.removeAttribute(this.name):this.element.setAttribute(this.name,t??"");}}class I extends H{constructor(){super(...arguments),this.type=3;}j(t){this.element[this.name]=t===A?void 0:t;}}class L extends H{constructor(){super(...arguments),this.type=4;}j(t){this.element.toggleAttribute(this.name,!!t&&t!==A);}}class z extends H{constructor(t,i,s,e,h){super(t,i,s,e,h),this.type=5;}_$AI(t,i=this){if((t=M(this,t,i,0)??A)===E)return;const s=this._$AH,e=t===A&&s!==A||t.capture!==s.capture||t.once!==s.once||t.passive!==s.passive,h=t!==A&&(s===A||e);e&&this.element.removeEventListener(this.name,this,s),h&&this.element.addEventListener(this.name,this,t),this._$AH=t;}handleEvent(t){"function"==typeof this._$AH?this._$AH.call(this.options?.host??this.element,t):this._$AH.handleEvent(t);}}class Z{constructor(t,i,s){this.element=t,this.type=6,this._$AN=void 0,this._$AM=i,this.options=s;}get _$AU(){return this._$AM._$AU}_$AI(t){M(this,t);}}const B=t.litHtmlPolyfillSupport;B?.(S,k),(t.litHtmlVersions??=[]).push("3.3.3");const D=(t,i,s)=>{const e=i;let h=e._$litPart$;if(void 0===h){const t=null;e._$litPart$=h=new k(i.insertBefore(c(),t),t,void 0,{});}return h._$AI(t),h};
 
     /**
      * Abstract base class for all skin components.
@@ -3881,15 +3881,37 @@
     }
 
     const IMA_SDK_URL = 'https://imasdk.googleapis.com/js/sdkloader/ima3.js';
+    /**
+     * G-07-9: backstop for an intro that never signals completion (all three
+     * IntroStreamManager completion triggers lost, e.g. a swallowed throw inside
+     * its init() that lifecycle.ts only logs). Chosen to exceed any plausible
+     * intro asset so it can never truncate a real intro — it converts an
+     * infinite hang into a bounded one.
+     */
+    const INTRO_DEFERRAL_TIMEOUT_MS = 120000;
+    /**
+     * G-07-11: bound from ad-leg entry to the AdsManager being handed back by
+     * the loader. It spans the gesture wait, loadScript, displayContainer
+     * initialization, requestAds and the ads response, and stops there —
+     * creative fetch, buffering and render are IMA's and are not charged to it.
+     * Must stay below MAIN_OPEN_FALLBACK_MS (eb-player.ts) so this more precise
+     * mechanism resolves first.
+     */
+    const AD_LEG_TIMEOUT_MS = 20000;
     /**
      * AdsManager manages the IMA SDK preroll ad lifecycle.
      *
-     * - Loads the IMA SDK from CDN via loadScript
-     * - Gates displayContainer.initialize() on a user gesture when config.autoplay is false
-     *   (browser autoplay policy requirement — see Pitfall 2 in plan context)
+     * - Defers IMA SDK loading until an intro stream (if configured) completes,
+     *   bounded by INTRO_DEFERRAL_TIMEOUT_MS (G-07-9)
+     * - Observes a user gesture on the player root starting before that
+     *   deferral, so a click during the intro satisfies the browser autoplay
+     *   gesture requirement without a second click after the intro (G-07-11)
+     * - Guarantees the ad leg completes exactly once, bounded by
+     *   AD_LEG_TIMEOUT_MS until the loader hands back an AdsManager (G-07-11)
      * - Sets state.adPlaying based on IMA lifecycle events
-     * - Emits 'ad-complete' on TypedEventBus when all ads are done
-     * - Cleans up adsManager.destroy() and displayContainer.destroy() on abort
+     * - Emits 'ad-complete' on TypedEventBus exactly once per instance
+     * - Cleans up adsManager.destroy() and displayContainer.destroy() on abort,
+     *   and on any completion path that never obtained an AdsManager
      */
     class AdsManager {
         constructor() {
@@ -3899,111 +3921,278 @@
         /**
          * Initialize the IMA SDK preroll ad system.
          * - Skips if config.ad is undefined
-         * - If !config.autoplay: waits for user click on video element before initializing
-         *   (required by browser autoplay policies to avoid muted/blocked display contexts)
+         * - Defers initialization while config.preroll is set, until
+         *   'intro-stream-complete' fires or INTRO_DEFERRAL_TIMEOUT_MS elapses
+         *   (G-07-9)
+         * - If !config.autoplay: observes a click anywhere in the player before
+         *   the deferral, and consumes it after (required by browser autoplay
+         *   policies to avoid muted/blocked display contexts)
+         * - The ad leg always completes exactly once, bounded by
+         *   AD_LEG_TIMEOUT_MS until the loader hands back an AdsManager (G-07-11)
          * - Loads IMA SDK, creates AdDisplayContainer, AdsLoader, and AdsRequest
          * - Wires ad lifecycle events to PlayerState and TypedEventBus
          */
         async init(config, state, bus, video, adsContainer, signal) {
             if (!config.ad)
                 return;
-            // CR-01: D-10 intro → ad → main precedence. If an intro stream is currently
-            // playing, defer IMA initialization until the bus emits 'intro-stream-complete'.
-            // Without this gate, IMA fires CONTENT_PAUSE_REQUESTED and tries to play the ad
-            // in the same <video> element the intro is using — the two streams race for
-            // the element with order determined by network/SDK timing.
-            if (state.introStreamPlaying) {
+            // G-07-11: single idempotent completion funnel. Every path that ends the
+            // ad leg — the watchdog, a rejected/failed SDK load, a loader or manager
+            // AD_ERROR, or a normal ALL_ADS_COMPLETED — routes through this closure,
+            // guarded so 'ad-complete' can never fire twice and main can never open
+            // twice.
+            let introDeferralTimer = null;
+            let adLegTimer = null;
+            let adLegCompleted = false;
+            const localController = new AbortController();
+            signal.addEventListener('abort', () => localController.abort(), { once: true });
+            const clearIntroDeferralTimer = () => {
+                if (introDeferralTimer !== null) {
+                    clearTimeout(introDeferralTimer);
+                    introDeferralTimer = null;
+                }
+            };
+            const clearAdLegTimer = () => {
+                if (adLegTimer !== null) {
+                    clearTimeout(adLegTimer);
+                    adLegTimer = null;
+                }
+            };
+            const completeAdLeg = () => {
+                if (adLegCompleted)
+                    return;
+                adLegCompleted = true;
+                clearIntroDeferralTimer();
+                clearAdLegTimer();
+                // T-07-23: release only when nothing can be rendering. imaAdsManager
+                // is assigned in exactly one place (below, after getAdsManager()
+                // returns), so null here means the loader never handed one back —
+                // watchdog expiry, an IMA-setup rejection, or a loader-level AD_ERROR
+                // before any manager. ALL_ADS_COMPLETED and a manager-level AD_ERROR
+                // keep dispose-time teardown instead (see releaseImaResources below).
+                if (this.imaAdsManager === null) {
+                    this.releaseImaResources();
+                }
+                state.adPlaying = false;
+                bus.emit('ad-complete');
+                localController.abort();
+            };
+            // Abort hygiene (G-07-11): unconditional and idempotent, registered
+            // once so it fires no matter which stage init() was in when the signal
+            // aborted. releaseImaResources() is itself null-guarded, so this is a
+            // no-op on any path that already released or never acquired IMA
+            // resources.
+            signal.addEventListener('abort', () => {
+                clearIntroDeferralTimer();
+                clearAdLegTimer();
+                this.releaseImaResources();
+            }, { once: true });
+            // G-07-11: gesture observation starts here, before the intro-deferral
+            // await below, so a click that lands during the intro is already
+            // captured by the time the post-intro await consumes it (the
+            // sequential-await interaction: fixing G-07-9 alone would otherwise
+            // install this listener only after the intro, behind the very click
+            // that started it).
+            //
+            // WR-01: wired to localController.signal, not the outer signal. The outer
+            // abort already propagates into localController (above), so this still
+            // covers player disposal — but it additionally lets completeAdLeg() settle
+            // a still-pending gesture wait. Without it, an ad leg completed by the
+            // watchdog, an AD_ERROR or ALL_ADS_COMPLETED before any click leaves this
+            // promise unsettled forever: init() never resolves and the capture-phase
+            // click listener stays attached to .eb-player.
+            const gesturePromise = config.autoplay ? null : this.waitForUserGesture(video, localController.signal);
+            // G-07-9: the decision is derived from configuration, not from the
+            // PlayerState intro-playing flag. An async function body runs
+            // synchronously up to its first await, so reading that flag here would
+            // always observe its createPlayerState() default — IntroStreamManager
+            // has not run yet at this point in initIntegrations(). config.preroll is
+            // immutable and readable regardless of integration init order.
+            if (config.preroll) {
                 await new Promise((resolve) => {
-                    bus.on('intro-stream-complete', () => resolve(), { signal });
-                    signal.addEventListener('abort', () => resolve(), { once: true });
+                    const settle = () => {
+                        clearIntroDeferralTimer();
+                        resolve();
+                    };
+                    bus.on('intro-stream-complete', settle, { signal });
+                    signal.addEventListener('abort', settle, { once: true });
+                    introDeferralTimer = setTimeout(() => {
+                        console.warn('AdsManager: intro-stream-complete never arrived within the bound — falling through to the ad leg (G-07-9)');
+                        settle();
+                    }, INTRO_DEFERRAL_TIMEOUT_MS);
                 });
                 if (signal.aborted)
                     return;
             }
-            // Gate initialization on user gesture when not in autoplay mode
-            if (!config.autoplay) {
-                await this.waitForUserGesture(video, signal);
-                if (signal.aborted)
+            // G-07-11 / D-08-03: the ad-leg watchdog bounds every step from here —
+            // the gesture wait, loadScript, the ad request and the ads response —
+            // until the loader hands back an AdsManager, which disarms it below.
+            // Armed unconditionally whenever config.ad is set (init() already
+            // returned above at the `!config.ad` early return, so this line is only
+            // ever reached with config.ad truthy): as of D-02, main is gated on
+            // 'ad-complete' in BOTH the intro+ad and ad-only configurations, so an
+            // unbounded leg in either shape is a permanent stuck loader — the exact
+            // failure VAST-05 forbids. Invariant: whenever main waits on the ad leg,
+            // the ad leg is bounded. Do not restore an `if (config.preroll)` guard
+            // here — that would leave the ad-only configuration unbounded again.
+            adLegTimer = setTimeout(() => {
+                console.warn('AdsManager: ad leg produced no AdsManager within the bound — falling through to main (G-07-11)');
+                completeAdLeg();
+            }, AD_LEG_TIMEOUT_MS);
+            // Consume the gesture observed above. A click that arrives after the ad
+            // leg has already completed must not resurrect it.
+            if (gesturePromise !== null) {
+                await gesturePromise;
+            }
+            if (signal.aborted || adLegCompleted)
+                return;
+            try {
+                const google = await loadScript(IMA_SDK_URL, 'google');
+                // G-07-11: the release above must be terminal. A watchdog that
+                // expired while loadScript was still in flight must not let a
+                // resolving SDK rebuild the display container it just destroyed.
+                if (adLegCompleted)
                     return;
-            }
-            const google = await loadScript(IMA_SDK_URL, 'google');
-            const { ima } = google;
-            const displayContainer = new ima.AdDisplayContainer(adsContainer, video);
-            this.imaDisplayContainer = displayContainer;
-            displayContainer.initialize();
-            const adsLoader = new ima.AdsLoader(displayContainer);
-            // AD_ERROR fall-through (CR-02): if the VAST tag fails to load (network
-            // error, ad-blocker, malformed XML, autoplay rejection), IMA fires
-            // AD_ERROR and never ALL_ADS_COMPLETED. Without this handler the
-            // orchestration in eb-player.ts would wait forever for 'ad-complete'
-            // and the main stream would never open. Treat AD_ERROR as a normal
-            // completion so the orchestration always advances.
-            adsLoader.addEventListener(ima.AdErrorEvent.Type.AD_ERROR, (errorEvent) => {
-                console.warn('AdsManager: AD_ERROR (loader) — falling through to main', errorEvent);
-                state.adPlaying = false;
-                bus.emit('ad-complete');
-            });
-            adsLoader.addEventListener(ima.AdsManagerLoadedEvent.Type.ADS_MANAGER_LOADED, (loadedEvent) => {
-                const event = loadedEvent;
-                const adsManager = event.getAdsManager(video);
-                this.imaAdsManager = adsManager;
-                // getBoundingClientRect is always defined on HTMLElement; the prior
-                // truthy check on the method reference was dead code. The real edge
-                // case is a zero-sized element (display:none, before layout) which
-                // would make IMA's ads container collapse — fall back to a 16:9
-                // baseline in that case.
-                const rect = video.getBoundingClientRect();
-                const width = rect.width > 0 ? rect.width : 640;
-                const height = rect.height > 0 ? rect.height : 360;
-                // Wire event handlers for ad lifecycle
-                adsManager.addEventListener(ima.AdEvent.Type.CONTENT_PAUSE_REQUESTED, () => {
-                    state.adPlaying = true;
-                    // Pause the content stream while the ad plays. IMA's integration
-                    // contract requires the publisher to pause its own content video on
-                    // CONTENT_PAUSE_REQUESTED; the symmetric CONTENT_RESUME_REQUESTED
-                    // handler below resumes it with video.play(). Without this the main
-                    // HLS/DASH stream keeps playing (audio + video) underneath the ad.
-                    video.pause();
-                });
-                adsManager.addEventListener(ima.AdEvent.Type.CONTENT_RESUME_REQUESTED, () => {
-                    state.adPlaying = false;
-                    void video.play();
+                const { ima } = google;
+                const displayContainer = new ima.AdDisplayContainer(adsContainer, video);
+                this.imaDisplayContainer = displayContainer;
+                displayContainer.initialize();
+                const adsLoader = new ima.AdsLoader(displayContainer);
+                // AD_ERROR fall-through (CR-02): if the VAST tag fails to load (network
+                // error, ad-blocker, malformed XML, autoplay rejection), IMA fires
+                // AD_ERROR and never ALL_ADS_COMPLETED. Route it through the shared
+                // completion funnel so the orchestration always advances.
+                adsLoader.addEventListener(ima.AdErrorEvent.Type.AD_ERROR, (errorEvent) => {
+                    console.warn('AdsManager: AD_ERROR (loader) — falling through to main', errorEvent);
+                    completeAdLeg();
                 });
-                adsManager.addEventListener(ima.AdEvent.Type.ALL_ADS_COMPLETED, () => {
-                    state.adPlaying = false;
-                    bus.emit('ad-complete');
-                });
-                // Same AD_ERROR fall-through on the manager — covers errors that
-                // surface only after the ad starts playing (decode error, mid-roll
-                // load failure, etc.).
-                adsManager.addEventListener(ima.AdErrorEvent.Type.AD_ERROR, (errorEvent) => {
-                    console.warn('AdsManager: AD_ERROR (manager) — falling through to main', errorEvent);
-                    state.adPlaying = false;
-                    bus.emit('ad-complete');
+                adsLoader.addEventListener(ima.AdsManagerLoadedEvent.Type.ADS_MANAGER_LOADED, (loadedEvent) => {
+                    // T-07-22: a late ads response — the request is issued before the
+                    // bound can expire, so this is reachable — must not start an ad
+                    // over an already-opened main stream, and must not emit a second
+                    // 'ad-complete'.
+                    if (adLegCompleted)
+                        return;
+                    const event = loadedEvent;
+                    const adsManager = event.getAdsManager(video);
+                    this.imaAdsManager = adsManager;
+                    // G-07-11: holding the manager is the earliest proof the ad leg is
+                    // alive and progressing. Creative fetch, buffering and render are
+                    // IMA's to own from here — disarm the watchdog now rather than at
+                    // a later, more visible signal, so none of that time is charged
+                    // to the bound.
+                    clearAdLegTimer();
+                    // getBoundingClientRect is always defined on HTMLElement; the prior
+                    // truthy check on the method reference was dead code. The real edge
+                    // case is a zero-sized element (display:none, before layout) which
+                    // would make IMA's ads container collapse — fall back to a 16:9
+                    // baseline in that case.
+                    const rect = video.getBoundingClientRect();
+                    const width = rect.width > 0 ? rect.width : 640;
+                    const height = rect.height > 0 ? rect.height : 360;
+                    // D-08-08: CONTENT_PAUSE_REQUESTED, CONTENT_RESUME_REQUESTED and
+                    // ALL_ADS_COMPLETED emitted nothing at all before this change, so
+                    // none of the three could be individually evidenced in the 08-04
+                    // live session (G-08-02) — only their side effects were visible.
+                    // These three log lines are observability-only and inherit
+                    // D-08-06's constraints below verbatim (never complete the leg,
+                    // never write state, never interpolate metadata). Each literal is
+                    // captured verbatim into a committed evidence file by 08-07.
+                    // Wire event handlers for ad lifecycle
+                    adsManager.addEventListener(ima.AdEvent.Type.CONTENT_PAUSE_REQUESTED, () => {
+                        console.log('AdsManager: CONTENT_PAUSE_REQUESTED — content paused (D-08-08)');
+                        state.adPlaying = true;
+                        // Pause the content stream while the ad plays. IMA's integration
+                        // contract requires the publisher to pause its own content video on
+                        // CONTENT_PAUSE_REQUESTED; the symmetric CONTENT_RESUME_REQUESTED
+                        // handler below resumes it with video.play(). Without this the main
+                        // HLS/DASH stream keeps playing (audio + video) underneath the ad.
+                        video.pause();
+                    });
+                    adsManager.addEventListener(ima.AdEvent.Type.CONTENT_RESUME_REQUESTED, () => {
+                        console.log('AdsManager: CONTENT_RESUME_REQUESTED — content resumed (D-08-08)');
+                        state.adPlaying = false;
+                        void video.play();
+                        // D-08-07: CONTENT_RESUME_REQUESTED is IMA's canonical "ad break
+                        // over, resume content" signal and is the ONLY completion event
+                        // dispatched for a plain VAST response — ALL_ADS_COMPLETED is
+                        // reliable only for VMAP/ad-rules responses. Routing it through
+                        // completeAdLeg() is what makes VAST-04's "exactly once per
+                        // instance" hold on both response shapes; completeAdLeg() is
+                        // idempotent via adLegCompleted, so a later ALL_ADS_COMPLETED is
+                        // a no-op rather than a second 'ad-complete'.
+                        //
+                        // Verified live (08-04): without this, a completed Google sample
+                        // preroll never emitted 'ad-complete', and main opened only when
+                        // the 30s MAIN_OPEN_FALLBACK_MS backstop expired — a 20-29s gap
+                        // on every ad-only playback.
+                        completeAdLeg();
+                    });
+                    adsManager.addEventListener(ima.AdEvent.Type.ALL_ADS_COMPLETED, () => {
+                        console.log('AdsManager: ALL_ADS_COMPLETED — ad leg complete (D-08-08)');
+                        completeAdLeg();
+                    });
+                    // Same AD_ERROR fall-through on the manager — covers errors that
+                    // surface only after the ad starts playing (decode error, mid-roll
+                    // load failure, etc.).
+                    adsManager.addEventListener(ima.AdErrorEvent.Type.AD_ERROR, (errorEvent) => {
+                        console.warn('AdsManager: AD_ERROR (manager) — falling through to main', errorEvent);
+                        completeAdLeg();
+                    });
+                    // D-08-06: IMA renders and owns its own Skip button (D-05 rules out
+                    // a custom skip UI), so this log is the only signal that proves the
+                    // control became available — observability only. It must never
+                    // call completeAdLeg() (this fires mid-ad, while a creative is
+                    // still rendering) and must never write to state (nothing consumes
+                    // an adSkippable field today, and speculative state violates
+                    // Simplicity First). No ad/creative metadata is interpolated: this
+                    // literal is captured verbatim into a committed evidence file by
+                    // 08-04 (T-08-05).
+                    adsManager.addEventListener(ima.AdEvent.Type.SKIPPABLE_STATE_CHANGED, () => {
+                        console.log('AdsManager: ad became skippable (D-08-06)');
+                    });
+                    adsManager.init(width, height);
+                    adsManager.start();
                 });
-                adsManager.init(width, height);
-                adsManager.start();
-            });
-            // Load the ad tag
-            const adsRequest = new ima.AdsRequest();
-            adsRequest.adTagUrl = config.ad;
-            adsLoader.requestAds(adsRequest);
-            // Register abort cleanup
-            signal.addEventListener('abort', () => {
-                if (this.imaAdsManager !== null) {
-                    this.imaAdsManager.destroy();
-                    this.imaAdsManager = null;
-                }
-                if (this.imaDisplayContainer !== null) {
-                    this.imaDisplayContainer.destroy();
-                    this.imaDisplayContainer = null;
-                }
-            }, { once: true });
+                // Load the ad tag
+                const adsRequest = new ima.AdsRequest();
+                adsRequest.adTagUrl = config.ad;
+                adsLoader.requestAds(adsRequest);
+            }
+            catch (error) {
+                // G-07-11: an ad-blocker blocking the CDN, a network error, or
+                // loadScript's own 10s timeout must fall through to main instead of
+                // escaping to the logging-only .catch() in lifecycle.ts.
+                console.warn('AdsManager: failed to load or initialize the IMA SDK — falling through to main (G-07-11)', error);
+                completeAdLeg();
+            }
+        }
+        /**
+         * Shared teardown for imaAdsManager and imaDisplayContainer, each behind
+         * its own null check and nulled immediately after — idempotent by
+         * construction. Called unconditionally on abort, and from the completion
+         * funnel only when this.imaAdsManager is still null (T-07-23).
+         */
+        releaseImaResources() {
+            if (this.imaAdsManager !== null) {
+                this.imaAdsManager.destroy();
+                this.imaAdsManager = null;
+            }
+            if (this.imaDisplayContainer !== null) {
+                this.imaDisplayContainer.destroy();
+                this.imaDisplayContainer = null;
+            }
         }
         /**
-         * Wait for a click event on the video element.
+         * Wait for a click event anywhere inside the player root.
          * Used to satisfy browser autoplay policies when autoplay is disabled.
          *
+         * G-07-11: the target widens from the video element to
+         * video.closest('.eb-player') (falling back to video itself for bare
+         * integrations), registered in the capture phase so a descendant that
+         * halts bubbling cannot hide the click from it. Observes only; never
+         * mutates the event, so the skip button and click-through link keep
+         * working exactly as they do today.
+         *
          * WR-05: single-shot settle flag guards against the click-vs-abort race —
          * Promise resolution is already idempotent but settled tightens the
          * contract by ensuring listener cleanup happens exactly once for either
@@ -4011,16 +4200,17 @@
          */
         waitForUserGesture(video, signal) {
             return new Promise((resolve) => {
+                const target = video.closest('.eb-player') ?? video;
                 let settled = false;
                 const settle = () => {
                     if (settled)
                         return;
                     settled = true;
-                    video.removeEventListener('click', onClick);
+                    target.removeEventListener('click', onClick, { capture: true });
                     resolve();
                 };
                 const onClick = () => settle();
-                video.addEventListener('click', onClick);
+                target.addEventListener('click', onClick, { capture: true });
                 // Clean up if aborted before click. The abort listener auto-removes
                 // via `{ once: true }`; the click listener is removed inside settle().
                 signal.addEventListener('abort', settle, { once: true });
@@ -4028,6 +4218,21 @@
         }
     }
 
+    /**
+     * G-07-12: absolute backstop for an intro pass where every other completion
+     * trigger is lost — no video `ended`, no `preroll-skip`, no `error-fatal`,
+     * and no `state.error` write. 90s cannot truncate a real brand intro
+     * (single-digit to ~30s assets) but converts an infinite hang into a bounded
+     * one.
+     *
+     * D-10: this value MUST stay strictly below AdsManager's
+     * INTRO_DEFERRAL_TIMEOUT_MS (120_000, src/integrations/ads-manager.ts) so
+     * the intro pass always completes before the ad leg falls through — intro →
+     * ad → main precedence must hold in the failure case too, not only the
+     * happy path. Test 14 in test/integrations/intro-stream-manager.test.ts
+     * asserts this ordering so a future edit to either constant fails loudly.
+     */
+    const INTRO_MAX_DURATION_MS = 90000;
     /**
      * IntroStreamManager owns the intro-stream lifecycle.
      *
@@ -4036,12 +4241,24 @@
      *     - the video element's native `ended` event
      *     - bus `preroll-skip` (from the PrerollOverlay skip button)
      *     - bus `error-fatal` (D-04 silent fall-through — intro must never block main)
+     *     - PlayerState `error` becoming non-null (G-07-12: the one signal shared
+     *       by two silent failure modes that never reach the bus —
+     *       StallWatchdog reload-budget exhaustion,
+     *       src/core/command-handler.ts:159-164, and a synchronous engine
+     *       init() throw caught in onAttach, src/engines/dash.ts:108-120 and
+     *       src/engines/hls.ts:194-207)
+     *     - the on-demand bus event that lets eb-player.ts's openMainStream()
+     *       guarantee the intro pass is finished before main opens (G-07-13
+     *       receiving half — see the bus.on() registration below for its name)
+     *     - an absolute INTRO_MAX_DURATION_MS backstop timer, armed in case no
+     *       other trigger ever fires
      * - Any one of those triggers calls a closure `complete()` exactly once
      *   (idempotent via a `completed` boolean guard), which flips
      *   state.introStreamPlaying = false and emits `intro-stream-complete`.
      * - On abort, the video `ended` listener is removed explicitly via
-     *   removeEventListener. Bus listeners auto-clean via the `{ signal }` option
-     *   (see src/core/event-bus.ts on()).
+     *   removeEventListener and the backstop timer is cleared. Bus and state
+     *   listeners auto-clean via the `{ signal }` option (see
+     *   src/core/event-bus.ts on() and src/core/player-state.ts on()).
      *
      * Scope: this manager listens and emits — it does NOT itself open the intro
      * stream. The engine open() call is owned by eb-player.ts (single source of
@@ -4052,8 +4269,10 @@
         /**
          * Initialize intro-stream lifecycle tracking.
          * - Skips entirely if config.preroll is falsy (no state flip, no listeners).
-         * - Otherwise flips state.introStreamPlaying = true and registers the three
-         *   completion triggers (video `ended`, bus `preroll-skip`, bus `error-fatal`).
+         * - Otherwise flips state.introStreamPlaying = true and registers the
+         *   completion triggers (video `ended`, bus `preroll-skip`, bus
+         *   `error-fatal`, PlayerState `error`, the on-demand force-completion bus
+         *   event, and the INTRO_MAX_DURATION_MS backstop timer).
          */
         async init(config, state, bus, video, signal) {
             if (!config.preroll)
@@ -4068,14 +4287,18 @@
             // Mirror outer aborts onto the local controller so dispose() still
             // cleans everything up.
             signal.addEventListener('abort', () => local.abort(), { once: true });
+            // Initialized to 0; clearing a zero timer handle is a no-op, so no null
+            // guard is needed around either clear call below.
+            let backstopTimer = 0;
             let completed = false;
             const complete = () => {
                 if (completed)
                     return;
                 completed = true;
+                clearTimeout(backstopTimer);
                 state.introStreamPlaying = false;
                 bus.emit('intro-stream-complete');
-                local.abort(); // tear down bus listeners after the intro completes
+                local.abort(); // tear down bus/state listeners after the intro completes
             };
             const onEnded = () => complete();
             video.addEventListener('ended', onEnded);
@@ -4086,8 +4309,40 @@
                 console.warn('IntroStreamManager: intro stream errored — falling through to main');
                 complete();
             }, { signal: local.signal });
+            // G-07-12: state.error is the one signal shared by two silent failure
+            // modes that never reach the bus — StallWatchdog reload-budget
+            // exhaustion (src/core/command-handler.ts:159-164) and a synchronous
+            // engine init() throw caught in onAttach (src/engines/dash.ts:108-120,
+            // src/engines/hls.ts:194-207). Both writers are shared with the MAIN
+            // pass, so the fix lives here (the intro-owning component) rather than
+            // in either shared file. The Proxy `set` trap already no-ops on an
+            // unchanged value, but a `null` write (e.g. openMainStream() clearing a
+            // stale error) must still never be read as "the intro finished".
+            state.on('error', (newValue) => {
+                if (newValue === null)
+                    return;
+                console.warn('IntroStreamManager: intro stream errored via state.error — falling through to main');
+                complete();
+            }, { signal: local.signal });
+            // G-07-13 receiving half: openMainStream() (src/eb-player.ts, plan
+            // 07-10) emits this to guarantee the intro pass is finished before main
+            // opens. No `completed` re-check is needed or wanted here: complete()
+            // aborts `local`, which removes this listener, so the handler below is
+            // only ever reachable while the intro is still live — adding a guard
+            // would create an unreachable branch.
+            bus.on('force-intro-complete', () => {
+                console.warn('IntroStreamManager: main is opening — force-completing the intro pass');
+                complete();
+            }, { signal: local.signal });
+            // G-07-12: absolute bound — even if no other trigger ever fires, the
+            // intro pass still completes within INTRO_MAX_DURATION_MS.
+            backstopTimer = setTimeout(() => {
+                console.warn('IntroStreamManager: intro stream exceeded INTRO_MAX_DURATION_MS — falling through to main');
+                complete();
+            }, INTRO_MAX_DURATION_MS);
             signal.addEventListener('abort', () => {
                 video.removeEventListener('ended', onEnded);
+                clearTimeout(backstopTimer);
             }, { once: true });
         }
     }
@@ -5500,6 +5755,153 @@
         };
     }
 
+    /**
+     * Segment (fragment) CDN token signing — shared primitive.
+     *
+     * Extends CDN token signing from manifests to segments, behind an opt-in flag
+     * (`EngineSettings.signSegmentsWithCdnToken`). Each segment is signed with the
+     * grant carried by its OWN parent playlist — read from `context.frag.baseurl`,
+     * the object hls.js itself parsed that fragment from — never from any store,
+     * cache, or shared manager state. This makes cross-rendition mis-signing
+     * structurally impossible rather than merely unlikely.
+     *
+     * CRITICAL: this module must never acquire or refresh a token. It only reads
+     * data already present on the fragment context handed to it by hls.js. Any
+     * acquisition call here would reintroduce the single-slot cache reuse in
+     * `CDNTokenManager.lastTokenResponse`, which hands one rendition's grant to
+     * another — the exact failure this design forbids.
+     *
+     * Token expiry model (CDN-04, D-07): a segment carries whatever grant its
+     * parent playlist carried when hls.js parsed it. Live playlists reload on
+     * their own cadence, so their fragments pick up refreshed grants with no
+     * refresh machinery here — reload IS the refresh path. VOD playlists are
+     * parsed exactly once by hls.js 1.6.10 (its level controller only
+     * (re)requests a playlist it has none of, or one that is live), so a VOD
+     * asset's segment grants are frozen at first parse for the asset's entire
+     * duration. If a token's lifetime is shorter than the asset's duration, later
+     * segments will be rejected by the edge and surface through the existing
+     * error/retry path. This is an accepted operational constraint — the token
+     * service's lifetime must exceed the longest VOD asset — not an oversight;
+     * D-07 chose reload-cadence refresh and CONTEXT.md defers a proactive
+     * near-expiry refresh path with a named revisit condition (a real asset shown
+     * to outlive its grant). No timer, interval, or scheduled re-fetch belongs in
+     * this module.
+     */
+    // ---------------------------------------------------------------------------
+    // Supported token-type family (D-03) — query-param tokens only. Akamai's
+    // path-segment mechanic (`appendAkamaiTokenParams`) is a different shape and
+    // deliberately not extended here.
+    // ---------------------------------------------------------------------------
+    const SEGMENT_SIGNING_TOKEN_TYPES = Object.freeze([
+        TOKEN_TYPES.EASY_B,
+        TOKEN_TYPES.VENOM,
+        TOKEN_TYPES.BUNNY
+    ]);
+    /**
+     * Builds the single diagnostic string used for every unsupported-token-type
+     * case. Names the flag and the offending token type (or says none is
+     * configured) and lists the supported ones. Never includes a token value.
+     */
+    function segmentSigningUnsupportedMessage(tokenType) {
+        const supported = SEGMENT_SIGNING_TOKEN_TYPES.join(', ');
+        const described = tokenType === undefined ? 'no token type configured' : `token type "${tokenType}"`;
+        return `signSegmentsWithCdnToken: segment signing is not supported for ${described}. Supported token types: ${supported}.`;
+    }
+    /**
+     * A fresh, all-zero `LoaderStats`-shaped object for the fail-loud path's
+     * `onError` call. hls.js's own error-handling code reads fields off this
+     * object (e.g. `stats.loaded`); passing `undefined` risks a `TypeError`
+     * inside hls.js itself instead of the clean error this module intends to
+     * produce. Returns a new object per call — never shared/mutated state — so
+     * nothing downstream can observe stale values from a previous failed load.
+     */
+    function createEmptySegmentLoaderStats() {
+        return {
+            aborted: false,
+            loaded: 0,
+            total: 0,
+            retry: 0,
+            chunkCount: 0,
+            bwEstimate: 0,
+            loading: { start: 0, first: 0, end: 0 },
+            parsing: { start: 0, end: 0 },
+            buffering: { start: 0, first: 0, end: 0 }
+        };
+    }
+    /**
+     * Pure transfer: reads `token`, `expires` and `token_path` off the parent
+     * playlist URL's query string and reapplies them to the segment URL via the
+     * same static primitive that signs manifests, so a signed segment URL is
+     * shaped exactly like a signed manifest URL. Returns the segment URL
+     * unchanged when the playlist carries no token, or when either URL cannot be
+     * parsed (a thrown exception inside a loader is a dead player, not a signing
+     * failure).
+     */
+    function signSegmentUrlFromPlaylist(segmentUrl, parentPlaylistUrl) {
+        try {
+            const playlistUrl = new URL(parentPlaylistUrl);
+            const token = playlistUrl.searchParams.get('token');
+            if (!token)
+                return segmentUrl;
+            const expires = playlistUrl.searchParams.get('expires');
+            const tokenPath = playlistUrl.searchParams.get('token_path');
+            return CDNTokenManager.appendTokenParams(segmentUrl, token, expires, tokenPath);
+        }
+        catch {
+            return segmentUrl;
+        }
+    }
+    /**
+     * Returns a loader class extending `BaseLoader`, built exactly like the
+     * existing playlist loader: call `super()`, bind the inherited `load`, then
+     * assign an own `load` property that reads `context.frag?.baseurl`.
+     *
+     * `tokenSource` is captured by closure — never stored on `this` and never
+     * used to acquire or refresh a token.
+     */
+    function createSegmentTokenLoaderClass(BaseLoader, tokenSource) {
+        // WR-02: the "unsupported token type" diagnostic is logged to the console
+        // at most once per loader CLASS — i.e. once per engine session that calls
+        // createSegmentTokenLoaderClass, since hls.js constructs a fresh loader
+        // instance per fragment load and an instance-level flag would reset every
+        // load. `callbacks.onError` still fires on every load below, unguarded —
+        // hls.js needs the error signal each time to drive its own retry/fatal
+        // escalation; only the console spam is deduplicated.
+        let unsupportedTokenTypeLogged = false;
+        class SegmentTokenLoader extends BaseLoader {
+            constructor(loaderConfig) {
+                super(loaderConfig);
+                const originalLoad = this.load.bind(this);
+                this.load = function (context, loadConfig, callbacks) {
+                    // D-03/D-04: a token type outside the query-param family (akamai, or
+                    // none configured) must fail visibly rather than emit an unsigned
+                    // request. A silent passthrough here is the same undiagnosable 403
+                    // from the edge that D-04 forbids, so it gets the same treatment as
+                    // the akamai case: no delegation to the base loader, and a named
+                    // error surfaced through hls.js's own error callback.
+                    const tokenType = tokenSource.tokenType;
+                    if (!tokenType || !SEGMENT_SIGNING_TOKEN_TYPES.includes(tokenType)) {
+                        const message = segmentSigningUnsupportedMessage(tokenType);
+                        if (!unsupportedTokenTypeLogged) {
+                            unsupportedTokenTypeLogged = true;
+                            console.error(message);
+                        }
+                        callbacks.onError({ code: 0, text: message }, context, null, createEmptySegmentLoaderStats());
+                        return;
+                    }
+                    const baseUrl = context.frag?.baseurl;
+                    if (!baseUrl || !context.url) {
+                        originalLoad(context, loadConfig, callbacks);
+                        return;
+                    }
+                    context.url = signSegmentUrlFromPlaylist(context.url, baseUrl);
+                    originalLoad(context, loadConfig, callbacks);
+                };
+            }
+        }
+        return SegmentTokenLoader;
+    }
+
     /**
      * HlsEngine — HLS playback engine.
      *
@@ -5683,6 +6085,7 @@
             const hlsSafeSettings = { ...hlsEngineSettings };
             delete hlsSafeSettings['extraParamsCallback'];
             delete hlsSafeSettings['onCDNTokenError'];
+            delete hlsSafeSettings['signSegmentsWithCdnToken'];
             const driverConfig = {
                 autoStartLoad: !config.startAt,
                 enableWorker: true,
@@ -5726,6 +6129,12 @@
                     }
                 }
                 driverConfig.pLoader = PLoader;
+                // Opt-in (D-06): sign segment requests with the grant carried by their
+                // own parent playlist. Off by default so segment request shapes stay
+                // byte-identical to today's when the flag is unset.
+                if (config.engineSettings.signSegmentsWithCdnToken === true) {
+                    driverConfig.fLoader = createSegmentTokenLoaderClass(Hls.DefaultConfig.loader, tm);
+                }
             }
             // Inject custom ABR controller unless disabled
             if (!config.disableCustomAbr) {
@@ -5978,7 +6387,14 @@
      * transient network failures (segment fetch, manifest re-fetch, etc.)
      * never permanently stop playback.
      */
-    function applyDashRetrySettings(driver) {
+    /**
+     * Bounded retry-attempt count used for the intro pass so an unreachable
+     * intro manifest surrenders quickly instead of retrying forever. With
+     * retryIntervals at 1000ms this surfaces the dash.js ERROR event roughly
+     * two seconds after an unreachable manifest.
+     */
+    const INTRO_PASS_RETRY_ATTEMPTS = 2;
+    function applyDashRetrySettings(driver, options = {}) {
         driver.updateSettings({
             streaming: {
                 retryIntervals: {
@@ -5993,16 +6409,17 @@
                 }
             }
         });
+        const retryAttempts = options.introPass === true ? INTRO_PASS_RETRY_ATTEMPTS : Infinity;
         driver.updateSettings({
             streaming: {
                 retryAttempts: {
-                    MPD: Infinity,
-                    XLinkExpansion: Infinity,
-                    InitializationSegment: Infinity,
-                    IndexSegment: Infinity,
-                    MediaSegment: Infinity,
-                    BitstreamSwitchingSegment: Infinity,
-                    other: Infinity,
+                    MPD: retryAttempts,
+                    XLinkExpansion: retryAttempts,
+                    InitializationSegment: retryAttempts,
+                    IndexSegment: retryAttempts,
+                    MediaSegment: retryAttempts,
+                    BitstreamSwitchingSegment: retryAttempts,
+                    other: retryAttempts,
                     lowLatencyMultiplyFactor: 1
                 }
             }
@@ -6171,7 +6588,12 @@
      * Ported from component/engines/dash.js
      *
      * Extends BaseEngine to bridge dash.js MediaPlayer events to PlayerState.
-     * Uses CDN loader, CDNTokenManager, StallWatchdog, and DASH retry settings.
+     * Uses the CDN loader and StallWatchdog, plus DASH retry settings and ABR rules.
+     *
+     * CDN token signing (manifests and segments alike) is HLS-only by design —
+     * this engine has no `CDNTokenManager` integration at all (Phase 08.1 / D-05).
+     * DASH segments are `.m4s`, so nothing written for HLS's fragment-loader
+     * token signing should be assumed to generalise here.
      *
      * CRITICAL: driver instance is a private class field — NEVER stored in PlayerState.
      */
@@ -6184,6 +6606,11 @@
             // Private — NEVER in PlayerState
             this.driver = null;
             this.dvrErrorHandler = null;
+            // True when this engine instance is loading the intro (preroll) stream
+            // rather than the main stream — see D-04 / G-07-10 in init().
+            this.isIntroPass = false;
+            // Guards the one-shot error-fatal emit on the intro pass (T-07-21).
+            this.introFallThroughReported = false;
         }
         getDriver() {
             return this.driver;
@@ -6290,6 +6717,10 @@
             const { config, video, state, signal } = this;
             if (!config || !video || !state || !signal)
                 return;
+            // D-04 / G-07-10: identify the intro pass so a permanently-unreachable
+            // intro manifest can fall through to main instead of looping forever.
+            // Same gate shape as src/engines/hls.ts:445.
+            this.isIntroPass = Boolean(config.preroll) && this.loadSourceUrl === config.preroll;
             const dashjsUrl = config.dashjs;
             if (!dashjsUrl) {
                 throw new Error('DashEngine: config.dashjs URL is required');
@@ -6319,7 +6750,7 @@
             player.initialize(video, this.loadSourceUrl || config.src || '', config.autoplay ?? false);
             // Apply retry settings if requested
             if (config.retry) {
-                applyDashRetrySettings(player);
+                applyDashRetrySettings(player, { introPass: this.isIntroPass });
             }
             // Apply custom ABR rule unless disabled
             if (!config.disableCustomAbr) {
@@ -6420,12 +6851,34 @@
             player.on(events['TRACK_CHANGE_RENDERED'], () => {
                 state.currentAudioTrack = player.getQualityFor('audio');
             });
-            // ERROR: log dash.js errors
+            // ERROR: log dash.js errors, and on the intro pass fall through to main
             player.on(events['ERROR'], (eventData) => {
-                const typedData = eventData;
-                console.warn('DashEngine error:', typedData?.error?.message ?? typedData?.error ?? typedData);
+                this.handleDriverError(eventData);
             });
         }
+        /**
+         * Handles a dash.js ERROR event.
+         *
+         * D-04 / G-07-10: always logs, exactly as before (test/engines/dash.test.ts:619
+         * and :1156 assert this unchanged). On the intro pass only — gated by
+         * this.isIntroPass, computed once in init() from
+         * `Boolean(config.preroll) && this.loadSourceUrl === config.preroll` — a fatal
+         * manifest/segment error stops the stall watchdog and emits `error-fatal`
+         * exactly once (guarded by introFallThroughReported) so
+         * IntroStreamManager.complete() can fire and openMainStream() run instead of
+         * the watchdog reopening the (still intro) lastSrc in a loop. On the main
+         * pass this method only warns — main-stream resilience must stay untouched.
+         */
+        handleDriverError(eventData) {
+            const typedData = eventData;
+            console.warn('DashEngine error:', typedData?.error?.message ?? typedData?.error ?? typedData);
+            if (!this.isIntroPass || this.introFallThroughReported)
+                return;
+            this.introFallThroughReported = true;
+            this.stopWatchdog();
+            const errorKey = typedData?.error?.code ?? typedData?.error?.message ?? 'unknown';
+            this.bus?.emit('error-fatal', { code: 'NETWORK', message: `Intro stream error: ${errorKey}` });
+        }
     }
 
     /**
@@ -6581,18 +7034,30 @@
                 }
                 PLoader = SnapshotPLoader;
             }
+            // Build fLoader class with segment CDN token signing — opt-in (D-06), off by
+            // default so segment request shapes stay byte-identical to today's when the
+            // flag is unset. Reuses the shared factory built for the main engine's
+            // fragment loader (`segment-token-loader.ts`) rather than re-implementing the
+            // signing logic here. tokenManager is the same closure-captured reference
+            // used above for pLoader (Pitfall 6) — never read off `this`.
+            let FLoader;
+            if (tokenManager && this.config.engineSettings?.signSegmentsWithCdnToken === true) {
+                FLoader = createSegmentTokenLoaderClass(HlsConstructor.DefaultConfig.loader, tokenManager);
+            }
             // Strip player-specific keys that are NOT hls.js config options — they contain
             // non-serializable functions that cause DataCloneError when hls.js posts config to its worker.
             const rawSettings = { ...(this.config.engineSettings ?? {}) };
             delete rawSettings['extraParamsCallback'];
             delete rawSettings['onCDNTokenError'];
+            delete rawSettings['signSegmentsWithCdnToken'];
             const driverConfig = {
                 startLevel: 0,
                 enableWebVTT: false,
                 enableWorker: false,
                 maxBufferLength: 1,
                 ...rawSettings,
-                ...(PLoader ? { pLoader: PLoader } : {})
+                ...(PLoader ? { pLoader: PLoader } : {}),
+                ...(FLoader ? { fLoader: FLoader } : {})
             };
             const driver = new HlsConstructor(driverConfig);
             this.driver = driver;
@@ -6893,6 +7358,18 @@
         // observably awaitable.
         return new Promise((resolve) => setTimeout(resolve, EME_TEARDOWN_DELAY_MS));
     }
+    /**
+     * G-07-11: bounded backstop so main always opens even when the ad leg never
+     * produces 'ad-complete'. Longer than AdsManager's own AD_LEG_TIMEOUT_MS
+     * (20s) so that more precise, better-logged inner mechanism wins first in a
+     * live player — this is the outer safety net, not the primary signal. Covers
+     * two cases the inner mechanism cannot: an AdsManager that was never
+     * constructed at all (noUi:true, or a null ads container — lifecycle.ts
+     * skips the branch that would create one), and an AdsManager that obtained
+     * its manager from the loader (disarming its own bound) whose creative then
+     * never reached the screen.
+     */
+    const MAIN_OPEN_FALLBACK_MS = 30000;
     // ---------------------------------------------------------------------------
     // Public API
     // ---------------------------------------------------------------------------
@@ -7103,13 +7580,17 @@
         controller.bus.on('error-fatal', () => {
             inst.p2p?.stop();
         }, { signal: controller.signal });
-        // Phase 7 — intro→main orchestration.
+        // Phase 7/8 — pre-main leg orchestration.
         // When mergedConfig.preroll is set, open the intro stream first, then on
         // bus 'intro-stream-complete' (emitted by IntroStreamManager on video.ended,
         // preroll-skip, or error-fatal) close → 500ms EME teardown delay → open main.
         // If config.ad is also set, wait additionally for bus 'ad-complete' before
         // opening main (D-10: intro → ad → main precedence).
         //
+        // D-02 (Phase 8): when mergedConfig.preroll is NOT set but mergedConfig.ad
+        // IS, main is gated on 'ad-complete' alone (no intro leg to precede it) —
+        // see the `hasAd` branch below and tryOpenMainAdOnly().
+        //
         // Runtime mute override: the live <video>.muted and PlayerState.muted are
         // forced to false for the intro pass (D-13 — intros always audible) and
         // restored to `originalMuted` before opening main. We do NOT mutate
@@ -7119,7 +7600,22 @@
         // P2P opt-in: `mergedConfig.manager` IS re-read on each reference.open() in
         // the P2P branch (eb-player.ts:192), so we config-level swap it to false for
         // the intro pass and restore it for main (D-08 — P2P attaches only to main).
+        // G-07-11: two independent paths can now reach openMainStream — the
+        // ad-complete handler and the MAIN_OPEN_FALLBACK_MS backstop — so it must
+        // be idempotent.
+        let mainOpened = false;
         const openMainStream = () => {
+            if (mainOpened)
+                return;
+            mainOpened = true;
+            // G-07-13 / D-10: force-complete the intro pass on EVERY path into main —
+            // including ad-complete firing with no prior intro-stream-complete (a hung
+            // intro deferred through AdsManager's INTRO_DEFERRAL_TIMEOUT_MS). This is a
+            // FORCE-complete, never a wait: IntroStreamManager.complete() runs
+            // synchronously, so D-04 liveness is untouched — main still opens in the
+            // same tick. complete() is idempotent, so on the normal ordering (intro
+            // already finished) this is a no-op; the listener is already torn down.
+            controller.bus.emit('force-intro-complete');
             if (video !== null) {
                 video.muted = originalMuted;
             }
@@ -7145,8 +7641,100 @@
                 return;
             reference.open(mergedConfig.src);
         };
-        if (mergedConfig.preroll) {
-            const hasAd = Boolean(mergedConfig.ad);
+        // D-02 (Phase 8): promoted out of the `preroll` branch so both the
+        // intro+ad and ad-only configurations share one gated main-open path — see
+        // the assumption_delta_decision in 08-01-PLAN.md ("pluralization": preroll
+        // and ad are two variants of a single "pre-main leg" concept).
+        const hasIntro = Boolean(mergedConfig.preroll);
+        const hasAd = Boolean(mergedConfig.ad);
+        // G-07-11: bounds the ad leg from this player's side, independent of
+        // AdsManager's own internal watchdog — see MAIN_OPEN_FALLBACK_MS.
+        let mainOpenFallbackTimer = null;
+        const clearMainOpenFallback = () => {
+            if (mainOpenFallbackTimer !== null) {
+                clearTimeout(mainOpenFallbackTimer);
+                mainOpenFallbackTimer = null;
+            }
+        };
+        const armMainOpenFallback = (onExpire) => {
+            mainOpenFallbackTimer = setTimeout(() => {
+                if (controller.signal.aborted)
+                    return;
+                // CR-01: an ad still playing when the bound elapses is legitimate — a
+                // 60s creative outlives the 30s window. But simply returning here would
+                // retire the ONLY remaining bound on the ad leg: AdsManager disarms its
+                // own AD_LEG_TIMEOUT_MS watchdog as soon as IMA hands back a manager.
+                // An ad that then stalls (no ad-complete, no AD_ERROR) would strand main
+                // playback for the life of the player. Re-arm instead, so the leg stays
+                // bounded on every path for as long as the ad genuinely progresses.
+                if (controller.state.adPlaying) {
+                    armMainOpenFallback(onExpire);
+                    return;
+                }
+                console.warn('eb-player: ad leg produced no ad-complete within the bound — falling through to main (G-07-11)');
+                onExpire();
+            }, MAIN_OPEN_FALLBACK_MS);
+        };
+        // WR-03: clear the fallback timer on dispose — otherwise a torn-down
+        // player leaves a pending setTimeout holding a closure reference alive.
+        controller.signal.addEventListener('abort', () => {
+            clearMainOpenFallback();
+        }, { once: true });
+        // D-08-02 (Phase 8): the two-gate compound funnel for the ad-only
+        // configuration. With no intro leg, main can open only once BOTH the ad
+        // leg has settled (adGateOpen) AND the user has requested playback
+        // (playGateOpen) — see the `else if (hasAd)` branch below. With no ad
+        // configured the ad gate starts open. With `autoplay: false`, the ad-leg
+        // bound is now armed unconditionally (D-08-03) and sits BEFORE
+        // AdsManager's `await gesturePromise`, so `ad-complete` can fire ~20s
+        // after page load with zero user interaction. Without this play gate that
+        // alone would fetch the CDN token and load the main manifest, breaking the
+        // documented no-prefetch contract (src/eb-player.ts:598-601 below). The
+        // gate is deliberately kept, not dropped (A-OQ1, 08-01-PLAN.md).
+        let adGateOpen = !hasAd;
+        let playGateOpen = Boolean(mergedConfig.autoplay);
+        let deferredPlaybackStarted = false;
+        const startDeferredPlayback = () => {
+            if (deferredPlaybackStarted)
+                return;
+            deferredPlaybackStarted = true;
+            const engine = inst.engine;
+            if (engine === null || video === null)
+                return;
+            // Honor the user's click intent. CommandHandler's earlier bus.on('play')
+            // listener fired before us with no source attached, so its video.play()
+            // was a silent no-op. Wait for driverReady (attachMedia + loadSource
+            // done) then start playback ourselves.
+            engine.driverReady.then(() => {
+                const playResult = video.play();
+                if (playResult && typeof playResult.catch === 'function') {
+                    playResult.catch((error) => {
+                        console.warn('EBPlayer: deferred play() rejected', error);
+                    });
+                }
+            });
+        };
+        const tryOpenMainAdOnly = () => {
+            if (!adGateOpen || !playGateOpen)
+                return;
+            openMainStream();
+            if (!mergedConfig.autoplay) {
+                startDeferredPlayback();
+            }
+        };
+        if (hasAd) {
+            controller.bus.on('ad-complete', () => {
+                clearMainOpenFallback();
+                adGateOpen = true;
+                if (hasIntro) {
+                    openMainStream();
+                }
+                else {
+                    tryOpenMainAdOnly();
+                }
+            }, { signal: controller.signal });
+        }
+        if (hasIntro) {
             controller.bus.on('intro-stream-complete', () => {
                 reference.close();
                 // WR-08: restore PlayerState.muted synchronously — DO NOT wait for the
@@ -7160,18 +7748,25 @@
                 controller.state.muted = originalMuted;
                 // EME teardown delay — see waitForEmeTeardown / EME_TEARDOWN_DELAY_MS.
                 waitForEmeTeardown().then(() => {
+                    // G-07-13: main may already be open — the ad-complete path force-
+                    // completes the intro (openMainStream() emits force-intro-complete),
+                    // which re-enters this handler synchronously before this async
+                    // continuation ever runs. Arming the fallback timer here would be an
+                    // orphan: main is already open and nothing will ever clear it.
+                    if (mainOpened)
+                        return;
                     if (!hasAd) {
                         openMainStream();
+                        return;
                     }
-                    // If hasAd, the ad-complete handler below will call openMainStream
-                    // after the AdsManager finishes (D-10 precedence).
+                    // hasAd: the ad-complete handler above will normally call
+                    // openMainStream after the AdsManager finishes (D-10 precedence).
+                    // G-07-11: arm the bounded fallback in case it never does — an
+                    // AdsManager that was never constructed, or one whose creative
+                    // never rendered after disarming its own bound.
+                    armMainOpenFallback(openMainStream);
                 });
             }, { signal: controller.signal });
-            if (hasAd) {
-                controller.bus.on('ad-complete', () => {
-                    openMainStream();
-                }, { signal: controller.signal });
-            }
             // Force runtime mute off for the intro pass — applied to the LIVE <video>
             // element and PlayerState, NOT to mergedConfig.muted (no-op for runtime).
             if (video !== null) {
@@ -7184,6 +7779,52 @@
             controller.config.manager = false;
             reference.open(mergedConfig.preroll);
         }
+        // D-02/D-08-02 (Phase 8): ad-only configuration — no intro stream, so this
+        // must NOT call reference.open() directly and must NOT copy any
+        // intro-specific step (no intro source open, no force-unmute, no P2P
+        // manager swap, no intro-stream-complete listener). Main opens only via
+        // tryOpenMainAdOnly() once both gates clear.
+        else if (hasAd) {
+            if (mergedConfig.autoplay) {
+                // playGateOpen is already true (set above) — main opens on whichever
+                // of 'ad-complete' or the fallback arrives first. tryOpenMainAdOnly()
+                // alone is NOT a real backstop here: it returns early unless
+                // adGateOpen is already true, and the only place that flips
+                // adGateOpen is the ad-complete handler above, which clears this very
+                // timer before calling it — so an unmodified tryOpenMainAdOnly passed
+                // directly can never observe adGateOpen === false the one time it
+                // would need to. Force the ad gate open in the callback itself so the
+                // bound can still open main when ad-complete never arrives at all
+                // (e.g. AdsManager is never constructed) — see G-07-11.
+                armMainOpenFallback(() => {
+                    adGateOpen = true;
+                    tryOpenMainAdOnly();
+                });
+            }
+            else {
+                // D-08-02: the 'play' gate — see the rationale comment above
+                // tryOpenMainAdOnly(). A repeat click must be inert.
+                controller.bus.on('play', () => {
+                    if (playGateOpen)
+                        return;
+                    playGateOpen = true;
+                    if (adGateOpen) {
+                        // The ad leg already settled — main can open now.
+                        tryOpenMainAdOnly();
+                        startDeferredPlayback();
+                    }
+                    else {
+                        // The ad leg is still in flight — start the outer 30s backstop
+                        // from the play request, not from page load, using the same
+                        // force-the-gate shape as the autoplay:true arm above.
+                        armMainOpenFallback(() => {
+                            adGateOpen = true;
+                            tryOpenMainAdOnly();
+                        });
+                    }
+                }, { signal: controller.signal });
+            }
+        }
         // Auto-open the stream if src is provided in config (matches legacy player behaviour
         // where consumers call start({ src: '...' }) and expect playback to begin immediately).
         // When autoplay is false, defer open() until the user requests play — this avoids
@@ -7199,21 +7840,7 @@
                         return;
                     deferredOpen = false;
                     reference.open(mergedConfig.src);
-                    // Honor the user's click intent. CommandHandler's earlier bus.on('play')
-                    // listener fired before us with no source attached, so its video.play()
-                    // was a silent no-op. Wait for driverReady (attachMedia + loadSource
-                    // done) then start playback ourselves.
-                    const engine = inst.engine;
-                    if (engine !== null && video !== null) {
-                        engine.driverReady.then(() => {
-                            const playResult = video.play();
-                            if (playResult && typeof playResult.catch === 'function') {
-                                playResult.catch((error) => {
-                                    console.warn('EBPlayer: deferred play() rejected', error);
-                                });
-                            }
-                        });
-                    }
+                    startDeferredPlayback();
                 }, { signal: controller.signal });
             }
         }