prismcast 1.10.2 → 1.11.0

package/dist/streaming/monitor.js

@@ -1,8 +1,9 @@
-import { EvaluateTimeoutError, LOG, capitalize, formatError, getAbortSignal, isSessionClosedError, runWithStreamContext, startTimer } from "../utils/index.js";
-import { RECOVERY_METHODS, checkCircuitBreaker, createRecoveryMetrics, formatIssueType, formatRecoveryDuration, getIssueCategory, getIssueDescription, getRecoveryMethod, recordRecoveryAttempt, recordRecoverySuccess, resetCircuitBreaker } from "./recovery.js";
+import { EvaluateTimeoutError, LOG, capitalize, formatError, getAbortSignal, isPageDeathError, isSessionClosedError, runWithStreamContext, startTimer } from "../utils/index.js";
+import { RECOVERY_METHODS, checkCircuitBreaker, classifyNativeSegmentHealth, computeNextRecoveryLevel, createRecoveryMetrics, deriveStreamHealth, formatIssueType, formatRecoveryDuration, getIssueCategory, getIssueDescription, getRecoveryMethod, recordRecoveryAttempt, recordRecoverySuccess, resetCircuitBreaker, shouldTriggerRecovery } from "./recovery.js";
 import { applyVideoStyles, buildVideoSelectorType, checkVideoPresence, enforceVideoVolume, ensurePlayback, findVideoContext, getVideoState, tuneToChannel, validateVideoElement, verifyFullscreen } from "../browser/video.js";
 import { getLastSegmentHasVideo, getLastSegmentSize, getStream, getStreamMemoryUsage } from "./registry.js";
 import { CONFIG } from "../config/index.js";
+import { clearNativeInitState } from "./hlsSegments.js";
 import { clearProbeCache } from "../native/probe.js";
 import { emitStreamHealthChanged } from "./statusEmitter.js";
 import { getChannelLogo } from "../config/userChannels.js";
@@ -33,8 +34,9 @@ import { resizeAndMinimizeWindow } from "../browser/cdp.js";
  * @param streamInfo - Stream metadata for status updates.
  * @param onCircuitBreak - Callback function called when circuit breaker trips.
  * @param onTabReplacement - Optional callback for tab replacement recovery. When provided and 3+ consecutive timeouts occur, this is called to replace the hung tab.
- *                           If null/undefined, tab replacement is not available and timeouts will eventually trip the circuit breaker.
- * @returns A cleanup function to stop the monitor.
+ *                           If null/undefined, tab replacement is not available; sustained evaluate timeouts are only surfaced via status (lastIssueType) with no
+ *                           automatic recovery escalation.
+ * @returns A MonitorHandle exposing the live recovery metrics (getMetrics) and a self-contained dispose that stops the monitor's polling interval.
  */
 export function monitorPlaybackHealth(page, context, profile, url, streamId, streamInfo, onCircuitBreak, onTabReplacement) {
     /* Monitor state. These track the video's behavior over time and control recovery decisions. Mutable variables are organized into typed state objects by subsystem
@@ -63,6 +65,15 @@ export function monitorPlaybackHealth(page, context, profile, url, streamId, str
     let fullscreenReapplyCount = 0;
     // Flag indicating the cleanup function was called. When true, the next interval check will clear itself.
     let intervalCleared = false;
+    /* Serialization flag for the tick body. The interval fires on its schedule whether or not the previous tick's async body has settled, so without this a single
+     * slow evaluate - bounded only by the evaluate timeout, seven and a half intervals long at the default cadence - stacks concurrent bodies that each mutate the
+     * shared counters and can each independently reach a recovery decision. With it, one dispatched tick body is the most that can be in flight.
+     *
+     * The scope is exactly that: the dispatched body. A native-mode recovery is launched fire-and-forget from inside a tick and outlives the body that started it,
+     * and recoveryState.inProgress is the guard covering that window - which is why every native recovery entry point raises that flag synchronously before its
+     * first await, and why a future native recovery path must do the same or it runs under neither guard.
+     */
+    let tickInProgress = false;
     // The current video context (page or frame). This can change after a page navigation recovery, when we need to find the new video context.
     let currentContext = context;
     // Circuit breaker state. Tracks total failures within a time window and trips (terminates the stream) when too many failures occur.
@@ -70,9 +81,20 @@ export function monitorPlaybackHealth(page, context, profile, url, streamId, str
     // Counter for consecutive "video not found" occurrences. We apply a grace period before triggering recovery to handle momentary context invalidation or readyState
     // fluctuations. Reset to 0 when video is found.
     let videoNotFoundCount = 0;
-    // Counter for consecutive evaluate timeouts. When the browser tab becomes unresponsive, evaluate() calls will timeout instead of returning data. After 3
-    // consecutive timeouts, we trigger tab replacement recovery (if the callback is provided). Reset to 0 on successful getVideoState().
+    /* Counter for consecutive evaluate timeouts. When the browser tab becomes unresponsive, evaluate() calls time out instead of returning data. The counter drives
+     * two things: the three-strike threshold that triggers tab replacement recovery (when the callback is provided), and the timeout the next state read is issued
+     * with - any non-zero value arms the short confirmation probe below. Reset to 0 on a successful getVideoState() and on every other piece of direct evidence
+     * that the tab answers evaluates.
+     */
     let consecutiveTimeouts = 0;
+    /* Evaluate bound for a state read issued while a timeout streak is open. One full-length timeout is what detects a hung tab; the reads that follow only have
+     * to tell a still-hung tab from a responsive one, and a tab that answers at all answers well inside this. At the default cadence three strikes then accumulate
+     * in roughly twenty seconds - one full timeout to detect, two short probes to confirm - rather than three full timeouts.
+     *
+     * The bound is fixed rather than derived from the operator's monitor interval: how quickly a tab must answer to count as alive is a property of the tab, not of
+     * how often we poll it, and the wall-clock to replacement scales with the chosen interval either way.
+     */
+    const UNRESPONSIVE_PROBE_TIMEOUT = 2000;
     // Last known video state for status reporting.
     let lastVideoState = null;
     // Recovery metrics tracked throughout the stream's lifetime.
@@ -83,15 +105,16 @@ export function monitorPlaybackHealth(page, context, profile, url, streamId, str
     // Recovery grace periods in milliseconds, indexed by recovery level (L0 = no recovery, L1 = play/unmute, L2 = source reload, L3 = page reload). After a recovery
     // action we wait this long before checking for new issues to give the action time to take effect. L1 is a quick action. L2 and L3 need more time for
     // rebuffering or navigation to complete.
-    const recoveryGracePeriods = [0, 3_000, 10_000, 10_000];
+    const recoveryGracePeriods = [0, 3000, 10000, 10000];
     // Segment stall timeout (10 seconds). After L2/L3 recovery completes, if no new segments are produced within this window, the capture pipeline is considered
     // dead and we escalate directly to tab replacement. This catches the case where recovery reports success but the MediaRecorder/FFmpeg pipeline has silently died.
-    const SEGMENT_STALL_TIMEOUT = 10_000;
+    const SEGMENT_STALL_TIMEOUT = 10000;
     // Tiny segment detection thresholds. Used for continuous segment size monitoring to detect dead capture pipelines. When video capture dies but audio continues,
-    // segments contain only audio data. Audio is transcoded at a controlled bitrate (max 512Kbps), so audio-only segments are at most ~192KB for 3-second segments.
-    // The 500KB threshold catches both dead captures (18 bytes) and audio-only captures while staying well below the smallest video preset (480p/3Mbps ~ 750KB/segment).
+    // segments contain only audio data. Audio is transcoded at a controlled bitrate (max 512Kbps), so audio-only segments are at most ~128KB for 2-second segments (the
+    // default hls.segmentDuration). The 500KB threshold catches both dead captures (18 bytes) and audio-only captures while staying well below the smallest video preset
+    // (480p/3Mbps ~ 750KB/segment, also a 2-second basis).
     // The default count trigger (10) requires roughly 20 seconds of consecutive tiny segments before action is taken, balancing responsiveness against false positives.
-    const TINY_SEGMENT_THRESHOLD = 512_000;
+    const TINY_SEGMENT_THRESHOLD = 512000;
     const TINY_SEGMENT_COUNT_TRIGGER = 10;
     // Resolve the service-specific tiny segment count threshold once at monitor startup. Services with extended static content (e.g., Xfinity commercial
     // placeholders) set a higher value to tolerate longer periods of small segments without false positive tab replacements. Dead capture pipelines (segments with
@@ -101,7 +124,7 @@ export function monitorPlaybackHealth(page, context, profile, url, streamId, str
     // Segment staleness timeout. When no new segments have been produced for this duration, the capture pipeline is considered dead even though the video element may
     // appear healthy. This catches the case where Chrome's MediaRecorder silently stops emitting data without raising an error - the input stream stays "open" but no
     // data events fire. The 20-second threshold is 4x the maximum expected moof delivery interval (5 seconds) to avoid false positives during normal bursty delivery.
-    const SEGMENT_STALENESS_TIMEOUT = 20_000;
+    const SEGMENT_STALENESS_TIMEOUT = 20000;
     // Resolution degradation detection. When the video element's intrinsic resolution is significantly below the configured viewport, the service's ABR is delivering
     // low-quality content. The threshold is expressed as a ratio - if either dimension is below this fraction of the viewport, the resolution is considered degraded.
     // 50% catches clear ABR degradation (768x432 on 1080p = 40%) while allowing legitimate 720p content on 1080p (67% > 50%).
@@ -115,7 +138,7 @@ export function monitorPlaybackHealth(page, context, profile, url, streamId, str
     // navigation and video reinitialization to complete before the site enforces its cutoff.
     const PROACTIVE_RELOAD_MARGIN_MS = 120000;
     // Timestamp of the most recent full page navigation. Used to calculate elapsed continuous playback for proactive reload when maxContinuousPlayback is configured.
-    // Initialized to Date.now() because the monitor starts immediately after tuneToChannel() succeeds in stream setup, meaning a page load just completed. Reset
+    // Initialized to Date.now() because the monitor starts immediately after stream setup establishes playback, meaning a page load just completed. Reset
     // after any successful page navigation recovery or tab replacement, but NOT after source reloads (L2) which preserve the page's JavaScript context.
     let lastPageNavigationTime = Date.now();
     // Pre-compute the selector type string for video element selection. This is passed to evaluate() calls.
@@ -161,8 +184,8 @@ export function monitorPlaybackHealth(page, context, profile, url, streamId, str
         lastSegmentAdvanceTime: Date.now(),
         recoveryAttempts: 0
     };
-    // Resolution degradation monitoring. Separate from the recovery escalation (L1-L4) which handles broken playback. Resolution degradation is a quality issue - the
-    // stream works but at lower-than-expected resolution. Uses its own tracking and two-step escalation: page reload, then tab replacement.
+    // Resolution degradation monitoring. Separate from the recovery escalation (L1-L3 plus tab replacement) which handles broken playback. Resolution degradation is a
+    // quality issue - the stream works but at lower-than-expected resolution. Uses its own tracking and two-step escalation: page reload, then tab replacement.
     const resolutionState = {
         consecutiveDegradedReadings: 0,
         graceEnd: Date.now() + RESOLUTION_GRACE_PERIOD,
@@ -199,9 +222,8 @@ export function monitorPlaybackHealth(page, context, profile, url, streamId, str
             LOG.debug("native:monitor", "Native proxy errored for %s. Initiating capture fallback.", storeKey);
             nativeHealthState.issueType = "proxy error";
             nativeHealthState.issueTime = now;
-            void runWithStreamContext(streamContext, async () => {
-                await executeNativeL3Fallback(entry);
-            });
+            // The caller establishes the stream context for this interval tick, so the fire-and-forget recovery promise inherits it across its async continuations.
+            void executeNativeL3Fallback(entry);
             return;
         }
         // Check if new segments have been produced since the last tick.
@@ -218,46 +240,45 @@ export function monitorPlaybackHealth(page, context, profile, url, streamId, str
         }
         // Calculate staleness: time since the last new segment was produced.
         const stalenessMs = now - nativeHealthState.lastSegmentAdvanceTime;
-        const stalenessThreshold = targetDuration * 2 * 1000;
-        // Classify health based on segment delivery metrics.
-        let nativeHealth = "healthy";
-        if (consecutiveErrors > 0) {
-            nativeHealth = "recovering";
-            if (!nativeHealthState.issueType) {
-                nativeHealthState.issueType = "fetch errors";
-                nativeHealthState.issueTime = now;
-            }
+        // Classify health and the warranted escalation via the pure classifyNativeSegmentHealth core in recovery.ts. The shell below owns the side effects the core
+        // leaves out: issue-timestamp recording, diagnostic logging, and firing the returned recovery action.
+        const decision = classifyNativeSegmentHealth({
+            consecutiveErrors,
+            lastSegmentTime,
+            recoveryAttempts: nativeHealthState.recoveryAttempts,
+            stalenessMs,
+            targetDurationMs: targetDuration * 1000
+        });
+        // Record the issue label the decision named when none is already tracked, so an earlier issue keeps its original timestamp across ticks.
+        if (decision.issueType && !nativeHealthState.issueType) {
+            nativeHealthState.issueType = decision.issueType;
+            nativeHealthState.issueTime = now;
+        }
+        const staleSec = Math.round(stalenessMs / 1000);
+        // Diagnostic logging mirrors the classification. The staleness threshold reported is 2x the target duration in seconds.
+        if (decision.health === "recovering") {
             LOG.debug("native:monitor", "Native stream recovering for %s. Consecutive errors: %s.", storeKey, consecutiveErrors);
         }
-        else if ((stalenessMs > stalenessThreshold) && (lastSegmentTime > 0)) {
-            // Only flag staleness after at least one segment has been produced (lastSegmentTime > 0) and the staleness exceeds the threshold.
-            nativeHealth = "stalled";
-            if (!nativeHealthState.issueType) {
-                nativeHealthState.issueType = "segment stall";
-                nativeHealthState.issueTime = now;
-            }
-            const staleSec = Math.round(stalenessMs / 1000);
-            LOG.debug("native:monitor", "Native stream stalled for %s. No new segments in %ss (threshold: %ss).", storeKey, staleSec, Math.round(stalenessThreshold / 1000));
-            // L2: At 4x target duration, attempt a page reload for fresh tokens. This recovers from auth expiry where the manifest URL is still valid but segment URLs
-            // are rejected. The proxy continues serving cached segments during the reload.
-            if ((stalenessMs > (targetDuration * 4 * 1000)) && (nativeHealthState.recoveryAttempts === 0)) {
-                LOG.warn("Native stream stalled for %s. No new segments in %ss. Attempting recovery.", storeKey, staleSec);
-                nativeHealthState.recoveryAttempts++;
-                void runWithStreamContext(streamContext, async () => {
-                    await executeNativeL2Recovery(entry);
-                });
-                return;
-            }
-            // L3: At 6x target duration (or if L2 was already attempted), fall back to capture mode via tab replacement.
-            if ((stalenessMs > (targetDuration * 6 * 1000)) || ((stalenessMs > (targetDuration * 4 * 1000)) && (nativeHealthState.recoveryAttempts > 0))) {
-                LOG.warn("Falling back to capture mode for %s: native streaming stalled after recovery attempt.", storeKey);
-                void runWithStreamContext(streamContext, async () => {
-                    await executeNativeL3Fallback(entry);
-                });
-                return;
-            }
+        else if (decision.health === "stalled") {
+            LOG.debug("native:monitor", "Native stream stalled for %s. No new segments in %ss (threshold: %ss).", storeKey, staleSec, Math.round(targetDuration * 2));
         }
-        emitNativeStatus(entry, nativeHealth);
+        // L2: at 4x target duration on the first attempt, reload the page for fresh tokens - recovering from auth expiry where the manifest URL is still valid but
+        // segment URLs are rejected. The proxy continues serving cached segments during the reload.
+        if (decision.action === "l2") {
+            LOG.warn("Native stream stalled for %s. No new segments in %ss. Attempting recovery.", storeKey, staleSec);
+            nativeHealthState.recoveryAttempts++;
+            // The caller establishes the stream context for this interval tick, so the fire-and-forget recovery promise inherits it across its async continuations.
+            void executeNativeL2Recovery(entry);
+            return;
+        }
+        // L3: at 4x target duration once an L2 attempt has already been made and the stall persists, fall back to capture mode via tab replacement.
+        if (decision.action === "l3") {
+            LOG.warn("Falling back to capture mode for %s: native streaming stalled after recovery attempt.", storeKey);
+            // The caller establishes the stream context for this interval tick, so the fire-and-forget recovery promise inherits it across its async continuations.
+            void executeNativeL3Fallback(entry);
+            return;
+        }
+        emitNativeStatus(entry, decision.health);
     }
     /**
      * Emits a status update with native-specific health classification. Populates meaningful fields (health, issue tracking, memory, clients) and zeroes video-specific
@@ -274,6 +295,9 @@ export function monitorPlaybackHealth(page, context, profile, url, streamId, str
         const memoryBytes = getStreamMemoryUsage(entry).total;
         const channelKey = entry.info.storeKey;
         const clientSummary = getClientSummary(streamInfo.numericStreamId);
+        // Native streams have no recovery ladder, so we reuse escalationLevel purely as a UI severity encoding rather than as a recovery-level index: healthy maps to 0,
+        // stalled to 1, and recovering to 2. The intended ordering is stalled < recovering because an actively-recovering stream warrants a stronger visual signal than one
+        // that has merely stalled.
         const escalation = (health === "stalled") ? 1 : ((health === "recovering") ? 2 : 0);
         const status = {
             bufferingDuration: null,
@@ -317,13 +341,40 @@ export function monitorPlaybackHealth(page, context, profile, url, streamId, str
         if (!proxy || proxy.isStopped()) {
             return;
         }
+        /* The refresh probes under the identity the tune established, which the entry holds. It is null only for a pending entry whose setup has not filled it in,
+         * and a stream with a running native proxy is past that point - so this answers a window that recovery does not reach rather than papering over one.
+         * Declining is the honest response either way: an identity assembled here would stamp a binding this frame cannot see, and the stall escalates to L3.
+         */
+        const probeIdentity = entry.probeIdentity;
+        if (!probeIdentity) {
+            LOG.debug("native:monitor", "Skipping L2 recovery for %s: the stream has no probe-cache identity yet.", entry.info.storeKey);
+            return;
+        }
+        /* The refresh's page-reload strategy re-establishes the channel through the capability the stream's setup built. A pending entry that never completed
+         * setup has none, and a recovery frame cannot assemble one - the profile closure belongs to the setup path - so the honest response is the same
+         * decline the missing probe identity takes: skip L2 and let the stall escalate on the existing ladder.
+         */
+        const reestablishManifest = entry.reestablishManifest;
+        if (!reestablishManifest) {
+            LOG.debug("native:monitor", "Skipping L2 recovery for %s: the stream has no re-establishment capability.", entry.info.storeKey);
+            return;
+        }
         recoveryState.inProgress = true;
         LOG.debug("native:monitor", "Starting L2 recovery (page reload) for %s.", entry.info.storeKey);
         try {
             const success = await refreshNativeManifest({
                 channelName: entry.info.storeKey,
+                onFeedApplied: (metadata) => {
+                    // The registry write belongs to this layer, not to the native one: recovery already holds the entry, so a refresh that binds a different rung of the
+                    // service's ladder is recorded here as the stream's current quality.
+                    entry.captureCodec = metadata.codec;
+                    entry.nativeBandwidth = metadata.bandwidth;
+                    entry.nativeResolution = metadata.resolution;
+                },
                 page: currentPage,
+                probeIdentity,
                 proxy,
+                reestablishManifest,
                 streamIdStr: streamId,
                 url
             });
@@ -358,11 +409,18 @@ export function monitorPlaybackHealth(page, context, profile, url, streamId, str
             entry.nativeProxy = null;
         }
         // Use the existing tab replacement infrastructure. It sets recoveryState.inProgress = true internally and clears it in finalizeTabReplacement. It creates a new
-        // page with capture, navigates, sets up playback, creates a segmenter, and updates the registry entry (page, rawCaptureStream, ffmpegProcess, segmenter).
+        // page with capture, navigates, sets up playback, creates a segmenter, and updates the registry entry (the page and the new capture session, with the segmenter
+        // attached to it).
         const outcome = await executeTabReplacement("native fallback to capture");
+        // The monitor stopped while tab replacement was in flight (the stream terminated). Nothing was applied and there is nothing to switch to, so return without
+        // mutating the entry or clearing the probe cache. This branch is explicit because the chain below ends in a catch-all else that would otherwise log a false
+        // "fallback failed" for a stop that is not a failure.
+        if (outcome.outcome === "stopped") {
+            return;
+        }
         if (outcome.outcome === "success") {
-            // Tab replacement succeeded. Update the registry to reflect capture mode. The tab replacement handler already set page, rawCaptureStream, ffmpegProcess,
-            // and segmenter on the registry entry. We just need to update the streaming mode and clear audio state.
+            // Tab replacement succeeded. Update the registry to reflect capture mode. The tab replacement handler already set the page and the new capture session (with
+            // its segmenter attached) on the registry entry. We just need to update the streaming mode and clear audio state.
             entry.streamingMode = "capture";
             // Clear separate audio state from the native proxy. Without this, hasAudio remains true and the HLS handler continues serving the master playlist (referencing
             // video.m3u8 and audio.m3u8) instead of the capture segmenter's variant playlist. Clients that cached the master playlist structure would request stale audio
@@ -372,6 +430,10 @@ export function monitorPlaybackHealth(page, context, profile, url, streamId, str
             entry.hls.audioSegments.clear();
             entry.hls.audioSegmentBytes = 0;
             entry.hls.videoPlaylist = "";
+            // Release the relay's initialization segments. They belong to a source this stream no longer consumes, and the memory report reads their byte counter with
+            // no mode gate, so state left here would be counted for the rest of the stream's life. The nativeContainer label needs no matching reset: every consumer
+            // reads it behind the streaming-mode check the line above just flipped, exactly as the sibling native quality fields work.
+            clearNativeInitState(entry.id);
             // Clear the probe cache so subsequent tunes to this channel don't re-attempt native streaming.
             clearProbeCache(entry.info.storeKey);
             LOG.info("Switched to capture mode for %s: native streaming failed.", entry.info.storeKey);
@@ -390,42 +452,28 @@ export function monitorPlaybackHealth(page, context, profile, url, streamId, str
     // Helper to mark a discontinuity in the HLS playlist after recovery events that disrupt the video source. The segmenter flushes its current fragment buffer and sets
     // a pending discontinuity flag so the next segment boundary includes an #EXT-X-DISCONTINUITY tag. This tells HLS clients to flush their decoder state.
     const markStreamDiscontinuity = () => {
-        getStream(streamInfo.numericStreamId)?.segmenter?.markDiscontinuity();
+        getStream(streamInfo.numericStreamId)?.captureSession?.segmenter?.markDiscontinuity();
     };
     /**
      * Computes the health status classification based on current monitor state.
      * @returns The health status classification.
      */
     function computeHealthStatus() {
-        // Error state takes precedence.
-        if (lastVideoState?.error) {
-            return "error";
-        }
-        // If we're at escalation level 3 (page reload), we're in serious trouble.
-        if (recoveryState.escalationLevel >= 3) {
-            return "error";
-        }
-        // If we're actively recovering (levels 1-2).
-        if (recoveryState.escalationLevel > 0) {
-            return "recovering";
-        }
-        // If we're buffering (within grace period).
-        if (bufferingStartTime !== null) {
-            return "buffering";
-        }
-        // If we have consecutive stalls but not yet triggering recovery.
-        if (recoveryState.stallCount > 0) {
-            return "stalled";
-        }
-        return "healthy";
+        // The health precedence ladder is the pure deriveStreamHealth core in recovery.ts; the monitor only supplies its current recovery and playback state.
+        return deriveStreamHealth({
+            escalationLevel: recoveryState.escalationLevel,
+            hasError: lastVideoState?.error ?? false,
+            isBuffering: bufferingStartTime !== null,
+            stallCount: recoveryState.stallCount
+        });
     }
     /**
      * Emits a status update for this stream.
      */
     function emitStatusUpdate() {
-        // Do not emit after the monitor has been stopped. An in-flight async tick can resume from an await after terminateStream() has called stopMonitor() and
-        // emitStreamRemoved(). Without this guard, the emitStreamHealthChanged() call below would re-add the dead stream to the streamStatuses Map, creating a zombie
-        // entry that persists in SSE snapshots indefinitely.
+        // Do not emit after the monitor has been stopped. An in-flight async tick can resume from an await after terminateStream() has disposed the monitor handle
+        // (clearing this interval) and called emitStreamRemoved(). Without this guard, the emitStreamHealthChanged() call below would re-add the dead stream to the
+        // streamStatuses Map, creating a zombie entry that persists in SSE snapshots indefinitely.
         if (intervalCleared) {
             return;
         }
@@ -486,7 +534,7 @@ export function monitorPlaybackHealth(page, context, profile, url, streamId, str
         segmentState.productionStalled = false;
         segmentState.consecutiveTinySegments = 0;
         segmentState.wasInTinyState = false;
-        segmentState.lastCheckedIndex = getStream(streamInfo.numericStreamId)?.segmenter?.getSegmentIndex() ?? 0;
+        segmentState.lastCheckedIndex = getStream(streamInfo.numericStreamId)?.captureSession?.segmenter?.getSegmentIndex() ?? 0;
         segmentState.lastSegmentAdvanceTime = Date.now();
     }
     /**
@@ -538,16 +586,49 @@ export function monitorPlaybackHealth(page, context, profile, url, streamId, str
         pendingReMinimize = true;
         recoveryState.graceUntil = Date.now() + (recoveryGracePeriods[level] ?? 0);
     }
+    /**
+     * Stops the monitoring interval. Pairs the two operations that must always happen together: setting intervalCleared so any in-flight async tick short-circuits at
+     * its next stop check, and clearing the interval so no further ticks fire. Every path that stops the monitor - the tick's own guards, the circuit-breaker
+     * terminations, and dispose() - routes through here, so a stopped monitor can never look un-stopped to a resuming await, which would go on to act on a stream
+     * that has already been terminated.
+     */
+    function stopMonitoring() {
+        intervalCleared = true;
+        clearInterval(interval);
+    }
+    /**
+     * Reports whether the monitor stopped while a recovery action was awaiting, and releases the recovery flag when it did. A recovery await can resume after
+     * terminateStream has already disposed this monitor; the resumption must then apply nothing at all - no grace window, no discontinuity mark, no context
+     * adoption, no counter reset, no navigation-failure tally, no status emission - because each of those would describe a stream that is already gone.
+     *
+     * Releasing recoveryState.inProgress is this helper's own job for exactly that reason: all five callers raise the flag before their await and lower it on the
+     * way out, and the resumption they skip is where that lowering would otherwise have happened. executeTabReplacement is not one of them - its finally already
+     * owns the release.
+     * @returns True if the monitor stopped and the caller must apply nothing.
+     */
+    const abandonRecoveryIfStopped = () => {
+        if (!intervalCleared) {
+            return false;
+        }
+        recoveryState.inProgress = false;
+        return true;
+    };
     /**
      * Handles tab replacement failure by checking the circuit breaker. If the breaker trips, terminates the stream. Returns the appropriate outcome for the caller.
      * @param context - Description of the failure for logging.
      * @returns The tab replacement outcome (failed or terminated).
      */
     function handleTabReplacementFailure(context) {
+        // Entry stop check, mirroring the tick's intervalCleared-first ordering (see the main interval's check-order note): a settlement that resumed after the monitor
+        // stopped must return the stopped outcome and trip nothing, because the breaker accounting, the logs, and the termination would all describe a stream that
+        // has already ended.
+        if (intervalCleared) {
+            return { outcome: "stopped" };
+        }
         const cbResult = checkCircuitBreaker(circuitBreaker, Date.now());
         if (cbResult.shouldTrip) {
             LOG.error("Recovery exhausted (%s) - terminating stream.", context);
-            clearInterval(interval);
+            stopMonitoring();
             onCircuitBreak();
             return { outcome: "terminated" };
         }
@@ -580,6 +661,12 @@ export function monitorPlaybackHealth(page, context, profile, url, streamId, str
      * @returns The tab replacement outcome (failed or terminated).
      */
     function handleExhaustedTabReplacement(context) {
+        // Entry stop check, mirroring the tick's intervalCleared-first ordering (see the main interval's check-order note): a settlement that resumed after the monitor
+        // stopped must return the stopped outcome without clearing metrics or tripping the breaker, because both would be bookkeeping for a stream that has already
+        // ended.
+        if (intervalCleared) {
+            return { outcome: "stopped" };
+        }
         // Clear stale recovery metrics so the deferred-success check does not falsely log "Recovered" from leftover state set by recordRecoveryAttempt.
         metrics.currentRecoveryStartTime = null;
         metrics.currentRecoveryMethod = null;
@@ -590,7 +677,7 @@ export function monitorPlaybackHealth(page, context, profile, url, streamId, str
         // zombie entry in the registry. Terminate explicitly instead.
         if ((failureOutcome.outcome === "failed") && currentPage.isClosed()) {
             LOG.error("Tab replacement failed and the original page is no longer available - terminating stream.");
-            clearInterval(interval);
+            stopMonitoring();
             onCircuitBreak();
             return { outcome: "terminated" };
         }
@@ -601,9 +688,9 @@ export function monitorPlaybackHealth(page, context, profile, url, streamId, str
      * tab) consistently, including metrics recording, success/failure logging, circuit breaker checks, and state resets.
      *
      * On failure, retries onTabReplacement once before giving up. The handler destroys old resources (capture, segmenter, FFmpeg, page) before calling
-     * createPageWithCapture, so a retry is the only chance to save the stream when the first attempt fails. All handler cleanup steps are idempotent on retry:
-     * rawCaptureStream.destroyed guard, segmenter stop() checks state.stopped, FFmpeg kill() checks ffmpeg.killed, page close checks !oldPage.isClosed(), and
-     * unregisterManagedPage is idempotent.
+     * createPageWithCapture, so a retry is the only chance to save the stream when the first attempt fails. All handler cleanup steps are safe to call more than
+     * once on retry: rawCaptureStream.destroyed guard, segmenter stop() checks state.stopped, FFmpeg kill() checks ffmpeg.killed, page close checks
+     * !oldPage.isClosed(), and unregisterManagedPage is a no-op on repeat.
      * @param issueType - Description of what triggered the replacement (for logging and UI display).
      * @returns The tab replacement outcome.
      */
@@ -621,7 +708,7 @@ export function monitorPlaybackHealth(page, context, profile, url, streamId, str
         recordRecoveryAttempt(metrics, RECOVERY_METHODS.tabReplacement);
         try {
             let result = await onTabReplacement();
-            // First attempt failed - retry once. See idempotency notes in the JSDoc above.
+            // First attempt failed - retry once. See the safe-to-retry notes in the JSDoc above.
             if (!result) {
                 LOG.debug("recovery:tab", "Tab replacement attempt 1/2 failed. Retrying...");
                 try {
@@ -632,6 +719,12 @@ export function monitorPlaybackHealth(page, context, profile, url, streamId, str
                 }
             }
             if (result) {
+                // The stream can terminate during the awaited onTabReplacement above; a settlement that resumed after the monitor stopped must not adopt the fresh capture
+                // resources or reset recovery state. Report the stop and apply nothing - the fresh page and capture session were already torn down at the source by the
+                // hls.ts handler's own post-await re-check, so there is nothing to clean up here.
+                if (intervalCleared) {
+                    return { outcome: "stopped" };
+                }
                 applyTabReplacementSuccess(result);
                 return { outcome: "success" };
             }
@@ -644,6 +737,10 @@ export function monitorPlaybackHealth(page, context, profile, url, streamId, str
             try {
                 const retryResult = await onTabReplacement();
                 if (retryResult) {
+                    // Same post-await stop check as the try path: a settlement that resumed after the monitor stopped applies nothing and reports the stop.
+                    if (intervalCleared) {
+                        return { outcome: "stopped" };
+                    }
                     applyTabReplacementSuccess(retryResult);
                     return { outcome: "success" };
                 }
@@ -659,8 +756,8 @@ export function monitorPlaybackHealth(page, context, profile, url, streamId, str
         }
     }
     /**
-     * Performs page navigation recovery with validation. This is the single recovery function used by both the "video not found" and "escalation level 4" code paths,
-     * ensuring consistent behavior. The function:
+     * Performs page navigation recovery with validation. This is the single recovery function used by both the "video not found" and "escalation level 3" (page
+     * navigation) code paths, ensuring consistent behavior. The function:
      * 1. Calls tuneToChannel to reinitialize playback
      * 2. Checks for unexpected new tabs
      * 3. Validates the page URL
@@ -674,8 +771,8 @@ export function monitorPlaybackHealth(page, context, profile, url, streamId, str
         const browser = currentPage.browser();
         const pageCountBefore = (await browser.pages()).length;
         try {
-            // Use tuneToChannel to reinitialize playback. This is the single source of truth for channel initialization, ensuring recovery uses the exact same sequence
-            // as initial setup (navigation, channel selection, video detection, click-to-play, playback).
+            // Use tuneToChannel to reinitialize playback. It is the tune this recovery path owns, and it runs the phases stream setup ran - navigation, channel
+            // selection, video detection, click-to-play, playback - so a recovered stream comes up the way a fresh one did.
             const { context: newContext } = await tuneToChannel(currentPage, url, profile);
             // Check for unexpected new tabs created during tuning.
             const pageCountAfter = (await browser.pages()).length;
@@ -731,6 +828,9 @@ export function monitorPlaybackHealth(page, context, profile, url, streamId, str
             LOG.debug("recovery:general", "Video is buffering (readyState=%s, elements=%s).", presence.maxReadyState, presence.videoCount);
             // Reset video not found counter since video actually exists.
             videoNotFoundCount = 0;
+            // The presence check answering is direct evidence the tab runs evaluates, and the timeout streak both drives the tab-replacement threshold and arms the
+            // short confirmation probe, so it must not outlive that evidence.
+            consecutiveTimeouts = 0;
             emitStatusUpdate();
             return;
         }
@@ -751,6 +851,9 @@ export function monitorPlaybackHealth(page, context, profile, url, streamId, str
                     LOG.info("Video found in different context after re-search. readyState=%s.", validationState.readyState);
                     currentContext = newContext;
                     videoNotFoundCount = 0;
+                    // A validated video means the tab answered the re-search evaluates, and the timeout streak both drives the tab-replacement threshold and arms the
+                    // short confirmation probe, so it must not outlive that evidence.
+                    consecutiveTimeouts = 0;
                     emitStatusUpdate();
                     return;
                 }
@@ -764,11 +867,17 @@ export function monitorPlaybackHealth(page, context, profile, url, streamId, str
         }
         // After 3+ consecutive failures, escalate to full page navigation recovery.
         LOG.warn("Video element not found - recovering via %s.", RECOVERY_METHODS.pageNavigation);
+        // Post-await stop check guarding both breaker branches below. The only await on the path to here is checkVideoPresence above; a tick that resumed after the
+        // monitor stopped must neither trip the breaker nor navigate, because the stream both would act on has already been terminated. No await separates the two
+        // breaker branches, so this single check makes both inert.
+        if (intervalCleared) {
+            return;
+        }
         // Check circuit breaker for too many failures.
         const cbResult = checkCircuitBreaker(circuitBreaker, now);
         if (cbResult.shouldTrip) {
             LOG.error("Recovery failed after %s attempts - terminating stream.", cbResult.totalCount);
-            clearInterval(interval);
+            stopMonitoring();
             onCircuitBreak();
             return;
         }
@@ -783,15 +892,21 @@ export function monitorPlaybackHealth(page, context, profile, url, streamId, str
         // Check page reload limit before attempting recovery.
         if (!isPageReloadAllowed()) {
             LOG.error("Page navigation rate limit reached (%s in %s minutes) - cannot recover without video element.", CONFIG.playback.maxPageReloads, Math.round(CONFIG.playback.pageReloadWindow / 60000));
-            clearInterval(interval);
+            stopMonitoring();
             onCircuitBreak();
             return;
         }
         const recoveryResult = await performPageNavigationRecovery();
+        // The stream can terminate while the navigation above runs. A resumption that lands after the monitor stopped applies nothing - the discontinuity mark, the
+        // grace window, the context adoption, and the failure tally below would all describe a stream that was torn down at the source.
+        if (abandonRecoveryIfStopped()) {
+            return;
+        }
         // Page navigation disrupted the video stream. Mark a discontinuity regardless of navigation success so HLS clients resynchronize their decoders.
         markStreamDiscontinuity();
-        // Set grace period to give page navigation time to take effect (L3 = 10 seconds).
-        recoveryState.graceUntil = now + recoveryGracePeriods[3];
+        // Open the grace window that gives page navigation time to take effect (L3 = 10 seconds). The helper reads the clock here, so the window is measured from
+        // the completed recovery action rather than from the tick that began it.
+        setRecoveryGracePeriod(3);
         if (recoveryResult.success && recoveryResult.newContext) {
             currentContext = recoveryResult.newContext;
             const duration = formatRecoveryDuration(metrics.currentRecoveryStartTime ?? now);
@@ -830,7 +945,7 @@ export function monitorPlaybackHealth(page, context, profile, url, streamId, str
             segmentState.waitStartTime ??= now;
             // Check if segments are flowing by comparing current index to pre-recovery index.
             const entry = getStream(streamInfo.numericStreamId);
-            const currentIndex = entry?.segmenter?.getSegmentIndex() ?? null;
+            const currentIndex = entry?.captureSession?.segmenter?.getSegmentIndex() ?? null;
             if ((currentIndex !== null) && (currentIndex > segmentState.preRecoveryIndex)) {
                 // Segments are flowing - recovery actually succeeded. Clear tracking state.
                 segmentState.preRecoveryIndex = null;
@@ -845,7 +960,7 @@ export function monitorPlaybackHealth(page, context, profile, url, streamId, str
         }
         // Continuous segment size monitoring. Runs on every healthy interval to detect spontaneous capture pipeline death.
         const sizeCheckEntry = getStream(streamInfo.numericStreamId);
-        const currentSegmentIndex = sizeCheckEntry?.segmenter?.getSegmentIndex() ?? 0;
+        const currentSegmentIndex = sizeCheckEntry?.captureSession?.segmenter?.getSegmentIndex() ?? 0;
         if ((currentSegmentIndex > segmentState.lastCheckedIndex) && sizeCheckEntry) {
             // A new segment was produced. Update the staleness tracker and check its size.
             segmentState.lastSegmentAdvanceTime = now;
@@ -947,13 +1062,30 @@ export function monitorPlaybackHealth(page, context, profile, url, streamId, str
             }
             pendingReMinimize = true;
             const recoveryResult = await performPageNavigationRecovery();
+            // Same post-await stop check as the other navigation sites: a resumption after the monitor stopped applies neither the grace windows nor the ratchet step
+            // below, since both would be bookkeeping for a stream that is gone.
+            if (abandonRecoveryIfStopped()) {
+                return true;
+            }
             markStreamDiscontinuity();
+            // Arm the shared recovery grace window unconditionally, mirroring the proactive-reload sibling. This is the one navigation path that would otherwise leave it
+            // unarmed, letting the post-reload settle-in feed the general stall ladder and fire a colliding second recovery a couple of ticks later. Unconditional because
+            // even a failed reload has a settle window that must not read as a fresh stall. This is the shared recoveryState.graceUntil, distinct from the
+            // resolutionState.graceEnd cooldown set just below.
+            setRecoveryGracePeriod(3);
             resolutionState.consecutiveDegradedReadings = 0;
             resolutionState.recoveryAttempt = 1;
             resolutionState.graceEnd = now + RESOLUTION_GRACE_PERIOD;
             if (recoveryResult.success && recoveryResult.newContext) {
                 currentContext = recoveryResult.newContext;
                 lastPageNavigationTime = Date.now();
+                // Reset the general-recovery state a successful reload made stale, composed for this site. Deliberately NOT resetResolutionState() (which the proactive-reload
+                // sibling calls): that zeroes the recoveryAttempt ratchet set to 1 just above, collapsing the two-step resolution ladder into an endless step-1 loop. And
+                // deliberately WITH resetEscalationState() (which the sibling omits): the sibling's caller guarantees a zero escalation level, but this path can run mid-cooldown
+                // with a stale general-ladder level, and every ungated navigation sibling clears it.
+                resetRecoveryCounters();
+                resetSegmentMonitoringState();
+                resetEscalationState();
             }
             else {
                 LOG.warn("Resolution recovery via page reload unsuccessful.");
@@ -1033,6 +1165,11 @@ export function monitorPlaybackHealth(page, context, profile, url, streamId, str
             return true;
         }
         const recoveryResult = await performPageNavigationRecovery();
+        // Same post-await stop check as the other navigation sites: a resumption after the monitor stopped applies nothing, and the reload it was maintaining is
+        // moot now that the stream is gone.
+        if (abandonRecoveryIfStopped()) {
+            return true;
+        }
         markStreamDiscontinuity();
         setRecoveryGracePeriod(3);
         if (recoveryResult.success && recoveryResult.newContext) {
@@ -1073,30 +1210,29 @@ export function monitorPlaybackHealth(page, context, profile, url, streamId, str
             await executeTabReplacement("capture pipeline stalled");
             return true;
         }
+        // Post-await stop check for the breaker branch below. The tick awaited getVideoState before calling this; a tick that resumed after the monitor stopped must not
+        // trip the breaker, because the accounting, the log, and the termination would all describe a stream that has already ended. Return terminal so the tick exits
+        // without further work.
+        if (intervalCleared) {
+            return true;
+        }
         // Check circuit breaker for too many failures.
         const cbResult = checkCircuitBreaker(circuitBreaker, now);
         if (cbResult.shouldTrip) {
             const elapsedSeconds = circuitBreaker.firstFailureTime ? Math.round((now - circuitBreaker.firstFailureTime) / 1000) : 0;
             LOG.error("Recovery failed after %s attempts in %ss - terminating stream.", cbResult.totalCount, elapsedSeconds);
-            clearInterval(interval);
+            stopMonitoring();
             onCircuitBreak();
             return true;
         }
-        // Issue-aware escalation. Determine the appropriate level based on the type of issue and whether source reload has already been attempted.
+        // Issue-aware escalation. The escalation ladder is the pure computeNextRecoveryLevel core in recovery.ts; the later L3-to-L2 fallback under a navigation rate
+        // limit stays here in the executor because it is entangled with the async navigation attempt.
         const issueCategory = getIssueCategory(state, !isProgressing, isBuffering);
-        let nextLevel;
-        if ((issueCategory === "paused") && (recoveryState.escalationLevel === 0)) {
-            // Paused issues: try L1 first (play/unmute works ~50% for paused).
-            nextLevel = 1;
-        }
-        else if (!recoveryState.sourceReloadAttempted) {
-            // First recovery attempt for buffering/other, or L1 didn't fix paused: try L2 (source reload).
-            nextLevel = 2;
-        }
-        else {
-            // Source reload already attempted: go to L3 (page reload).
-            nextLevel = 3;
-        }
+        const nextLevel = computeNextRecoveryLevel({
+            currentEscalationLevel: recoveryState.escalationLevel,
+            issueCategory,
+            sourceReloadAttempted: recoveryState.sourceReloadAttempted
+        });
         // Note: Keep state updates in sync with the video-not-found recovery path in handleVideoNotFound above.
         recoveryState.escalationLevel = nextLevel;
         recoveryState.lastRecoveryTime = now;
@@ -1120,7 +1256,7 @@ export function monitorPlaybackHealth(page, context, profile, url, streamId, str
         // For L2/L3 recovery, record the current segment index so we can verify segments are flowing after recovery completes.
         if (recoveryState.escalationLevel >= 2) {
             const entry = getStream(streamInfo.numericStreamId);
-            segmentState.preRecoveryIndex = entry?.segmenter?.getSegmentIndex() ?? null;
+            segmentState.preRecoveryIndex = entry?.captureSession?.segmenter?.getSegmentIndex() ?? null;
             segmentState.waitStartTime = null;
             segmentState.productionStalled = false;
         }
@@ -1129,11 +1265,16 @@ export function monitorPlaybackHealth(page, context, profile, url, streamId, str
             // Levels 1-2: In-page recovery via ensurePlayback().
             if (recoveryState.escalationLevel <= 2) {
                 await ensurePlayback(currentPage, currentContext, profile, { recoveryLevel: recoveryState.escalationLevel, skipNativeFullscreen: true });
+                // The stream can terminate while ensurePlayback runs. A resumption after the monitor stopped applies none of the settlement below - the source-reload
+                // mark, the discontinuity, the grace window, the resolution reset. Returning true is what makes the caller exit the tick immediately.
+                if (abandonRecoveryIfStopped()) {
+                    return true;
+                }
                 if (recoveryState.escalationLevel === 2) {
                     recoveryState.sourceReloadAttempted = true;
                     markStreamDiscontinuity();
                 }
-                recoveryState.graceUntil = now + (recoveryGracePeriods[recoveryState.escalationLevel] ?? 0);
+                setRecoveryGracePeriod(recoveryState.escalationLevel);
                 resetResolutionState();
             }
             else {
@@ -1153,8 +1294,13 @@ export function monitorPlaybackHealth(page, context, profile, url, streamId, str
                     }
                     else {
                         const recoveryResult = await performPageNavigationRecovery();
+                        // Same post-await stop check as the other navigation sites. The exit value here is true, not the false this function returns on normal completion:
+                        // false means "continue the tick", and a tick running against a terminated stream has nothing left to do.
+                        if (abandonRecoveryIfStopped()) {
+                            return true;
+                        }
                         markStreamDiscontinuity();
-                        recoveryState.graceUntil = now + recoveryGracePeriods[3];
+                        setRecoveryGracePeriod(3);
                         if (recoveryResult.success && recoveryResult.newContext) {
                             currentContext = recoveryResult.newContext;
                             const duration = formatRecoveryDuration(metrics.currentRecoveryStartTime ?? now);
@@ -1180,21 +1326,49 @@ export function monitorPlaybackHealth(page, context, profile, url, streamId, str
         recoveryState.inProgress = false;
         return false;
     }
+    /**
+     * Dispatches one tick body and holds the serialization flag for that body's whole lifetime. This is the only writer of tickInProgress: the flag is raised here
+     * before the body starts and released when its promise settles, so no other site can leave it stuck raised and starve the monitor.
+     *
+     * The catch is the backstop for both dispatch branches. The capture branch's body ends in its own escape handler, but the native branch's does not, so a throw
+     * out of the native health check would otherwise surface as an unhandled rejection. Both branches hand back the promise of an async call, which is what
+     * guarantees the settlement handlers attach at all - a body that could throw synchronously would skip them and wedge the flag.
+     * @param body - The tick body to run. Its promise settling is what releases the flag.
+     */
+    const dispatchSerializedTick = (body) => {
+        tickInProgress = true;
+        void body().catch((dispatchError) => {
+            LOG.warn("Monitor tick dispatch failed: %s.", formatError(dispatchError));
+        }).finally(() => {
+            tickInProgress = false;
+        });
+    };
     /* Main monitoring interval. This runs every MONITOR_INTERVAL milliseconds to check video state and trigger recovery when needed.
      *
      * Every early return must call emitStatusUpdate() before returning (except when the stream is terminating, e.g., page closed or circuit breaker tripped). This
      * ensures SSE clients always have current status data (duration, memory, health) even during recovery, buffering, or video search periods. Without this, the
      * streamStatuses map becomes stale and new SSE connections receive outdated snapshots.
      *
-     * Check ordering: the recoveryState.inProgress check must come before the currentPage.isClosed() check. During tab replacement, the old page is intentionally
-     * closed while the handler creates a new page; if we checked isClosed() first, we would terminate the interval while recovery is still in progress, causing
-     * status updates to stop permanently. The required sequence is: (1) intervalCleared for explicit cleanup, (2) recoveryState.inProgress to continue during
-     * recovery, (3) isClosed() for unexpected page termination outside of recovery.
+     * Check ordering, in the sequence the callback applies them:
+     *
+     * 1. intervalCleared, for explicit cleanup.
+     * 2. tickInProgress, so a firing that lands while the previous body is still running skips instead of stacking a second body on the same counters.
+     * 3. recoveryState.inProgress. On the capture path this covers the window a recovery await holds open inside a tick body; on the native path it is the only
+     *    guard there is, since a native recovery is launched fire-and-forget and outlives the tick that started it.
+     * 4. currentPage.isClosed(), for page termination outside of recovery. It must come after the recovery check: during tab replacement the old page is
+     *    deliberately closed while the handler creates a new one, so testing isClosed() first would clear the interval mid-recovery and stop status updates
+     *    permanently.
      */
     const interval = setInterval(() => {
         // Stop monitoring if cleanup was requested.
         if (intervalCleared) {
-            clearInterval(interval);
+            stopMonitoring();
+            return;
+        }
+        // Skip this firing if the previous tick body has not settled. Emit status so SSE clients keep seeing current duration, memory, and health while a long read
+        // is outstanding.
+        if (tickInProgress) {
+            emitStatusUpdate();
             return;
         }
         // Skip health checks if a recovery operation is in progress. During tab replacement, the old page will be closed but we must keep the interval running until the
@@ -1205,7 +1379,7 @@ export function monitorPlaybackHealth(page, context, profile, url, streamId, str
         }
         // Stop monitoring if the page was closed outside of recovery. This handles cases like browser disconnect or explicit stream termination.
         if (currentPage.isClosed()) {
-            clearInterval(interval);
+            stopMonitoring();
             return;
         }
         // For static capture profiles (e.g., staticPage), there is no video element to monitor. Skip all video health checks and just emit a status update.
@@ -1217,16 +1391,20 @@ export function monitorPlaybackHealth(page, context, profile, url, streamId, str
         // startup because the streaming mode is set after the monitor starts (native streaming is attempted after setupStream returns).
         const nativeEntry = getStream(streamInfo.numericStreamId);
         if (nativeEntry?.streamingMode === "native") {
-            checkNativeStreamHealth(nativeEntry);
+            // Re-establish stream context for this interval tick before running the native health check. AsyncLocalStorage context is lost when entering setInterval
+            // callbacks, so without this wrapper the native path's non-debug warnings would emit without the stream-ID prefix. This mirrors the capture-mode branch below.
+            dispatchSerializedTick(() => runWithStreamContext(streamContext, async () => {
+                checkNativeStreamHealth(nativeEntry);
+            }));
             return;
         }
         // Re-establish stream context for this interval tick. AsyncLocalStorage context is lost when entering setInterval callbacks.
-        runWithStreamContext(streamContext, async () => {
+        dispatchSerializedTick(() => runWithStreamContext(streamContext, async () => {
             try {
                 // Early exit if the stream's abort signal has been triggered. This prevents wasted work when the stream is being terminated.
                 const abortSignal = getAbortSignal(streamId);
                 if (abortSignal?.aborted) {
-                    clearInterval(interval);
+                    stopMonitoring();
                     return;
                 }
                 // Capture current timestamp for all timing calculations in this check cycle.
@@ -1236,13 +1414,13 @@ export function monitorPlaybackHealth(page, context, profile, url, streamId, str
                 let stateInfo = null;
                 let contextInvalidated = false;
                 try {
-                    stateInfo = await getVideoState(currentContext, selectorType);
+                    // A read issued while a timeout streak is open is a confirmation probe, so it carries the short bound. With no streak open the read takes the evaluate
+                    // wrapper's default, which is the bound that detects a hung tab in the first place.
+                    stateInfo = await getVideoState(currentContext, selectorType, (consecutiveTimeouts > 0) ? UNRESPONSIVE_PROBE_TIMEOUT : undefined);
                 }
                 catch (stateError) {
-                    // Check for execution context destroyed errors, which indicate the frame was detached.
-                    const errorMessage = formatError(stateError);
-                    const isContextDestroyed = ["context", "destroyed", "detached", "target closed"].some((term) => errorMessage.toLowerCase().includes(term));
-                    if (isContextDestroyed) {
+                    // Classify through the shared page-death predicate: the world the read ran in is gone, so the video may simply live in a context we no longer hold.
+                    if (isPageDeathError(stateError)) {
                         LOG.debug("recovery:context", "Video context was invalidated (frame detached). Will re-search for video.");
                         contextInvalidated = true;
                     }
@@ -1263,6 +1441,9 @@ export function monitorPlaybackHealth(page, context, profile, url, streamId, str
                             LOG.info("Video found in new context after detachment. readyState=%s.", validationState.readyState);
                             currentContext = newContext;
                             videoNotFoundCount = 0;
+                            // A validated video means the tab answered the re-search evaluates, and the timeout streak both drives the tab-replacement threshold and arms the
+                            // short confirmation probe, so it must not outlive that evidence.
+                            consecutiveTimeouts = 0;
                             // Emit status so SSE clients stay current even when returning early after context re-search.
                             emitStatusUpdate();
                             return;
@@ -1381,10 +1562,18 @@ export function monitorPlaybackHealth(page, context, profile, url, streamId, str
                  * - Video is stalled for too long (stallCount exceeds threshold and not in buffering grace)
                  * - Segment production has stalled after recovery (capture pipeline dead)
                  */
-                const needsRecovery = !withinRecoveryGrace && (state.error || state.ended ||
-                    (state.paused && !withinBufferingGrace && (recoveryState.pauseCount > CONFIG.playback.stallCountThreshold)) ||
-                    (!isProgressing && !withinBufferingGrace && (recoveryState.stallCount > CONFIG.playback.stallCountThreshold)) ||
-                    segmentState.productionStalled);
+                const needsRecovery = shouldTriggerRecovery({
+                    hasEnded: state.ended,
+                    hasError: state.error,
+                    isPaused: state.paused,
+                    isProgressing,
+                    pauseCount: recoveryState.pauseCount,
+                    productionStalled: segmentState.productionStalled,
+                    stallCount: recoveryState.stallCount,
+                    stallCountThreshold: CONFIG.playback.stallCountThreshold,
+                    withinBufferingGrace: Boolean(withinBufferingGrace),
+                    withinRecoveryGrace
+                });
                 /* Escalation reset. After sustained healthy playback (SUSTAINED_PLAYBACK_REQUIRED, default 60 seconds), we reset the escalation level and circuit breaker.
                  * This allows a stream that recovered to start fresh, rather than immediately escalating to aggressive recovery on the next issue.
                  */
@@ -1400,8 +1589,11 @@ export function monitorPlaybackHealth(page, context, profile, url, streamId, str
                         // Clear buffering state. The bufferingStartTime may persist through recovery cycles due to networkState === 2 (NETWORK_LOADING) being true for live streams
                         // even during healthy playback. Since we have confirmed 60 seconds of progression, the stream is definitively not buffering.
                         bufferingStartTime = null;
-                        // Reset escalation, segment tracking, and circuit breaker. Sustained healthy playback confirms the stream works.
+                        // Reset escalation, failure counters, segment tracking, and circuit breaker. Sustained healthy playback confirms the stream works, so we clear every
+                        // failure tally for a true fresh start. Without resetting the counters here, a stale consecutiveNavigationFailures count could carry across the healthy
+                        // window and prematurely escalate a future L3 episode, defeating the purpose of the 60-second reset.
                         resetEscalationState();
+                        resetRecoveryCounters();
                         resetSegmentMonitoringState();
                         resetCircuitBreaker(circuitBreaker);
                     }
@@ -1425,7 +1617,7 @@ export function monitorPlaybackHealth(page, context, profile, url, streamId, str
                 recoveryState.inProgress = false;
                 // If the session or page was closed, stop monitoring gracefully.
                 if (isSessionClosedError(error) || currentPage.isClosed()) {
-                    clearInterval(interval);
+                    stopMonitoring();
                     return;
                 }
                 // Check for evaluate timeout errors, which indicate the browser tab may be unresponsive.
@@ -1462,15 +1654,21 @@ export function monitorPlaybackHealth(page, context, profile, url, streamId, str
         }).catch((outerError) => {
             // Log errors that escape the inner try/catch. In normal operation we should not reach here - if we do, there's a bug to investigate.
             LOG.warn("Monitor tick error escaped inner try/catch: %s.", formatError(outerError));
-        });
+        }));
     }, CONFIG.playback.monitorInterval);
-    /* Return the cleanup function. The caller (stream handler) should call this when the stream ends to stop monitoring. Returns the recovery metrics for the
-     * termination summary log.
+    /* The monitor's teardown: mark the interval cleared (so any in-flight async tick short-circuits) and clear it. Self-contained - it owns only the interval. Defined
+     * as a const so it is exposed as both dispose() and [Symbol.dispose].
      */
-    return function () {
-        intervalCleared = true;
-        clearInterval(interval);
-        return metrics;
+    const dispose = () => {
+        stopMonitoring();
+    };
+    /* Return the monitor handle. getMetrics() exposes the live recovery metrics (read in the termination prologue for the summary log); dispose() / [Symbol.dispose]
+     * stops the monitor. The metrics object remains valid after disposal because it is a retained counter snapshot, not derived at stop time.
+     */
+    return {
+        dispose,
+        getMetrics: () => metrics,
+        [Symbol.dispose]: dispose
     };
 }
 //# sourceMappingURL=monitor.js.map