prismcast 1.12.0 → 1.13.0

package/dist/streaming/setup.js

@@ -50,31 +50,31 @@ var __disposeResources = (this && this.__disposeResources) || (function (Suppres
     var e = new Error(message);
     return e.name = "SuppressedError", e.error = error, e.suppressed = suppressed, e;
 });
-import { BrowserSupersededError, BrowserUnavailableError, getBrowserInstance, getCurrentBrowser, getStream, invalidateBrowser, minimizeBrowserWindow, registerManagedPage, setCaptureProbe, unregisterManagedPage } from "../browser/index.js";
-import { CaptureAbandonedError, createCaptureLock } from "./captureLock.js";
+import { BrowserCaptureImpairedError, BrowserSupersededError, BrowserUnavailableError, acquireCaptureStream, confirmSharedWindowPlacement, emulateCaptureSurface, emulateLayoutSurface, getBrowserInstance, getCaptureImpairment, getCurrentBrowser, installActivationHeal, noteBrowserCaptureImpaired, registerManagedPage, resolveSharedWindowCarrier, setCaptureProbe, syncWindowVisibility, unregisterManagedPage } from "../browser/index.js";
+import { CAPTURE_SOURCE_UNAVAILABLE_MESSAGE, isChannelSelectionProfile } from "../types/index.js";
+import { CaptureAbandonedError, CaptureTurnTimeoutError, createCaptureLock } from "./captureLock.js";
 import { FINALIZE_SETTLE_DELAY, installManifestInterceptor } from "../browser/manifestInterceptor.js";
-import { LOG, delay, extractDomain, formatError, getStreamContext, isStaleCaptureMutexError, maxRetryDuration, realClock, registerAbortController, resolveFFmpegPath, retryOperation, runWithStreamContext, spawnFFmpeg, startTimer, waitWithTimeout } from "../utils/index.js";
-import { getAllStreams, getNextStreamId } from "./registry.js";
+import { LOG, chromeFetch, delay, extractDomain, formatError, getStreamContext, maxRetryDuration, registerAbortController, resolveFFmpegPath, retryOperation, runWithStreamContext, spawnFFmpeg, startTimer, timeoutSignal, waitWithTimeout } from "../utils/index.js";
 import { getAuthDomainForChannel, getServiceDisplayName, resolveServiceKey } from "../config/services.js";
-import { getBuiltinProfile, getProfileForChannel, getProfileForUrl, resolveProfile } from "../config/profiles.js";
+import { getDomainConfig, getProfileForChannel, getProfileForUrl, resolveProfile } from "../config/profiles.js";
 import { getProviderByStrategy, invalidateDirectUrl, resolveDirectUrl } from "../browser/channelSelection.js";
 import { initializePlayback, injectVideoSelector, muteExistingVideos, navigateToPage } from "../browser/video.js";
 import { CONFIG } from "../config/index.js";
-import { chromeFetch } from "../utils/index.js";
 import { createCaptureSession } from "./captureSession.js";
+import { getBuiltinProfile } from "../config/sites.js";
 import { getCachedEncryption } from "../native/probe.js";
 import { getCaptureMimeType } from "./codec.js";
 import { getDomainAuthState } from "../config/health.js";
-import { getDomainConfig } from "../config/sites.js";
-import { getPresetViewport } from "../config/presets.js";
+import { getNextStreamId } from "./registry.js";
 import { getUserProfiles } from "../config/userProfiles.js";
 import { isCaptureInfrastructureError } from "./recovery.js";
-import { isChannelSelectionProfile } from "../types/index.js";
-import { minimizeWindow } from "../browser/cdp.js";
 import { monitorPlaybackHealth } from "./monitor.js";
 import { mutateChannels } from "../config/userChannels.js";
+import { openSharedWindowTab } from "../browser/tabSelection.js";
 import { pipeline } from "node:stream/promises";
+import { reaffirmCaptureSurface } from "../browser/cdp.js";
 import { startOverlayHandling } from "../browser/consent.js";
+import { systemClock } from "homebridge-plugin-utils";
 /* This module contains the common stream setup logic for HLS streaming. The core logic is split into two functions:
  *
  * 1. createPageWithCapture(): Creates a browser page, starts media capture, navigates to the URL, and sets up video playback. This is the reusable core that both
@@ -99,8 +99,8 @@ import { startOverlayHandling } from "../browser/consent.js";
  */
 // Native fMP4 capture uses MP4/AAC for direct HLS segmentation without transcoding.
 const NATIVE_FMP4_MIME_TYPE = "video/mp4;codecs=avc1,mp4a.40.2";
-// Capture initialization is serialized through a task-scoped lock. Chrome's tabCapture extension can only initialize one capture at a time - concurrent getStream()
-// calls fail with "Cannot capture a tab with an active stream" - so every getStream initialization runs as a task on this one process-wide lock, which holds the
+// Capture initialization is serialized through a task-scoped lock. Chrome's tabCapture extension can only initialize one capture at a time - a second start while
+// one is in flight fails with "Cannot capture a tab with an active stream" - so every acquisition runs as a task on this one process-wide lock, which holds the
 // turn until the task's promise settles. Once a capture is established it runs concurrently with other captures without issue.
 // The wedge-derivation policy for the capture lock. A task held past max(CAPTURE_WEDGE_FLOOR_MS, deadline + CAPTURE_WEDGE_MARGIN_MS) without settling invokes its
 // onWedge callback so the call site can route it into browser recovery. The floor is the wedge bound at the normal navigation timeout; the margin keeps the wedge
@@ -109,15 +109,21 @@ const CAPTURE_WEDGE_FLOOR_MS = 30000;
 const CAPTURE_WEDGE_MARGIN_MS = 5000;
 // The one production capture lock. It takes no config-derived values: setup.ts's module body runs before initializeConfiguration(), and streaming.* saves mutate the
 // live CONFIG binding mid-process, so every timing bound is read per call at the call sites instead.
-const captureLock = createCaptureLock({ clock: realClock, wedgeFloorMs: CAPTURE_WEDGE_FLOOR_MS, wedgeMarginMs: CAPTURE_WEDGE_MARGIN_MS });
-// The delay puppeteer-stream's fire-and-forget STOP_RECORDING chain needs to settle after a raw capture stream is destroyed, before the owning page is closed.
-// Destroying the stream triggers STOP_RECORDING via the close handler, but the async chain (STOP_RECORDING -> recorder.stop() -> onstop -> track.stop()) must finish
-// while the browser is still connected, or Chrome's tabCapture state lingers and the next getStream() draws "Cannot capture a tab with an active stream".
-const STOP_RECORDING_SETTLE_MS = 500;
-// The teardown allowance the mid-life probe's outer lock deadline adds over its getStream criterion bound. The pass/fail criterion times getStream alone; this
-// allowance lets the destroy-plus-STOP_RECORDING-settle teardown complete inside the turn without counting against that criterion. A teardown that hangs past the
-// allowance trips the outer deadline and is reported as a capture-infrastructure failure.
-const PROBE_TEARDOWN_ALLOWANCE_MS = 3000;
+const captureLock = createCaptureLock({ clock: systemClock, wedgeFloorMs: CAPTURE_WEDGE_FLOOR_MS, wedgeMarginMs: CAPTURE_WEDGE_MARGIN_MS });
+// The bound on how long the capture extension may take to confirm a recording stopped, after a raw capture stream is destroyed and before the owning page is
+// closed. Destroying the stream sends the stop request; the extension answers by closing its socket once the recorder has stopped, its tracks have stopped, and
+// its pending sends have drained, and that answer is what CaptureStream.stopped carries. The stop has to land while the browser is still connected, or Chrome's
+// tabCapture state lingers and the next acquisition draws "Cannot capture a tab with an active stream". The ceiling bounds the case where the answer can never
+// arrive - a browser that is already gone - so a page close is never held hostage to it.
+const STOP_RECORDING_CEILING_MS = 3000;
+const STOP_RECORDING_CEILING_MESSAGE = "The capture extension did not confirm the recording stopped in time.";
+// The slack the probe's teardown gets beyond the stop confirmation itself: the managed-page unregister and the page close that follow it.
+const PAGE_CLOSE_MARGIN_MS = 2000;
+// The teardown allowance the mid-life probe's outer lock deadline adds over its acquisition criterion bound. The pass/fail criterion times the acquisition alone;
+// this allowance lets the destroy-and-confirm teardown complete inside the turn without counting against that criterion. It is derived from the stop ceiling it
+// has to outlast rather than written as a second number beside it, so the two cannot drift apart. A teardown that hangs past the allowance trips the outer
+// deadline and is reported as a capture-infrastructure failure.
+const PROBE_TEARDOWN_ALLOWANCE_MS = STOP_RECORDING_CEILING_MS + PAGE_CLOSE_MARGIN_MS;
 // The playback-initialization safety-net timeout. Channel selection plus video setup runs after navigation with no outer timeout racing its internal click
 // retries; for guideGrid strategies a selection failure triggers an overlay dismiss and retry, which doubles the channel-selection budget. 45 seconds accommodates
 // that retry while still preventing a pathological hang if multiple internal timeouts chain sequentially. Consumed by both the phase-2 race and the interception
@@ -127,35 +133,30 @@ const PLAYBACK_INIT_TIMEOUT = 45000;
 // resize and minimize, setupStream's pre-verification work) plus true slack. The interception window is a leak bound for a tune that dies without unwinding, not a
 // latency bound - no healthy path waits on it - so its generosity costs nothing.
 const INTERCEPTION_BUDGET_MARGIN_MS = 5000;
-// The caller-visible capture-timeout messages, each defined once so the lock's deadline errors and any pin test read the exact text. Both match
-// isCaptureInfrastructureError via its "timed out" substring, so they are exported for the classification pin that locks that contract.
+// The caller-visible capture-timeout messages, each defined once so the lock's deadline errors and any assertion test read the exact text. Both match
+// isCaptureInfrastructureError via its "timed out" substring, so they are exported for the classification assertion that locks that contract.
 export const STREAM_INIT_TIMEOUT_MESSAGE = "Stream initialization timed out.";
 export const CAPTURE_PROBE_TIMEOUT_MESSAGE = "Capture probe timed out.";
 /**
- * Retires a raw capture stream: destroys it to fire STOP_RECORDING while the browser is still connected, then waits STOP_RECORDING_SETTLE_MS for that fire-and-forget
- * chain to finish before the caller closes the page. This is the destroy-plus-settle core shared by the mid-life probe's success teardown and every path that must
- * retire a capture stream produced after its caller had already abandoned the turn. It is the async sibling of captureSession.ts's disposer, which tears the composed
- * FFmpeg pipeline down synchronously: this helper awaits the settle because a page close follows it directly, and unlike the composed disposer it is used on
- * abandoned paths where the page may already be closed, so the STOP_RECORDING side is then best-effort.
- * @param stream - The raw capture stream to destroy.
- * @param clock - Clock used for the settle delay. Defaults to realClock; tests inject a fake.
+ * Retires a raw capture stream: destroys it so the stop request goes out while the browser is still connected, then waits for the extension to confirm the
+ * recording stopped before the caller closes the page. This is the destroy-and-confirm core shared by the mid-life probe's success teardown and every path that
+ * must retire a capture stream produced after its caller had already abandoned the turn. It is the async sibling of captureSession.ts's disposer, which tears the
+ * composed FFmpeg pipeline down synchronously: this helper awaits the confirmation because a page close follows it directly, and unlike the composed disposer it
+ * is used on abandoned paths where the page may already be closed, so the stop side is then best-effort.
+ *
+ * It never throws. A confirmation that does not arrive inside the ceiling is warned about and then stepped past, because holding a page open for a browser that
+ * has stopped answering helps nobody.
+ * @param stream - The raw capture stream to retire.
+ * @param clock - Clock bounding the stop confirmation. Defaults to the system clock; tests inject a virtual clock.
  */
-async function retireRawStream(stream, clock = realClock) {
+export async function retireRawStream(stream, clock = systemClock) {
     stream.destroy();
-    await clock.sleep(STOP_RECORDING_SETTLE_MS);
-}
-/**
- * Escalates the stale-capture-mutex condition from a single home. A "Cannot capture a tab with an active stream" rejection leaks puppeteer-stream's module-level
- * mutex permanently - a Chrome restart cannot clear module state, so only a fresh process recovers. This logs the one canonical diagnostic with the failing site as
- * structured context, then schedules a deferred process exit. The exit is deferred briefly so the error log flushes to disk first; an immediate exit can truncate the
- * buffered file write and lose the diagnostic that explains the restart. Every caller throws or exits its own path right after, so no further capture work runs in the
- * interim.
- * @param siteContext - A short phrase naming where the stale mutex surfaced, attached as structured log context.
- */
-function escalateStaleCaptureMutex(siteContext) {
-    LOG.error("Stale capture state detected. puppeteer-stream's internal capture mutex is now permanently locked and the capture system is unrecoverable. Exiting so " +
-        "the service manager can restart with a clean module state.", { site: siteContext });
-    setTimeout(() => process.exit(1), 100);
+    try {
+        await waitWithTimeout(stream.stopped, STOP_RECORDING_CEILING_MS, { clock, reason: new Error(STOP_RECORDING_CEILING_MESSAGE) });
+    }
+    catch {
+        LOG.warn("The capture extension did not confirm the recording stopped within %dms; closing the page regardless.", STOP_RECORDING_CEILING_MS);
+    }
 }
 /**
  * Thrown by the capture-lock task when it finds the page already closed at the instant its turn is granted (a browser crash during the turn-wait). createPageWithCapture
@@ -185,12 +186,12 @@ export class DirectUrlEstablishmentError extends Error {
 // Maximum number of times createPageWithCapture() will retry when it detects that the page was closed while waiting for its turn on the capture lock (e.g., due to a
 // browser crash). An explicit guard prevents unbounded recursion.
 const MAX_PAGE_CLOSED_RETRIES = 3;
-// Maximum time in milliseconds to wait for a single capture probe's getStream() to respond. Shared by the launch-gate verification (verifyCaptureSystem) and the
+// Maximum time in milliseconds to wait for a single capture probe's acquisition to respond. Shared by the launch-gate verification (verifyCaptureSystem) and the
 // mid-life re-verification, so both tiers exercise the capture path with the same bound.
 const CAPTURE_PROBE_TIMEOUT_MS = 5000;
-// Wire the capture-readiness probe into the browser launch gate. setup.ts owns getStream and the unrecoverable stale-mutex process.exit decision; browser/index.ts
-// owns the launch lifecycle. Injecting verifyCaptureSystem here (setup.ts already depends on browser/index.ts) keeps the dependency one-directional and breaks the
-// cycle, mirroring the browserAccessors boundary between login.ts and index.ts. It runs once at module load, before any browser launch.
+// Wire the capture-readiness probe into the browser launch gate. setup.ts owns the capture lock and the readiness probe; browser/index.ts owns the launch
+// lifecycle. Injecting verifyCaptureSystem here (setup.ts already depends on browser/index.ts) keeps the dependency one-directional and breaks the
+// cycle, mirroring the loginDeps boundary between login.ts and index.ts. It runs once at module load, before any browser launch.
 setCaptureProbe(verifyCaptureSystem);
 /**
  * Error thrown when stream setup fails. Includes HTTP status code and user-friendly message for the response.
@@ -305,7 +306,14 @@ function disposePage(page) {
         });
     }
 }
-const defaultCreatePageWithCaptureDeps = { getCurrentBrowser, getStream, startOverlayHandling };
+const defaultCreatePageWithCaptureDeps = { acquireCaptureStream, awaitCaptureVerdict: noteClassifiedCaptureFailure,
+    emulateCaptureSurface, getCurrentBrowser, installActivationHeal, openSharedWindowTab, reaffirmCaptureSurface, spawnFFmpeg, startOverlayHandling,
+    syncWindowVisibility };
+/* The window-topology answers the open primitive needs and cannot reach for itself: tabSelection.ts speaks to the capture extension alone, so the CDP-side carrier
+ * resolution and placement confirmation arrive from here, where both modules are already in view. One record, referenced by both call sites, because the two call
+ * sites want the identical pair.
+ */
+const SHARED_WINDOW_TOPOLOGY = { confirmPlacement: confirmSharedWindowPlacement, resolveCarrier: resolveSharedWindowCarrier };
 /**
  * Creates a browser page with media capture and navigates to the URL. This is the reusable core function used by both initial stream setup and tab replacement
  * recovery. It handles:
@@ -313,6 +321,8 @@ const defaultCreatePageWithCaptureDeps = { getCurrentBrowser, getStream, startOv
  * - Initializing media capture (native fMP4 or Matroska+FFmpeg)
  * - Navigating to the URL with retry
  * - Setting up video playback via navigateToPage() + initializePlayback()
+ * - Re-entering itself once, on a fresh page through a freshly acquired browser, when Chrome refuses the capture start and the mid-life probe's verdict says a
+ *   second attempt has something to start from
  *
  * The caller is responsible for:
  * - Creating the segmenter and attaching it to the capture session via captureSession.attachSegmenter()
@@ -322,7 +332,7 @@ const defaultCreatePageWithCaptureDeps = { getCurrentBrowser, getStream, startOv
  *
  * @param options - Options for page and capture creation.
  * @param deps - The injected browser and overlay-poll collaborators; defaults to defaultCreatePageWithCaptureDeps. Threaded so a test drives this function without a
- * live Chrome by substituting the shared-browser accessor, the capture launcher, and the static-capture overlay poll.
+ * live Chrome by substituting the shared-browser accessor, the capture acquisition, and the static-capture overlay poll.
  * @returns The page, context, and capture session (which owns the raw capture stream and any FFmpeg child).
  * @throws Error if page creation, capture initialization, or navigation fails.
  */
@@ -330,23 +340,39 @@ export async function createPageWithCapture(options, deps = defaultCreatePageWit
     const env_1 = { stack: [], error: void 0, hasError: false };
     try {
         const captureElapsed = startTimer();
-        const { comment, numericStreamId, onFFmpegError, profile, streamId, url } = options;
+        const { comment, onFFmpegError, profile, streamId, url } = options;
+        /* Bring the window on screen before anything else. Capture reads the compositor's output for the shared window, and that output is only composed correctly for a
+         * window the desktop is presenting, so the sync has to land ahead of capture acquisition rather than alongside it. The pending registry entry is already in
+         * capture mode by the time any caller reaches here, on both request paths, so the policy reads capture-active and this resolves to a window on screen.
+         */
+        await deps.syncWindowVisibility();
         // Acquire every resource on a DisposableStack so that any throw - in capture initialization, navigation, or playback setup - disposes them structurally as the
         // function unwinds, in last-acquired-first order (capture session before page, so the capture stream is destroyed and STOP_RECORDING fires while the browser is
         // still connected, before the page closes). On success we move() the stack to disarm it and transfer ownership to the caller. This centralizes teardown that
         // would otherwise be repeated in each failure path, and closes the navigation-path leak of the manifest interceptor.
         const resources = __addDisposableResource(env_1, new DisposableStack(), false);
-        // Create browser page.
-        const browser = await deps.getCurrentBrowser();
-        const page = await browser.newPage();
-        // Register in-flight: the registry does not record this page against the stream until setup finishes, so the mark is what keeps stale page cleanup from closing
-        // it mid-tune.
-        registerManagedPage(page, { inFlightSetup: true });
+        /* Create browser page. The establishment goes on to start a capture, so a browser that can no longer start one refuses here, before a page exists. The page is
+         * opened as a tab of the shared window rather than wherever Chrome would place it, because a capture tab rooted in a discovery window keeps that window alive
+         * and leaves the visibility policy managing a window the capture is not in. The tab is selected for the moment it arrives and the selection goes straight back,
+         * so a user working in another tab is never moved out of it.
+         */
+        const browser = await deps.getCurrentBrowser("capture");
+        const page = await deps.openSharedWindowTab(browser, { deps: SHARED_WINDOW_TOPOLOGY });
+        // Register the page as held in flight: the registry does not record it against the stream until setup finishes, so the mark is what keeps stale page cleanup
+        // from closing it mid-tune.
+        registerManagedPage(page, { inFlight: true });
         resources.adopt(page, disposePage);
+        // Emulate the capture surface before anything else touches the page and well before capture acquires it: the dimensions the encoder is held to and the pixel
+        // density the compositor rasters at are both settled here, on a page nothing has overridden yet, and a failure unwinds through the DisposableStack exactly as
+        // every later step does.
+        const surface = await deps.emulateCaptureSurface(page);
         await page.setBypassCSP(true);
         // Inject the shared video selector helper into the browser context. This must happen before navigation so the helper is available when evaluate calls run during
         // initializePlayback (startVideoPlayback, applyVideoStyles, verifyFullscreen, lockVolumeProperties) and subsequent health monitoring (getVideoState).
         await injectVideoSelector(page);
+        // Install the tab-activation heal alongside it, before capture is acquired, so the page is enrolled and carries its listener from its first document onward:
+        // whichever way this tab becomes the selected one, the capture's composition moves back to the emulated surface about a second later.
+        await deps.installActivationHeal(page);
         // Select MIME type based on capture mode. FFmpeg mode is more stable for long recordings because Chrome's native fMP4 MediaRecorder can become unstable. The
         // codec decision (H.264 vs HEVC) is delegated to the codec module, which considers the user's allowlist and GPU hardware capabilities.
         const useFFmpeg = CONFIG.streaming.captureMode === "ffmpeg";
@@ -361,76 +387,60 @@ export async function createPageWithCapture(options, deps = defaultCreatePageWit
         // Initialize media stream capture. The whole capture-init phase runs inside one try so a browser crash detected at turn grant drives the closed-page recursion,
         // while every other failure unwinds through the DisposableStack.
         try {
-            const viewport = getPresetViewport(CONFIG);
             const streamOptions = {
                 audio: true,
                 audioBitsPerSecond: CONFIG.streaming.audioBitsPerSecond,
                 mimeType: captureMimeType,
                 video: true,
                 videoBitsPerSecond: CONFIG.streaming.videoBitsPerSecond,
-                // Constrain capture frame rate to a 30-60 fps band: 60 is the live-TV ceiling, and a 30 floor keeps motion smooth even when the user configures a lower rate.
-                // The ceiling is fixed at 60 while the floor follows the user's configured rate (clamped into the band), so the encoder favours the requested rate but never
-                // drops below 30. The readiness probe (attemptCaptureProbe) instead pins both bounds to a flat 30 because its getStream() fails or succeeds at the tabCapture
-                // API level before encoding matters, so a representative-but-minimal constraint set suffices there.
+                /* The dimension bounds hold the track to exactly the surface emulateCaptureSurface declared on this page, rather than to a second read of the configured
+                 * preset, so a preset saved mid-establishment cannot leave the encoder constrained to dimensions the page was never emulated at.
+                 *
+                 * The frame rate is constrained to a 30-60 fps band: 60 is the live-TV ceiling, and a 30 floor keeps motion smooth even when the user configures a lower
+                 * rate. The ceiling is fixed at 60 while the floor follows the user's configured rate (clamped into the band), so the encoder favours the requested rate but
+                 * never drops below 30. The readiness probe (attemptCaptureProbe) instead holds both bounds to a flat 30 because its acquisition fails or succeeds at the
+                 * tabCapture API level before encoding matters, so a representative-but-minimal constraint set suffices there.
+                 */
                 videoConstraints: {
                     mandatory: {
                         maxFrameRate: 60,
-                        maxHeight: viewport.height,
-                        maxWidth: viewport.width,
+                        maxHeight: surface.height,
+                        maxWidth: surface.width,
                         minFrameRate: Math.max(30, Math.min(60, CONFIG.streaming.frameRate)),
-                        minHeight: viewport.height,
-                        minWidth: viewport.width
+                        minHeight: surface.height,
+                        minWidth: surface.width
                     }
                 }
             };
-            // Acquire the raw capture stream through the capture lock. The lock serializes getStream against every other capture init process-wide and holds the turn until
-            // this task's promise settles, so no two inits collide. Every timing bound is read here, at the call, because the module-scope lock captured nothing from CONFIG.
+            // Acquire the raw capture stream through the capture lock. The lock serializes acquisition against every other capture init process-wide and holds the turn
+            // until this task's promise settles, so no two inits collide. Every timing bound is read here, at the call, because the module-scope lock captured nothing
+            // from CONFIG.
             const stream = await captureLock.run(async (signal) => {
                 // If Chrome crashed while this task waited for its turn, the page is dead. Throw a typed error so the turn releases at once and the closed-page recursion runs
                 // OUTSIDE the lock, on a fresh page.
                 if (page.isClosed()) {
                     throw new PageClosedDuringTurnError();
                 }
-                // Initialize capture. On a stale-mutex rejection - including one that arrives after this task was abandoned at the caller deadline - escalate from the single
-                // home before rethrowing, so the process-exit safety net fires even on the abandoned path, where a late stale-mutex rejection would otherwise go unescalated.
-                let raw;
-                try {
-                    raw = await deps.getStream(page, streamOptions);
-                }
-                catch (error) {
-                    if (isStaleCaptureMutexError(error)) {
-                        escalateStaleCaptureMutex("stream initialization");
-                    }
-                    throw error;
-                }
-                // The caller deadline fired while getStream was still running: retire the stream this task just produced - destroy plus the STOP_RECORDING settle - inside the
-                // turn, then reject, so no path strands a live capture on a closing page or mistakes a retired stream for a usable one.
+                // Initialize capture. The acquisition makes one start and reports what came back, so it is handed no deadline signal of its own; the check immediately
+                // below is where this task decides what becomes of a capture that arrived after the caller stopped waiting for it.
+                const raw = await deps.acquireCaptureStream(page, streamOptions);
+                // The caller deadline fired while the acquisition was still running: retire the stream this task just produced - destroy plus the stop confirmation - inside
+                // the turn, then reject, so no path strands a live capture on a closing page or mistakes a retired stream for a usable one.
                 if (signal.aborted) {
-                    await retireRawStream(raw, realClock);
+                    await retireRawStream(raw, systemClock);
                     throw new CaptureAbandonedError();
                 }
                 return raw;
             }, {
                 deadlineMessage: STREAM_INIT_TIMEOUT_MESSAGE,
                 deadlineMs: CONFIG.streaming.navigationTimeout,
-                // A wedged capture init is decisive only when no OTHER stream is active - the same judgment, from the same predicate, as the mid-life detector: any other
-                // active stream means the browser is demonstrably capturing, so tearing it down would violate per-stream failure isolation. reverificationInProgress is passed
-                // as the literal false because an in-flight mid-life probe is itself queued BEHIND this wedged task on the same lock, so deferring to it would double the
-                // recovery bound, and a redundant invalidate is identity-guarded and converges harmlessly.
+                /* A capture initialization that holds the lock this long is evidence about the browser rather than about the stream: the wedge fires only after this task's
+                 * own deadline has already failed the tune, so the tune is lost either way and what is left to decide is what the browser can still be trusted with.
+                 * Recording it marks the instance this task ran against, which refuses later capture starts at once and relaunches the browser when nothing depends on it -
+                 * the same response the probe's verdict takes, reached from the other direction.
+                 */
                 onWedge: () => {
-                    if (shouldReverifyCapture({ activeStreamIds: getAllStreams().map((entry) => entry.id), failingStreamId: numericStreamId, hasBrowser: true,
-                        reverificationInProgress: false })) {
-                        // Route the wedge into the existing browser-recovery ladder, targeting the exact instance this task ran against; invalidateBrowser no-ops if it was already
-                        // superseded. A rejection is warn-logged rather than rethrown out of the wedge callback.
-                        void invalidateBrowser(browser, "capture initialization wedged past the recovery bound").catch((error) => {
-                            LOG.warn("Invalidating a wedged capture browser failed: %s.", formatError(error));
-                        });
-                    }
-                    else {
-                        // Other streams are active, so hold rather than tear the browser down: waiters fail fast on their own turn-wait bounds, the wedged operation settles at
-                        // worst at Puppeteer's protocolTimeout, and once the other streams drain a later wedge or setup failure reaches the zero-other case.
-                        LOG.warn("Capture initialization has wedged past the recovery bound, but other streams are active; holding rather than invalidating the browser.", { failingStreamId: numericStreamId });
-                    }
+                    void noteBrowserCaptureImpaired(browser, "capture initialization wedged past the recovery bound");
                 },
                 turnWaitMs: CONFIG.streaming.navigationTimeout
             });
@@ -439,17 +449,26 @@ export async function createPageWithCapture(options, deps = defaultCreatePageWit
             // pipeline wiring below are synchronous, so the stream is owned the instant it exists.
             let ffmpegProcess = null;
             if (useFFmpeg) {
-                const ffmpeg = spawnFFmpeg(ffmpegBin, CONFIG.streaming.audioBitsPerSecond, (error) => {
+                const ffmpeg = deps.spawnFFmpeg(ffmpegBin, CONFIG.streaming.audioBitsPerSecond, (error) => {
                     LOG.error("FFmpeg process error: %s.", formatError(error));
                     if (onFFmpegError) {
                         onFFmpegError(error);
                     }
                 }, streamId, comment);
                 ffmpegProcess = ffmpeg;
+                /* A disposed pipeline must never fire its error callback. The two listeners below sit on the process's own streams rather than inside the spawn wrapper,
+                 * so they are the two places a post-kill teardown event can still reach a caller, and each gates on the same teardown flag the wrapper's own handlers use.
+                 *
+                 * The gate is what keeps a tab replacement's discard silent. A replacement disposes the outgoing pipeline in the same synchronous frame it installs the
+                 * incoming one, so a stray event from the killed FFmpeg lands a tick later - against a registry that already holds a healthy new pipeline - and this
+                 * closure's callback would break the circuit on the very stream the replacement just saved. String filters cannot cover that: they name the errors
+                 * teardown is known to produce, and the point here is every error a killed pipeline produces.
+                 */
+                const isTornDown = () => ffmpeg.isShuttingDown();
                 // Handle pipe errors on stdout. Stdin errors are handled by pipeline() below.
                 ffmpeg.stdout.on("error", (error) => {
                     const errorMessage = formatError(error);
-                    if (errorMessage.includes("EPIPE")) {
+                    if (errorMessage.includes("EPIPE") || isTornDown()) {
                         LOG.debug("streaming:ffmpeg", "FFmpeg stdout pipe closed: %s.", errorMessage);
                     }
                     else {
@@ -464,8 +483,9 @@ export async function createPageWithCapture(options, deps = defaultCreatePageWit
                 // destroys the source stream, preventing "write after end" errors that would occur with .pipe().
                 pipeline(stream, ffmpeg.stdin).catch((error) => {
                     const errorMessage = formatError(error);
-                    // EPIPE, "write after end", and "Premature close" errors are expected during cleanup when FFmpeg is killed or the capture stream is destroyed.
-                    if (errorMessage.includes("EPIPE") || errorMessage.includes("write after end") || errorMessage.includes("Premature close")) {
+                    // EPIPE, "write after end", and "Premature close" errors are expected during cleanup when FFmpeg is killed or the capture stream is destroyed, and a
+                    // pipeline whose FFmpeg is being torn down produces whatever it produces.
+                    if (errorMessage.includes("EPIPE") || errorMessage.includes("write after end") || errorMessage.includes("Premature close") || isTornDown()) {
                         return;
                     }
                     // Unexpected pipeline errors require cleanup.
@@ -493,15 +513,42 @@ export async function createPageWithCapture(options, deps = defaultCreatePageWit
                 }
                 return await createPageWithCapture({ ...options, _pageClosedRetries: retryCount + 1 }, deps);
             }
-            // Every other rejection - a stale-mutex escalation already fired inside the task, a caller-deadline CaptureDeadlineError, or any other capture-init failure - just
-            // unwinds. Resource teardown (page, interceptor, and the capture session once built) is handled by the DisposableStack as this throw unwinds the function scope.
+            /* Chrome refuses a first capture start now and then, browser-wide, and a fresh Chrome accepts at once - so this refusal is a question about the browser, and
+             * the probe is what answers it. The wait is worth it because the answer is exactly what the tune needs: every one of its outcomes IS the retry policy, read
+             * off getCurrentBrowser("capture") on the way back in. A `captured` verdict means the browser is healthy and the re-entry meets the same instance. A `failed`
+             * verdict on an otherwise idle browser means the relaunch has already run by the time the verdict settles, so the re-entry meets the fresh one. A `failed`
+             * verdict while a stream is established or another tune is mid-setup means the relaunch could not run, and the re-entry draws the impaired refusal the
+             * supervisor already answers with - a quiet 503 rather than a second failed establishment.
+             *
+             * The failed attempt's resources are released BEFORE the wait rather than on the way out. The relaunch a failed verdict triggers waits for every in-flight
+             * page to be gone, and this page is one of them, so a tune still holding its page would be waiting on a relaunch its own page forbids. Disposing here empties
+             * the stack, which leaves its scope-exit disposal a no-op on every path out of this block.
+             *
+             * One retry, and the marker travels through the closed-page recursion's options spread on purpose: a browser crash recovery that follows a refusal retry must
+             * not buy a second one, because the bound is per logical establishment rather than per invocation.
+             */
+            if (formatError(error).includes(CAPTURE_SOURCE_UNAVAILABLE_MESSAGE) && !options._refusalRetried) {
+                resources.dispose();
+                const verdict = await deps.awaitCaptureVerdict(error);
+                // No published browser, or a probe that never obtained its turn: neither is evidence about the browser, so there is nothing a second establishment would
+                // be starting from. The refusal travels as the tune's own failure.
+                if (!verdict || (verdict.kind === "inconclusive")) {
+                    throw error;
+                }
+                LOG.info("Chrome refused the capture start; retrying once on the probe's verdict.", { verdict: verdict.kind });
+                return await createPageWithCapture({ ...options, _refusalRetried: true }, deps);
+            }
+            // Every other rejection - a caller-deadline CaptureDeadlineError, a refusal the one retry has already been spent on, or any other capture-init failure - just
+            // unwinds. The verdict still gets the failure, because a browser that cannot start captures is worth marking whoever asked; nothing waits on it here.
+            // Resource teardown (page, interceptor, and the capture session once built) is handled by the DisposableStack as this throw unwinds the function scope.
+            void deps.awaitCaptureVerdict(error);
             throw error;
         }
         // Navigate and set up playback. For static capture profiles, just navigate without video setup.
         let context;
         let strategyDirectTune = false;
         let usedDirectUrl = false;
-        // Install the CDP manifest interceptor immediately before the navigate-and-tune fork, so its observation window opens after the capture-lock and getStream phase
+        // Install the CDP manifest interceptor immediately before the navigate-and-tune fork, so its observation window opens after the capture-lock and acquisition
         // (which the observer would otherwise idle through) and spans exactly the phases that produce manifests: navigation with retry, channel selection, and video
         // setup. The install decision is gated on tab replacement and the skip flag only - static-capture profiles install too, since they stay native-HLS eligible
         // through the interception's presence, so the guard sits upstream of the fork and both branches inherit it. The navigation allowance handed to the budget is
@@ -569,10 +616,10 @@ export async function createPageWithCapture(options, deps = defaultCreatePageWit
             // If a direct watch URL was used, offer the failure to the cache coordinator, which evicts the live and persisted hints when the failure is evidence against
             // the URL and reports that verdict back. The retention policy lives there and is read from there - this file never re-derives which failures count.
             const urlEvidence = usedDirectUrl && invalidateDirectUrl(profile, error);
-            // Re-minimize the browser window. Navigation may have un-minimized it (new tab activation on macOS), and without this the window stays visible after the failed
-            // attempt. Fire-and-forget since we're about to throw. Resource teardown (capture session, interceptor, page) is handled by the DisposableStack as this throw
-            // unwinds the function scope; the capture session disposes first, destroying the capture stream before the page closes, so STOP_RECORDING ordering is preserved.
-            minimizeBrowserWindow().catch(() => { });
+            // Window presentation is deliberately left alone here. The failing stream's registry entry is still registered in capture mode at this point, so the policy
+            // would read capture-active and hold the window on screen anyway; the terminate path that tears the entry down is the moment that genuinely settles it.
+            // Resource teardown (capture session, interceptor, page) is handled by the DisposableStack as this throw unwinds the function scope; the capture session
+            // disposes first, destroying the capture stream before the page closes, so STOP_RECORDING ordering is preserved.
             /* A failure the coordinator blamed on the URL is worth one more attempt down the guide path, so it leaves this function typed for setupStream to act on. An
              * establishment timeout qualifies: the retry is a whole fresh invocation, so there is no abandoned first attempt still driving a page, no one-shot manifest
              * interception handle to reuse, and no direct-tune marker to reset - the retry gets its own page, handle, and markers, which is exactly what a fresh tune
@@ -581,15 +628,27 @@ export async function createPageWithCapture(options, deps = defaultCreatePageWit
             if (urlEvidence) {
                 throw new DirectUrlEstablishmentError(error);
             }
+            /* Classification sits below that branch, on the standing attempt, and not above it. A failure that leaves this function typed is not a verdict on the
+             * establishment at all - it is a request for one more attempt - and the attempt that follows raises its own failure through this same catch. Classifying
+             * above the branch would hand the readiness detector both of them for a single logical setup, which is one setup speaking twice about one browser's fate.
+             * The establishment timeout is exactly the shape where that matters, because it is both a failure the URL can be blamed for and one that carries a
+             * capture-infrastructure signature.
+             *
+             * The verdict is started here and not waited on. A failure this far in has already spent a navigation and a channel selection, so a second whole tune would
+             * double the client's wait for something no verdict can change: the capture start, the one step a fresh browser would do differently, already succeeded.
+             */
+            void deps.awaitCaptureVerdict(error);
             throw error;
         }
-        // During tab replacement, allow Chrome's compositor to fully stabilize the fullscreen video surface before minimizing. Without this delay, the compositor may
-        // snapshot an incorrect scaling state during the minimize transition, causing the captured content to appear zoomed into the top-left corner.
-        if (options.tabReplacement && !profile.staticCapture) {
-            await delay(500);
-        }
-        // Minimize the window now that the page is fully established.
-        await minimizeWindow(page);
+        /* Both establishment branches join here, which is why the re-affirmation sits at this point: capture acquisition selects this tab for the length of the start
+         * and hands the selection back, and a tune of a fullscreen-activating profile selects it again for its fullscreen sequence and hands it back once more.
+         * Re-issuing the page's own declared metrics is what leaves the capture composing the emulated surface rather than the window's fitted view of it, whatever the
+         * establishment did with the selection.
+         */
+        await deps.reaffirmCaptureSurface(page);
+        // Re-settle the window now that the page is established, handing the sync the page it should use for the CDP session. Navigation activates the window on macOS,
+        // so a pass here settles it against the policy after the tune, as every other transition does.
+        await deps.syncWindowVisibility(page);
         LOG.debug("timing:startup", "Page with capture ready. Total: %sms.", captureElapsed());
         // Success: transfer ownership of the page, interceptor, and capture session out of the scope guard. move() empties the stack so its scope-exit disposal is a no-op
         // and the caller becomes responsible for disposing what it now holds.
@@ -617,18 +676,23 @@ export async function createPageWithCapture(options, deps = defaultCreatePageWit
  * FruitDeepLinks) whose domain has no profile mapping. By following redirects, we discover the actual streaming site's domain and can resolve the correct profile.
  *
  * Uses a HEAD request to avoid downloading response bodies. The 3-second timeout ensures stream startup isn't blocked by slow or unreachable indirection services.
+ * This resolver holds no clock of its own, so that bound takes the port's default, the system clock.
  *
  * @param url - The URL to resolve.
  * @returns The final URL after following all redirects, or null on any error.
  */
 async function resolveRedirectUrl(url) {
+    const bound = timeoutSignal(3000);
     try {
-        const response = await chromeFetch(url, { method: "HEAD", signal: AbortSignal.timeout(3000) });
+        const response = await chromeFetch(url, { method: "HEAD", signal: bound.signal });
         return response.url;
     }
     catch {
         return null;
     }
+    finally {
+        bound.cancel();
+    }
 }
 // Stream Setup.
 /**
@@ -651,7 +715,7 @@ function buildPersistResolutionCallback(canonicalKey, serviceTag) {
             const existing = data.channels[variantKey] ?? {};
             data.channels[variantKey] = { ...existing, channelSelector: resolvedSelector };
         });
-        LOG.debug("tuning", "Persisted resolved selector \"%s\" to channel store as \"%s\".", resolvedSelector, variantKey);
+        LOG.debug("tuning:selector", "Persisted resolved selector \"%s\" to channel store as \"%s\".", resolvedSelector, variantKey);
     };
 }
 /* Decides whether the manifest a tune's interception selected belongs to the channel the profile selects, using the provider's own verifier when one exists. The
@@ -659,7 +723,7 @@ function buildPersistResolutionCallback(canonicalKey, serviceTag) {
  * here...the promise's settle time belongs only to the paths that consume it. Verification is gated to master-kind selections because a provider verifier like
  * Fox's reads the channel call sign from a fixed segment of the master CDN URL, and a media (chunklist) URL has a different path shape the verifier was never
  * calibrated for - a false tune-failure on a correct stream. Providers without a verifier, profiles without a channelSelector, non-master selections, and a null
- * interception all verify vacuously: the gates upstream are the only identity signal we have there, so the honest answer is no objection rather than a guess.
+ * interception all verify vacuously: the gates upstream are the only identity signal we have there, so the answer the state supports is no objection rather than a guess.
  *
  * @param interceptionPromise - The interception promise from the handle the tune finalized, awaited only once the gates above admit a verifier.
  * @param profile - The resolved site profile whose strategy names the provider and whose channelSelector names the expected channel.
@@ -720,7 +784,7 @@ export async function establishChannelPlayback(page, profile, handle, options, d
     // channel), and guide-tune selection prefers a master observed after this point. A null handle means nothing is observing, so there is no epoch to stamp.
     handle?.markChannelSelectionStart();
     const initPromise = deps.initializePlayback(page, profile, initOptions);
-    /* The settlement hook rides the initialization's own settlement rather than a fixed step after the wait below, because only the promise knows which of
+    /* The settlement hook runs on the initialization's own settlement rather than a fixed step after the wait below, because only the promise knows which of
      * success, failure, or a late completion actually happened - and a late completion is reachable, since the wait abandons rather than cancels: a lapsed
      * initialization is not stopped, it winds down on its own bounded internal phases and can finish afterward. The trailing catch is the whole safety net for
      * the hook itself, absorbing a hook that throws as well as a structurally-permitted async hook that rejects, so this chain can never become a rejection
@@ -729,10 +793,10 @@ export async function establishChannelPlayback(page, profile, handle, options, d
     if (onInitSettled) {
         void initPromise.finally(() => onInitSettled()).catch(() => { });
     }
-    return waitWithTimeout(initPromise, PLAYBACK_INIT_TIMEOUT, new Error("Playback initialization timed out after " + String(PLAYBACK_INIT_TIMEOUT) + "ms."));
+    return waitWithTimeout(initPromise, PLAYBACK_INIT_TIMEOUT, { reason: new Error("Playback initialization timed out after " + String(PLAYBACK_INIT_TIMEOUT) + "ms.") });
 }
 /**
- * Adjudicates what an establishment's interception selected: finalize it against the honest direct-tune kind, then confirm the manifest belongs to the channel
+ * Adjudicates what an establishment's interception selected: finalize it against the accurate direct-tune kind, then confirm the manifest belongs to the channel
  * the profile names. The tune path and the native refresh capability both run this, so finalize-then-verify is written exactly once.
  *
  * The stage hands on the interception promise rather than a resolved result, which is what keeps verifyManifestSelection's latency rule holding - its provider
@@ -768,7 +832,8 @@ export async function setupStream(options, onCircuitBreak, deps = defaultCreateP
     // tab replacement handler all reference the same stream identity as the pending entry in the registry.
     const streamId = options.streamId ?? generateStreamId(channelName, url);
     const numericStreamId = options.numericStreamId ?? getNextStreamId();
-    const startTime = new Date();
+    // Stream setup is a composition point - it builds the capture lock, the health monitor, and the page - so it reads the system clock at its own boundary.
+    const startTime = systemClock.now();
     // Create and register the AbortController for this stream. This allows pending evaluate calls to be cancelled immediately when the stream is terminated.
     const abortController = new AbortController();
     registerAbortController(streamId, abortController);
@@ -849,12 +914,12 @@ export async function setupStream(options, onCircuitBreak, deps = defaultCreateP
             // Create page and start capture using the shared function. This handles browser page creation, capture initialization, FFmpeg spawning, and navigation with retry.
             let captureResult;
             try {
-                /* Skip CDP manifest interception when the channel is pinned to screen capture, or when the probe cache already knows this stream's binding resolves to
+                /* Skip CDP manifest interception when the channel is locked to screen capture, or when the probe cache already knows this stream's binding resolves to
                  * DRM. The per-channel override short-circuits first, so a forced channel never installs the interceptor: nothing intercepts a manifest, no native
                  * attempt runs, no probe fires, and the encryption cache stays untouched by that stream. The cache half avoids creating a CDP session that sits idle for
                  * 15 seconds before the interceptor timeout cleans it up; every stream carries an identity, ad-hoc URLs included, so that lookup needs no guard.
                  */
-                const skipInterception = (channel?.forceCapture === true) || (getCachedEncryption(probeIdentity) === "drm");
+                const skipInterception = (channel?.forceCapture === true) || (getCachedEncryption(probeIdentity, systemClock.now()) === "drm");
                 // Build the persistResolution closure for the active channel. When the resolution layer in selectChannel() converts a category selector to a concrete call
                 // sign, this closure writes the result to the user's channel store as a per-service-variant override - the same shape produced when a user manually edits
                 // the selector via the web UI. Omitted for ad-hoc URL streams (no channel record to update).
@@ -864,7 +929,6 @@ export async function setupStream(options, onCircuitBreak, deps = defaultCreateP
                     undefined;
                 const attemptOptions = {
                     comment: metadataComment,
-                    numericStreamId,
                     onFFmpegError: onCircuitBreak,
                     persistResolution,
                     profile,
@@ -906,6 +970,13 @@ export async function setupStream(options, onCircuitBreak, deps = defaultCreateP
                 if ((error instanceof BrowserUnavailableError) || (error instanceof BrowserSupersededError)) {
                     throw new StreamSetupError("Browser temporarily unavailable.", 503, "The capture system is recovering. Please retry shortly.", { cause: error });
                 }
+                // The browser is alive and still serving the captures it started, but it can no longer start another, so this tune is refused before a page is even opened.
+                // Quiet like its sibling above, because the alarm fired once when the mark was recorded. The message differs because the wait ends differently: the client is
+                // waiting on the browser to be released by whatever still holds it rather than on a cooldown to elapse.
+                if (error instanceof BrowserCaptureImpairedError) {
+                    throw new StreamSetupError("Browser temporarily unavailable.", 503, "The browser can no longer start captures and will relaunch as soon as nothing is " +
+                        "using it. Please retry shortly.", { cause: error });
+                }
                 // createPageWithCapture handles its own cleanup on failure (closes page, kills FFmpeg).
                 const errorMessage = formatError(error);
                 const lowerMessage = errorMessage.toLowerCase();
@@ -914,16 +985,14 @@ export async function setupStream(options, onCircuitBreak, deps = defaultCreateP
                 if (!isBenign) {
                     LOG.error("Stream setup failed for %s: %s.", url, errorMessage);
                 }
-                // Capture infrastructure errors should return 503 to signal Channels DVR to back off. These include Chrome capture state issues, capture-lock turn-wait
-                // timeouts, and stream initialization failures. Using 503 with Retry-After prevents retry storms when there's a systemic issue. isCaptureInfrastructureError
-                // (recovery.ts) is the single source of truth for this classification, shared with the browser supervisor's readiness detection.
+                /* Capture infrastructure errors should return 503 to signal Channels DVR to back off. These include Chrome capture state issues, capture-lock turn-wait
+                 * timeouts, and stream initialization failures. Using 503 with Retry-After prevents retry storms when there's a systemic issue. isCaptureInfrastructureError
+                 * (recovery.ts) is the single source of truth for this judgment, shared with the browser supervisor's readiness detection.
+                 *
+                 * The read here is purely for the client-facing status. The side effect that judgment also drives - handing the failure to the passive mid-life capture
+                 * detector - fires inside createPageWithCapture's own catches, where every caller of the acquisition reaches it rather than only this one.
+                 */
                 const isCaptureError = isCaptureInfrastructureError(errorMessage);
-                // A capture-infrastructure failure may mean the browser, though still connected, can no longer capture. Hand it to the passive mid-life detector, which (guarded
-                // and single-flight, in the background) re-verifies capture readiness and invalidates the browser for a governed relaunch if confirmed. Fire-and-forget: it must
-                // never delay this response.
-                if (isCaptureError) {
-                    noteCaptureInfrastructureFailure(numericStreamId);
-                }
                 // A failed tune on a service currently marked needs-sign-in most likely failed AT the auth wall, so the user-facing message leads with the remedy.
                 throw new StreamSetupError("Stream error.", isCaptureError ? 503 : 500, withSignInGuidance("Failed to start stream.", channelName, serviceName), { cause: error });
             }
@@ -949,7 +1018,6 @@ export async function setupStream(options, onCircuitBreak, deps = defaultCreateP
             if (manifestInterception) {
                 const verifyError = await adjudicateChannelSelection(manifestInterception, profile, directTune);
                 if (verifyError) {
-                    await minimizeBrowserWindow();
                     const failureLabel = channel?.name ?? channelName ?? url;
                     throw new StreamSetupError("Tune verification failed: " + verifyError, 502, withSignInGuidance("Tune verification failed for " + failureLabel + ". " + verifyError, channelName, serviceName));
                 }
@@ -977,8 +1045,8 @@ export async function setupStream(options, onCircuitBreak, deps = defaultCreateP
                 monitor.dispose();
                 captureSession.dispose();
                 disposePage(page);
-                // Re-minimize the browser window.
-                await minimizeBrowserWindow();
+                // Settle the window against the policy now that this stream's resources are gone.
+                await deps.syncWindowVisibility();
             };
             // Success: transfer ownership out of the scope guard. The cleanup closure and, once the session is installed on the registry entry, terminateStream become
             // responsible for disposing the page and capture session; the interceptor continues into tune verification and native streaming.
@@ -1062,7 +1130,7 @@ export async function reestablishChannelManifest(options) {
                         void muteExistingVideos(page);
                     }
                 });
-                // Adjudicate honestly: the kind formula gets no cached-direct-URL term here, because the route above never takes one.
+                // Adjudicate against this route's facts: the kind formula gets no cached-direct-URL term here, because the route above never takes one.
                 const verifyError = await adjudicateChannelSelection(handle, profile, computeDirectTuneKind({ profile, strategyDirectTune: tuneResult.directTune ?? false }));
                 // On a verifier-bearing master path the adjudication has already awaited this promise; on the vacuous path this await is the one that waits out the
                 // finalize settle. Reading it before the verification result is contract rather than preference: an establishment that intercepted nothing has to report
@@ -1101,19 +1169,17 @@ export async function reestablishChannelManifest(options) {
 }
 // Capture Readiness Verification.
 /**
- * Verifies that a freshly-launched Chrome instance can actually capture, by running a real getStream against a throwaway page on it. This is the capability tier of
- * the browser launch gate: browser/index.ts injects it via setCaptureProbe and runs it inside launchReadyBrowser, so a browser is published as ready only after its
- * capture capability is verified - at boot AND at every relaunch, not just startup. It exercises the exact getStream path that hangs when the puppeteer-stream
- * extension is unregistered, so a dead extension is detected immediately rather than causing every subsequent stream request to hang.
+ * Verifies that a freshly-launched Chrome instance can actually capture, by running a real capture acquisition against a throwaway page on it. This is the
+ * capability tier of the browser launch gate: browser/index.ts injects it via setCaptureProbe and runs it inside launchReadyBrowser, so a browser is published as
+ * ready only after its capture capability is verified - at boot AND at every relaunch, not just startup. It exercises the exact acquisition path that fails when
+ * the capture extension is unregistered, so a dead extension is detected immediately rather than causing every subsequent stream request to fail.
  *
- * Each attempt creates a temporary page, attempts a short capture, and tears down both cleanly. A 500ms delay after destroying the capture stream allows
- * puppeteer-stream's fire-and-forget STOP_RECORDING chain to complete before closing the page, preventing a stale capture cascade on the first real request.
+ * Each attempt creates a temporary page, attempts a short capture, and tears down both cleanly. The teardown waits for the extension to confirm the recording
+ * stopped, bounded by a ceiling, before closing the page, so Chrome's tabCapture state is released rather than lingering into the first real request.
  *
  * After a system reboot or a fresh relaunch, Chrome's display stack or capture extension may not be ready immediately. The probe retries up to PROBE_MAX_ATTEMPTS
  * times with a delay between attempts, giving the system time to settle before giving up. At boot this prevents a rapid restart storm where the service manager
  * relaunches PrismCast repeatedly, each attempt orphaning a Chrome process; at relaunch it provides in-launch settling before the supervisor counts a launch failure.
- *
- * If stale capture state is detected, the process exits immediately - a Chrome restart cannot fix the leaked module-level mutex, only a fresh process can.
  * @param browser - The Chrome instance to verify (the local instance being launched, passed in rather than re-acquired to avoid re-entering the launch in flight).
  */
 export async function verifyCaptureSystem(browser) {
@@ -1121,20 +1187,13 @@ export async function verifyCaptureSystem(browser) {
     const PROBE_RETRY_DELAY = 5000;
     for (let attempt = 1; attempt <= PROBE_MAX_ATTEMPTS; attempt++) {
         // The launch gate runs its capture probe OFF the capture lock, deliberately: it fires pre-publish, when supervisor.current() is null, so a wedged gate task would
-        // have no recovery target and would jam the shared lock. GATE mode keeps the internal getStream bound, and this path keeps its own poison exit below.
+        // have no recovery target and would jam the shared lock. GATE mode keeps the acquisition bounded internally instead.
         // eslint-disable-next-line no-await-in-loop -- Sequential retries are intentional; each probe must complete before deciding whether to retry.
         const result = await attemptCaptureProbe(browser, { boundMs: CAPTURE_PROBE_TIMEOUT_MS, kind: "gate" });
         // Probe succeeded.
         if (result === null) {
             return;
         }
-        // Stale capture state is unrecoverable: puppeteer-stream's second lock section has no try/finally, so the mutex is permanently leaked and every subsequent
-        // getStream() hangs. Chrome restart cannot fix module-level state, so escalate from the single home (which logs and schedules the deferred exit), then throw so no
-        // further probe attempts run before the process exits.
-        if (isStaleCaptureMutexError(result)) {
-            escalateStaleCaptureMutex("the launch-gate capture probe");
-            throw new Error("Capture system verification failed: stale capture state detected.");
-        }
         // If we have retries remaining, log a warning and wait before the next attempt.
         if (attempt < PROBE_MAX_ATTEMPTS) {
             LOG.warn("Capture probe attempt %d of %d failed: %s. Retrying in %ds.", attempt, PROBE_MAX_ATTEMPTS, result, PROBE_RETRY_DELAY / 1000);
@@ -1158,16 +1217,24 @@ export async function verifyCaptureSystem(browser) {
 /**
  * Executes a single capture probe attempt. Creates a temporary page on the given browser, tries to start a capture stream, and tears everything down cleanly. It
  * NEVER throws in either mode: it returns null on success or an error-message string on failure, so callers branch on the string. The two modes differ only in how
- * getStream is bounded - see CaptureProbeMode.
+ * the acquisition is bounded - see CaptureProbeMode.
  * @param browser - The Chrome instance to probe.
- * @param mode - The operating mode: gate (internal getStream race) or midlife (self-timed getStream on the lock).
- * @param clock - Clock used for the mid-life self-timing and the teardown settle. Defaults to realClock.
+ * @param mode - The operating mode: gate (internal acquisition race) or midlife (self-timed acquisition on the lock).
+ * @param clock - Clock used for the mid-life self-timing and the teardown confirmation. Defaults to the system clock.
  * @returns Null on success, or an error message string on failure.
  */
-async function attemptCaptureProbe(browser, mode, clock = realClock) {
-    const page = await browser.newPage();
+async function attemptCaptureProbe(browser, mode, clock = systemClock) {
+    /* The mid-life probe runs against a browser that is serving streams, so its page is opened as a tab of the shared window for the reason a stream's page is: a
+     * probe tab rooted in a discovery window would hold that window open for as long as the probe took. The launch gate keeps the plain create: it runs pre-publish,
+     * when the browser has exactly one window and no discovery window can exist yet, so its tab has no wrong window to land in - and a gate that has to stay bounded
+     * gains nothing from queuing behind the selection executor to prove it.
+     */
+    const page = (mode.kind === "midlife") ? await openSharedWindowTab(browser, { deps: SHARED_WINDOW_TOPOLOGY }) : await browser.newPage({ background: true });
     registerManagedPage(page);
-    // Tears the probe page down cleanly: retire the raw capture stream (destroy plus the STOP_RECORDING settle) while the browser is still connected, unregister the
+    // The probe page carries the preset-sized layout at the display's density, the surface a capture page starts from before its own declaration, so the probe's
+    // acquisition keeps the shape the field validated.
+    const surface = await emulateLayoutSurface(page);
+    // Tears the probe page down cleanly: retire the raw capture stream (destroy plus the stop confirmation) while the browser is still connected, unregister the
     // managed page, then close it. Shared by every success and self-timed-failure path in both modes.
     const teardown = async (stream) => {
         await retireRawStream(stream, clock);
@@ -1177,12 +1244,11 @@ async function attemptCaptureProbe(browser, mode, clock = realClock) {
         }
     };
     try {
-        // Use the same capture MIME type and viewport (height/width) as the runtime. The stale state error occurs at the tabCapture API level before encoding matters,
-        // so matching those runtime constraints ensures the probe exercises a representative getStream() call. Both read the configured preset, so they agree by
-        // construction rather than by two call sites happening to pick the same numbers.
+        // Use the same capture MIME type and surface as the runtime. The stale state error occurs at the tabCapture API level before encoding matters, so matching
+        // those runtime constraints ensures the probe exercises a representative acquisition. The constraints are held to the dimensions the declaration above
+        // returned, so the probe holds its track to the surface the page actually carries rather than to a second read of the preset.
         const useFFmpeg = CONFIG.streaming.captureMode === "ffmpeg";
         const captureMimeType = useFFmpeg ? getCaptureMimeType() : NATIVE_FMP4_MIME_TYPE;
-        const viewport = getPresetViewport(CONFIG);
         const streamOptions = {
             audio: true,
             mimeType: captureMimeType,
@@ -1190,26 +1256,26 @@ async function attemptCaptureProbe(browser, mode, clock = realClock) {
             videoConstraints: {
                 mandatory: {
                     maxFrameRate: 30,
-                    maxHeight: viewport.height,
-                    maxWidth: viewport.width,
+                    maxHeight: surface.height,
+                    maxWidth: surface.width,
                     minFrameRate: 30,
-                    minHeight: viewport.height,
-                    minWidth: viewport.width
+                    minHeight: surface.height,
+                    minWidth: surface.width
                 }
             }
         };
-        // GATE mode: bound getStream with an internal timeout. On a lapse the getStream promise is still pending, so attach a both-callback handler that retires a
+        // GATE mode: bound the acquisition with an internal timeout. On a lapse the acquisition is still running, so attach a both-callback handler that retires a
         // late-arriving stream (best-effort; the page may already be closing) and consumes a late rejection. The bounded wait already observes the promise's rejection,
         // so a fulfillment-only handler would create unhandled-rejection noise. This cleans up the orphan without serializing successive gate attempts against one another.
         if (mode.kind === "gate") {
-            const streamPromise = getStream(page, streamOptions);
+            const streamPromise = acquireCaptureStream(page, streamOptions);
             const timeoutError = new Error(CAPTURE_PROBE_TIMEOUT_MESSAGE);
             let stream;
             try {
-                stream = await waitWithTimeout(streamPromise, mode.boundMs, timeoutError);
+                stream = await waitWithTimeout(streamPromise, mode.boundMs, { reason: timeoutError });
             }
             catch (error) {
-                // Only the internal timeout leaves getStream pending; an in-time rejection produced no stream to clean up and is already observed by the bounded wait.
+                // Only the internal timeout leaves the acquisition running; an in-time rejection produced no stream to clean up and is already observed by the bounded wait.
                 if (error === timeoutError) {
                     void streamPromise.then((late) => {
                         void retireRawStream(late, clock);
@@ -1223,14 +1289,14 @@ async function attemptCaptureProbe(browser, mode, clock = realClock) {
             LOG.info("Capture system verified successfully.");
             return null;
         }
-        // MID-LIFE mode: await getStream raw and self-time it. The turn (owned by the lock) spans the whole task, but the pass/fail CRITERION is getStream's own latency
-        // against boundMs, measured without racing or abandoning anything, so the teardown settle that follows never counts against it.
+        // MID-LIFE mode: await the acquisition raw and self-time it. The turn (owned by the lock) spans the whole task, but the pass/fail CRITERION is the
+        // acquisition's own latency against boundMs, measured without racing or abandoning anything, so the teardown that follows never counts against it.
         const startedAt = clock.now();
-        const stream = (await getStream(page, streamOptions));
+        const stream = await acquireCaptureStream(page, streamOptions);
         const elapsed = clock.now() - startedAt;
         await teardown(stream);
         // Report failure when the caller abandoned this probe at the lock's outer deadline (unobservable in practice - the lock already rejected the caller - but it keeps
-        // the never-throw contract and prevents stranding a capture), or when getStream's own latency exceeded the criterion bound.
+        // the never-throw contract and prevents stranding a capture), or when the acquisition's own latency exceeded the criterion bound.
         if (mode.signal.aborted || (elapsed > mode.boundMs)) {
             return CAPTURE_PROBE_TIMEOUT_MESSAGE;
         }
@@ -1246,104 +1312,169 @@ async function attemptCaptureProbe(browser, mode, clock = realClock) {
         }
         return errorMessage;
     }
+    finally {
+        /* The mid-life open restores the shared window on its way in, so the presentation is settled back here, on every exit this arm has: the success return, the
+         * self-timed bound return, and the catch. It settles inside the probe rather than in the detector above it because the capture lock's outer deadline can
+         * abandon this task while it runs on detached - a settle placed in the detector would fire before a detached probe's open had restored anything. The launch
+         * gate opens no such tab and touches no window, so the settle is the mid-life arm's alone.
+         */
+        if (mode.kind === "midlife") {
+            await syncWindowVisibility();
+        }
+    }
 }
 // Passive Mid-Life Capture-Death Detection.
-/* A browser can be capture-ready at launch and lose its capture capability later - the extension wedges, tabCapture stalls - without ever firing a "disconnected"
- * event, so neither the launch gate nor the disconnect handler would catch it. This detector rides a signal that is already happening: a stream-setup failure
- * carrying a capture-infrastructure signature. It is deliberately conservative. The guard (the failing stream is the only active stream) preserves per-stream
- * isolation - if any other stream is active, the browser is either demonstrably capturing or those streams will trip their own circuit breakers and drain. The probe
- * is the authoritative arbiter, serialized through the capture lock so it can never race a real stream's getStream init, and it runs in the background, single-flight,
- * so it never delays a response or stacks up. On a confirmed failure, the one recovery action runs: invalidate the browser for a governed relaunch.
+/* A browser can be capture-ready at launch and lose its capture capability later - the extension wedges, tabCapture stalls, a display reconfiguration leaves the
+ * process unable to start another capture while the captures already running continue - without ever firing a "disconnected" event, so neither the launch gate nor
+ * the disconnect handler would catch it. This detector uses a signal that is already happening: a stream-setup failure carrying a capture-infrastructure
+ * signature. The probe is the arbiter, serialized through the capture lock so it can never race a real stream's capture acquisition. A probe that never obtained a
+ * turn is no verdict at all, because a busy lock is evidence about load rather than about the browser. On a confirmed failure the one recovery action runs: mark
+ * the browser, which leaves its running captures alone, refuses new capture starts at acquire(), and leaves the adapter to decide when the relaunch is safe.
+ *
+ * The verdict is a shared promise rather than a task nobody holds, and that is what lets a single caller wait on it. A tune Chrome refused the capture start for
+ * is that caller: it has nothing to serve until the browser's fate is settled, and a relaunched browser is exactly what would serve it. Every other failure hands
+ * its error over and walks on, so no healthy response is ever delayed by a probe. One slot holds the verdict for as long as it is unsettled, which is what makes
+ * a burst cheap: a dozen tunes refused in the same second share one probe, one verdict, and one relaunch.
  */
-// At most one mid-life re-verification runs at a time across the process, so a burst of capture-infrastructure failures triggers a single probe, not a storm.
-let captureReverificationInProgress = false;
+// The verdict being reached right now, or null when none is. Every caller that arrives while one is unsettled is handed this same promise.
+let captureVerdictInFlight = null;
+/**
+ * Classifies a throw from the probe's run on the capture lock into a verdict or the absence of one. A turn-wait timeout means the probe never got to run: with
+ * other streams tuning at the same moment it queued behind their legitimate acquisitions, and a lock that is busy says something about load, not about the browser
+ * - a holder that is genuinely hung marks the browser through its own wedge. Every other value, the outer deadline above all, means the probe held its turn and its
+ * own acquisition did not settle, which is exactly the failure the mark exists for. Pure and total, so the distinction the detector rests on is pinnable without a
+ * browser.
+ * @param error - The value the lock run threw.
+ * @returns The outcome the detector acts on.
+ */
+export function classifyCaptureProbeFailure(error) {
+    if (error instanceof CaptureTurnTimeoutError) {
+        return { kind: "inconclusive", reason: formatError(error) };
+    }
+    return { kind: "failed", reason: formatError(error) };
+}
 /**
- * Runs one capture probe as a task on the capture lock, so it cannot race a concurrent getStream initialization (which would draw a spurious "Cannot capture a tab
- * with an active stream"). The lock holds the turn across the probe's full task - getStream plus the STOP_RECORDING settle inside attemptCaptureProbe - so the next
- * initialization does not start until the probe's capture is fully released. The mid-life probe self-times its getStream against `timeout`; the lock's outer deadline
- * adds a teardown allowance over it as a safety net.
+ * Runs one capture probe as a task on the capture lock, so it cannot race a concurrent capture acquisition (which would draw a spurious "Cannot capture a tab
+ * with an active stream"). The lock holds the turn across the probe's full task - the acquisition plus the stop confirmation inside attemptCaptureProbe - so the
+ * next initialization does not start until the probe's capture is fully released. The mid-life probe self-times its acquisition against `timeout`; the lock's
+ * outer deadline adds a teardown allowance over it as a safety net.
  * @param browser - The Chrome instance to probe.
- * @param timeout - Maximum time in milliseconds to wait for the probe's getStream() to respond (the self-timed criterion).
- * @returns Null when the browser captured successfully, or an error message when it could not (including a wedged-lock timeout).
+ * @param timeout - Maximum time in milliseconds to wait for the probe's acquisition to respond (the self-timed criterion).
+ * @returns Captured when the browser started a capture, failed when it could not, inconclusive when the probe never obtained its turn.
  */
 async function probeCaptureSerialized(browser, timeout) {
     try {
-        return await captureLock.run((signal) => attemptCaptureProbe(browser, { boundMs: timeout, kind: "midlife", signal }), {
+        const failure = await captureLock.run((signal) => attemptCaptureProbe(browser, { boundMs: timeout, kind: "midlife",
+            signal }), {
             deadlineMessage: CAPTURE_PROBE_TIMEOUT_MESSAGE,
             deadlineMs: timeout + PROBE_TEARDOWN_ALLOWANCE_MS,
-            // The probe's wedge is a loud warning only, never an invalidate: by wedge time the detector has already invalidated this browser via the returned failure
-            // string (the outer deadline fires roughly 22s earlier), so a wedge here means the kill-immune leaked-mutex hang, where a second invalidate is a guaranteed
-            // identity-guard no-op.
+            // The probe's wedge is a loud warning only, never a second verdict: by wedge time the detector has already marked this browser from the returned failure
+            // (the outer deadline fires roughly 22s earlier), so a mark raised here would land on an instance that already carries one.
             onWedge: () => {
-                LOG.warn("A mid-life capture probe has wedged past the recovery bound; the capture mutex is likely leaked and awaiting a process restart.");
+                LOG.warn("A mid-life capture probe has wedged past the recovery bound; the browser was already marked when the probe's deadline fired, so this wedge " +
+                    "is informational.");
             },
             turnWaitMs: CONFIG.streaming.navigationTimeout
         });
+        return (failure === null) ? { kind: "captured" } : { kind: "failed", reason: failure };
     }
     catch (error) {
-        // The only throw here is a lock failure - a turn-wait timeout or the outer deadline; attemptCaptureProbe returns its own failures as strings. A jammed capture
-        // lock is itself evidence the browser cannot capture, so surface it as a probe failure the detector routes into invalidateBrowser.
-        return formatError(error);
+        return classifyCaptureProbeFailure(error);
     }
 }
 /**
- * Pure decision for whether a mid-life capture-infrastructure failure warrants re-verifying the browser. Re-verification is warranted iff no other re-verification
- * is already in flight, a browser is published to probe, and the failing stream is the only active stream - any other active stream means either the browser is
- * demonstrably capturing (so this failure is stream-specific - never invalidate) or those streams will trip their own circuit breakers and drain, after which a
- * later failure reaches the zero-other case. An empty registry (setup failed before the stream was registered) satisfies the isolation check vacuously and is the
- * common real-world shape of this failure.
- * @param inputs - The decision inputs.
- * @param inputs.activeStreamIds - The ids of every stream currently in the registry.
- * @param inputs.failingStreamId - The id of the stream whose setup just failed, excluded from the isolation check.
- * @param inputs.hasBrowser - Whether a browser instance is currently published to probe.
- * @param inputs.reverificationInProgress - Whether a re-verification is already deciding the browser's fate.
- * @returns True when the failure should trigger a re-verification probe.
+ * Classifies an establishment failure and, when it carries a capture-infrastructure signature, hands it to the passive mid-life detector.
+ *
+ * This sits at the acquisition chokepoint rather than in one caller's catch, so every path that establishes a capture gets the detection: a fresh stream's setup,
+ * a tab replacement, and anything added later. Both of createPageWithCapture's own catch blocks call it, which is what extends the coverage across phases - the
+ * acquisition catch sees a refused capture start, the establishment catch sees the playback-initialization timeout the pattern list also names.
+ *
+ * Every logical setup classifies at most once. What holds that rule at the two call sites is where each call sits: each classifies the failure it is about to
+ * rethrow raw, and never one it is about to wrap for a retry. So a failure blamed on a direct watch URL classifies nothing, and the standing attempt that follows
+ * it classifies for both. The alternative would hand the readiness detector two failures from one setup, which is two background probes deciding a single
+ * browser's fate.
+ *
+ * DirectUrlEstablishmentError is excluded here as well, as the backstop that keeps the rule true of a call site added later rather than as a filter the current
+ * two depend on: neither of them can reach this with one, because the type exists only to leave this function, and the path that wraps into it throws before
+ * the classification line is reached.
+ * @param error - The failure the establishment is about to rethrow.
+ * @returns The verdict the detector reached, or null when this failure called for none.
  */
-export function shouldReverifyCapture(inputs) {
-    return !inputs.reverificationInProgress && inputs.hasBrowser && inputs.activeStreamIds.every((id) => id === inputs.failingStreamId);
+async function noteClassifiedCaptureFailure(error) {
+    if ((error instanceof DirectUrlEstablishmentError) || !isCaptureInfrastructureError(error)) {
+        return null;
+    }
+    return await noteCaptureInfrastructureFailure();
 }
+// The production collaborators, with the probe bound to the criterion every mid-life verdict is judged against.
+const defaultCaptureVerdictDeps = { getBrowserInstance, getCaptureImpairment, noteBrowserCaptureImpaired,
+    probe: (browser) => probeCaptureSerialized(browser, CAPTURE_PROBE_TIMEOUT_MS) };
 /**
- * Passive mid-life capture-death detection, called from the stream-setup failure path when the failure carries a capture-infrastructure signature. If the failing
- * stream is the only active stream, it re-verifies the browser's capture capability with a lock-serialized probe in the background and, on confirmed failure,
- * invalidates the browser for a governed relaunch - catching a browser that is still connected (no "disconnected" event) but can no longer capture. Fire-and-forget
- * so the failing request's response is not delayed; single-flight so a burst of failures triggers at most one probe.
- * @param failingStreamId - The numeric id of the stream whose setup just failed, excluded from the active-stream guard.
+ * Passive mid-life capture-death detection, called from the stream-setup failure path when the failure carries a capture-infrastructure signature. It re-verifies
+ * the browser's capture capability with a lock-serialized probe and, on a confirmed failure, marks the browser: its running captures continue, new capture starts
+ * are refused at acquire(), and the adapter relaunches it once nothing depends on it. Any refused start is worth a probe - a browser that is demonstrably
+ * capturing for someone else can still be unable to start another - while a browser that already carries a mark needs no second verdict, so the reason on record
+ * is handed back instead.
+ *
+ * The returned promise settles only once everything the verdict set in motion has settled, the relaunch a `failed` outcome triggers included. That is the whole
+ * reason a caller can act on it: a tune that re-acquired the browser the instant the mark landed would meet the retiring instance's drain, where acquire() rejects
+ * rather than joins, while one that waits for this promise meets the fresh browser or a refusal that means what it says. The promise never rejects; the absence of
+ * a verdict is a null rather than a throw.
+ *
+ * It is deliberately not async: every caller in a burst has to hand back the SAME promise object, because what they are waiting on is the browser's one verdict
+ * rather than their own call's. An async wrapper would give each caller a distinct promise that merely adopts it, and the shared identity the single-flight slot
+ * exists to provide would stop being observable at this boundary.
+ * @param deps - The injected collaborators; defaults to the production ones.
+ * @returns The verdict, or null when no browser is published to reach one about.
  */
-function noteCaptureInfrastructureFailure(failingStreamId) {
-    // Single-flight: a re-verification is already deciding the browser's fate; do not stack another. Read first so a re-verify already in flight short-circuits
-    // before the registry and browser lookups below are even performed.
-    if (captureReverificationInProgress) {
-        return;
+export function noteCaptureInfrastructureFailure(deps = defaultCaptureVerdictDeps) {
+    // A verdict already being reached is the verdict every later caller gets. Read first so a burst short-circuits before the browser lookup below is even
+    // performed, and so no second probe can ever spend the capture lock on a question that is already being answered.
+    if (captureVerdictInFlight) {
+        return captureVerdictInFlight;
     }
-    // A readiness probe needs a connected browser to exercise. If none is published, a disconnect already handled the readiness loss. The !browser check is
-    // combined into this one condition (rather than a separate guard) so TypeScript narrows browser from Nullable<Browser> to Browser for the probe and
-    // invalidateBrowser calls below. hasBrowser and reverificationInProgress are passed as the values their guards already guarantee here - true (the !browser
-    // guard has passed) and false (the single-flight guard above already returned if it were true).
-    const browser = getBrowserInstance();
-    if (!browser || !shouldReverifyCapture({ activeStreamIds: getAllStreams().map((entry) => entry.id), failingStreamId, hasBrowser: true,
-        reverificationInProgress: false })) {
-        return;
+    // A readiness probe needs a connected browser to exercise. If none is published, a disconnect already handled the readiness loss and there is nothing to judge.
+    const browser = deps.getBrowserInstance();
+    if (!browser) {
+        return Promise.resolve(null);
     }
-    captureReverificationInProgress = true;
-    // Run in the background so the failing request's 503 response is not delayed by the probe, which can take up to the probe timeout.
-    void (async () => {
+    /* A refused start against a browser that is already marked belongs to a tune that acquired it an instant before the mark landed. The verdict is recorded and
+     * the relaunch is scheduled, so a probe here would spend the capture lock re-establishing what is already known. The recorded reason answers instead, and what
+     * happens next is the caller's own re-acquire to discover from the supervisor.
+     */
+    const impairment = deps.getCaptureImpairment();
+    if (impairment) {
+        return Promise.resolve({ kind: "failed", reason: impairment.reason });
+    }
+    captureVerdictInFlight = (async () => {
         try {
-            const failure = await probeCaptureSerialized(browser, CAPTURE_PROBE_TIMEOUT_MS);
-            if (failure !== null) {
-                // The probe confirmed the browser cannot capture though it is still connected. invalidateBrowser is the single recovery action - relinquish readiness,
-                // terminate the now-doomed streams, and close Chrome - so the next request relaunches a fresh, gate-verified browser. We pass the exact instance we probed:
-                // invalidateBrowser no-ops if it was already superseded by a disconnect-and-relaunch during the probe, so we never tear down a healthy replacement. A
-                // genuinely leaked module mutex, if that was the cause, surfaces again at the relaunch's gate probe and exits there; a merely-slow getStream that finally
-                // settles instead lets the relaunch recover.
-                await invalidateBrowser(browser, "a capture probe failed after a stream setup failure with no other active streams");
+            const outcome = await deps.probe(browser);
+            switch (outcome.kind) {
+                case "failed": {
+                    /* The probe confirmed the browser cannot start a capture though it is still connected. We pass the exact instance we probed, so a disconnect and
+                     * relaunch during the probe leaves the fresh browser unmarked. The mark is awaited rather than fired off, because the relaunch it starts is the thing a
+                     * waiting tune is waiting for: settling this promise ahead of that relaunch would hand the tune a browser mid-teardown.
+                     */
+                    await deps.noteBrowserCaptureImpaired(browser, outcome.reason);
+                    break;
+                }
+                case "inconclusive": {
+                    LOG.debug("streaming:setup", "Mid-life capture re-verification could not obtain a turn on the capture lock (%s); no verdict.", outcome.reason);
+                    break;
+                }
+                case "captured": {
+                    // The browser started a capture, so it is healthy and the setup failure that brought us here belonged to the stream rather than to the browser.
+                    break;
+                }
             }
-        }
-        catch (error) {
-            LOG.debug("streaming:setup", "Mid-life capture re-verification aborted: %s.", formatError(error));
+            return outcome;
         }
         finally {
-            captureReverificationInProgress = false;
+            // The slot empties as this verdict settles, so the next capture-infrastructure failure asks the browser afresh rather than reading an answer about a
+            // moment that has passed.
+            captureVerdictInFlight = null;
         }
     })();
+    return captureVerdictInFlight;
 }
 //# sourceMappingURL=setup.js.map