prismcast 1.12.1 → 1.14.0

package/dist/native/proxy.js

@@ -2,14 +2,15 @@
  *
  * proxy.ts: Native HLS proxy - manifest polling, segment fetching, and playlist generation.
  */
-import { LOG, chromeFetch, realClock, startTimer } from "../utils/index.js";
-import { buildPrerollEntries, computePrerollWindow } from "../streaming/preroll.js";
+import { LOG, chromeFetch, resolveUrl, startTimer, timeoutSignal } from "../utils/index.js";
+import { buildPrerollEntries, buildPrerollInitUri, computePrerollWindow } from "../streaming/preroll.js";
 import { decryptSegment, deriveIvFromSequence, fetchDecryptionKey, parseExplicitIv } from "./decrypt.js";
 import { findNamedInitSegment, pruneNamedInitSegments, storeAudioSegment, storeNamedInitSegment, storeSegment, updateAudioPlaylist, updatePlaylist, updateVideoPlaylist } from "../streaming/hlsSegments.js";
+import { CAPTURE_BASELINE_CODEC } from "../types/index.js";
 import { CONFIG } from "../config/index.js";
 import { buildPlaylist } from "../streaming/playlistBuilder.js";
 import { getStream } from "../streaming/registry.js";
-import { resolveUrl } from "./probe.js";
+import { systemClock } from "homebridge-plugin-utils";
 /* This module implements the native HLS proxy that replaces Chrome screen capture for viable streams. It polls the service's variant manifest at regular intervals,
  * detects new segments by tracking #EXT-X-MEDIA-SEQUENCE, fetches each segment (optionally decrypting AES-128), stores them in the existing HLS segment system, and
  * generates an HLS playlist that faithfully propagates upstream metadata - discontinuity markers, program timestamps, and SCTE-35 ad signaling (cue-out, cue-in,
@@ -33,10 +34,10 @@ const MAX_MANIFEST_FAILURES = 3;
 // dropped connection on one segment) are more common here; this higher tolerance than MAX_MANIFEST_FAILURES avoids escalating on blips that would otherwise
 // self-resolve on the next fetch.
 const MAX_SEGMENT_FAILURES = 5;
-// Number of segment byte-fetches one track keeps in flight while its commit walk consumes the results in broadcast order. Three concurrent connections lift a
-// track's download throughput to roughly three times the per-connection pacing a CDN edge grants, which is what keeps a high-bitrate channel ahead of its own
-// production rate rather than accumulating a backlog that delays the next manifest poll. The bound is what keeps the gain cheap: at most three segments per
-// track are resident at once - six for a stream whose audio is a separate rendition, since each track runs its own window.
+// Number of segment byte-fetches one track keeps in flight while its commit walk consumes the results in broadcast order. Running that many connections at once
+// lifts a track's download throughput to roughly that many times the per-connection pacing a CDN edge grants, which is what keeps a high-bitrate channel ahead
+// of its own production rate rather than accumulating a backlog that delays the next manifest poll. The bound is what keeps the gain cheap: at most
+// PARALLEL_SEGMENT_FETCHES segments per track are resident at once - twice that when audio is a separate rendition, since each track runs its own window.
 const PARALLEL_SEGMENT_FETCHES = 3;
 // Manifest poll backoff base delay and cap. On success, the poll interval returns to the base delay (a fixed 3000ms, ~half a typical 6s segment). On failure, the delay
 // doubles on each consecutive failure up to the cap. Jitter of +/-20% prevents multiple streams from retrying in lockstep after a shared CDN outage.
@@ -427,7 +428,7 @@ async function resolveTrackInit(options) {
         servedName = ((track === "video") ? "init-v" : "init-a") + String(tracking.initCounter) + ".mp4";
         tracking.initCounter++;
     }
-    storeNamedInitSegment(ctx.streamId, track, servedName, data);
+    storeNamedInitSegment(ctx.streamId, track, servedName, data, ctx.clock.now());
     tracking.lastUpstreamMapUri = mapUri;
     LOG.debug("native:proxy", "Initialization segment %s for %s (%s track, %s bytes, %s).", (existingName === undefined) ? "stored as " + servedName :
         "reused as " + servedName, ctx.channelName, track, data.length, mapUri.slice(0, 80));
@@ -659,21 +660,30 @@ async function pollAudioStream(ctx, audio, pipeline) {
         return false;
     }
     try {
-        const response = await chromeFetch(audio.variantUrl, { signal: AbortSignal.timeout(SEGMENT_FETCH_TIMEOUT) });
-        if (!response.ok) {
-            audio.consecutiveManifestFailures++;
-            ctx.stats.totalFetchErrors++;
-            // Classify the failure via the shared threshold helper so the audio path escalates identically to the video path: 4xx uses the base threshold, 5xx and
-            // network conditions get double the attempts.
-            const effectiveThreshold = manifestFailureThreshold(response.status);
-            LOG.debug("native:proxy", "Audio manifest poll failed for %s: HTTP %s (%s/%s).", ctx.channelName, response.status, audio.consecutiveManifestFailures, effectiveThreshold);
-            if (audio.consecutiveManifestFailures >= effectiveThreshold) {
-                escalateProxyFailure({ ctx, message: "audio manifest poll failed " + String(audio.consecutiveManifestFailures) + " times" });
+        const bound = timeoutSignal(SEGMENT_FETCH_TIMEOUT, { clock: ctx.clock });
+        let body;
+        try {
+            const response = await chromeFetch(audio.variantUrl, { signal: bound.signal });
+            if (!response.ok) {
+                audio.consecutiveManifestFailures++;
+                ctx.stats.totalFetchErrors++;
+                // Classify the failure via the shared threshold helper so the audio path escalates identically to the video path: 4xx uses the base threshold, 5xx and
+                // network conditions get double the attempts.
+                const effectiveThreshold = manifestFailureThreshold(response.status);
+                LOG.debug("native:proxy", "Audio manifest poll failed for %s: HTTP %s (%s/%s).", ctx.channelName, response.status, audio.consecutiveManifestFailures, effectiveThreshold);
+                if (audio.consecutiveManifestFailures >= effectiveThreshold) {
+                    escalateProxyFailure({ ctx, message: "audio manifest poll failed " + String(audio.consecutiveManifestFailures) + " times" });
+                }
+                return false;
             }
-            return false;
+            audio.consecutiveManifestFailures = 0;
+            body = await response.text();
+        }
+        finally {
+            // The bound covers this poll's own network wait and nothing past it: a bound is armed for exactly the wait it bounds and disposed the moment that wait
+            // settles, so the audio processing below runs with no timer of this poll's left pending on the proxy's clock.
+            bound.cancel();
         }
-        audio.consecutiveManifestFailures = 0;
-        const body = await response.text();
         return await processAudioStream(ctx, audio, body, audio.variantUrl, pipeline);
     }
     catch (error) {
@@ -741,10 +751,10 @@ async function processAudioStream(ctx, audio, body, baseUrl, pipeline) {
 // Composite Playlist Builder.
 /**
  * Builds a composite playlist with fMP4 preroll entries and the relayed source's real entries. Uses the same compositor and builder as the capture path's
- * generatePlaylist(), ensuring identical windowing behavior (maxPrerollInWindow cap, progressive falloff). The DISCONTINUITY tag at the preroll-to-real boundary
- * signals the transition between two independently-initialized runs of content, which is spec-compliant per RFC 8216 Section 4.3.3.3 - and when the relayed
- * source is itself fMP4, that boundary is also where its own initialization reference is re-emitted. VERSION:7 is used throughout to support EXT-X-MAP, and stays
- * backward-compatible with MPEG-TS entries once preroll falls off the window.
+ * generatePlaylist(), ensuring identical windowing behavior (the MAX_PREROLL_IN_WINDOW cap in streaming/preroll.ts, progressive falloff). The DISCONTINUITY
+ * tag at the preroll-to-real boundary signals the transition between two independently-initialized runs of content, which is spec-compliant per RFC 8216
+ * Section 4.3.3.3 - and when the relayed source is itself fMP4, that boundary is also where its own initialization reference is re-emitted. VERSION:7 is used
+ * throughout to support EXT-X-MAP, and stays backward-compatible with MPEG-TS entries once preroll falls off the window.
  *
  * @param options - Composite playlist configuration with segment data, preroll settings, and composite tracking state.
  * @returns The formatted composite m3u8 playlist string.
@@ -752,20 +762,22 @@ async function processAudioStream(ctx, audio, body, baseUrl, pipeline) {
 function buildCompositePlaylist(options) {
     const { composite, prerollBaseUrl, prerollCodec, prerollSegmentCount, segmentEntries, segmentIndex, targetDuration, videoMetadata } = options;
     // Compute the sliding window start index via the compositor. The three-way max prevents negative indices, enforces the sliding window rule, and caps preroll
-    // entries at maxPrerollInWindow to force clients past preroll toward the live edge.
+    // entries at the preroll-in-window cap to force clients past preroll toward the live edge.
     const realSegmentCount = segmentEntries.length;
     const startIndex = computePrerollWindow({
         currentSegmentIndex: segmentIndex,
         maxSegments: CONFIG.hls.maxSegments,
         prerollSegmentCount,
+        // The relay numbers its composite from index 0, so its preroll starts there.
+        prerollStartIndex: 0,
         realSegmentCount
     });
-    // Build fMP4 preroll entries for preroll indices still in the window. These reference the global /preroll/ routes with absolute URLs and .m4s extension.
+    // Build fMP4 preroll entries for preroll indices still in the window. These reference the global /preroll/ routes with absolute URLs.
     let prerollEntries = [];
     if (startIndex < prerollSegmentCount) {
-        prerollEntries = buildPrerollEntries({ baseUrl: prerollBaseUrl, codec: prerollCodec, extension: ".m4s", prerollSegmentCount, startIndex });
+        prerollEntries = buildPrerollEntries({ baseUrl: prerollBaseUrl, codec: prerollCodec, prerollSegmentCount, startIndex });
     }
-    // Build real MPEG-TS entries from the video metadata maps via the shared helper.
+    // Build the relayed source's real entries (MPEG-TS or fMP4) from the video metadata maps via the shared helper.
     const realEntries = segmentEntries.map((filename) => buildEntryFromMetadata(filename, videoMetadata, targetDuration));
     // Mark the preroll-to-real boundary on the first real entry when preroll entries are present in the window. This is a playlist-level concern (the stitching of
     // preroll before real content), not a segment-level property - so it's applied here in the composite builder rather than injected into videoMetadata at segment
@@ -807,7 +819,7 @@ function buildCompositePlaylist(options) {
      * has fallen out of the window, the real content's own initialization becomes the window-level reference directly.
      */
     const realInitialMapUri = annotateMapTransitions(realEntries, videoMetadata);
-    let initialMapUri = (prerollEntries.length > 0) ? (prerollBaseUrl + "/preroll/" + prerollCodec + "/init.mp4") : undefined;
+    let initialMapUri = (prerollEntries.length > 0) ? buildPrerollInitUri(prerollBaseUrl, prerollCodec) : undefined;
     if (realInitialMapUri !== null) {
         if ((prerollEntries.length > 0) && firstRealEntry) {
             firstRealEntry.mapUri = realInitialMapUri;
@@ -831,12 +843,14 @@ function buildCompositePlaylist(options) {
  * @returns The native proxy interface.
  */
 export function createNativeProxy(options) {
-    const { channelName, clock = realClock, container, encryption, keyUrl, onError, streamId } = options;
+    const { channelName, clock = systemClock, container, encryption, keyUrl, onError, streamId } = options;
     const hasAudio = options.audioVariantUrl !== null;
+    // The preroll codec is read only while a preroll is active, and every caller that activates one passes its codec, so the baseline stands in only for a proxy that
+    // never reads it.
+    const prerollCodec = options.prerollCodec ?? CAPTURE_BASELINE_CODEC;
     // Preroll segment index offset. When preroll is ready (prerollSegmentCount > 0), real segments start numbering after the preroll range (e.g., segmentN.ts where
     // N = prerollSegmentCount). This offset is unconditional - it reserves the index space for preroll regardless of whether the deferred preroll timer fires.
     // The composite playlist behavior (including preroll entries) is determined dynamically by checking stream.hls.prerollStartTime at playlist generation time.
-    const prerollCodec = options.prerollCodec ?? "h264";
     const prerollSegmentCount = options.prerollSegmentCount ?? 0;
     /* Proxy state. These track segment storage, manifest polling, error thresholds, and playlist generation across the proxy's lifetime. Mutable variables are organized
      * into typed state objects by subsystem (lifecycle, video tracking, audio tracking, composite playlist, statistics) to clarify ownership and interaction boundaries.
@@ -904,7 +918,7 @@ export function createNativeProxy(options) {
         totalTokenRefreshes: 0
     };
     // Shared context for extracted module-level functions. Bundles immutable references with shared mutable state objects.
-    const ctx = { channelName, lifecycle, onError, stats, streamId };
+    const ctx = { channelName, clock, lifecycle, onError, stats, streamId };
     /* The two tracks' pipeline bindings. Construction happens here, at the proxy's composition root, so the pipeline that serves both loops carries no branch on
      * which track it is running: everything that differs between them - where segments are stored, how many are stored, how they are named, which initialization
      * slot they read, and the extra bookkeeping video alone keeps - is data on these two objects.
@@ -912,7 +926,7 @@ export function createNativeProxy(options) {
     const videoPipeline = {
         afterCommit: ({ byteLength, storedBefore }) => {
             video.lastSegmentSize = byteLength;
-            video.lastSegmentTime = Date.now();
+            video.lastSegmentTime = ctx.clock.now();
             // Log the first segment fetch latency for timing diagnostics.
             if (stats.totalSegmentsFetched === 1) {
                 LOG.debug("timing:native", "First segment fetched for %s (%s bytes).", channelName, byteLength);
@@ -969,34 +983,44 @@ export function createNativeProxy(options) {
         return Math.round(lifecycle.manifestBackoffMs * jitter);
     }
     /**
-     * Orchestrates the poll cycle: fetches video and audio manifests in parallel, stores segments, and generates playlists after both stores are updated.
+     * Orchestrates the poll cycle: fetches the video manifest first, then runs video segment processing in parallel with the audio poll (the audio manifest fetch
+     * and its segments), and generates playlists after both stores are updated.
      */
     async function pollManifest() {
         if (lifecycle.stopped) {
             return;
         }
-        const pollElapsed = startTimer();
+        const pollElapsed = startTimer(clock);
         try {
-            const response = await chromeFetch(video.variantUrl, { signal: AbortSignal.timeout(SEGMENT_FETCH_TIMEOUT) });
-            if (!response.ok) {
-                video.consecutiveManifestFailures++;
-                stats.totalFetchErrors++;
-                // Classify the error via the shared threshold helper. Client errors (4xx) use the base threshold; server errors (5xx) and network conditions get double the
-                // attempts. This is the same logic the audio poll path uses, so video and audio escalate identically.
-                const isClientError = (response.status >= 400) && (response.status < 500);
-                const effectiveThreshold = manifestFailureThreshold(response.status);
-                LOG.debug("native:proxy", "Manifest poll failed for %s: HTTP %s (%s, %s/%s).", channelName, response.status, isClientError ? "client" : "server", video.consecutiveManifestFailures, effectiveThreshold);
-                if (video.consecutiveManifestFailures >= effectiveThreshold) {
-                    escalateProxyFailure({ ctx, message: "manifest poll failed " + String(video.consecutiveManifestFailures) + " times (HTTP " +
-                            String(response.status) + ")" });
+            const bound = timeoutSignal(SEGMENT_FETCH_TIMEOUT, { clock });
+            let body;
+            try {
+                const response = await chromeFetch(video.variantUrl, { signal: bound.signal });
+                if (!response.ok) {
+                    video.consecutiveManifestFailures++;
+                    stats.totalFetchErrors++;
+                    // Classify the error via the shared threshold helper. Client errors (4xx) use the base threshold; server errors (5xx) and network conditions get double
+                    // the attempts. This is the same logic the audio poll path uses, so video and audio escalate identically.
+                    const isClientError = (response.status >= 400) && (response.status < 500);
+                    const effectiveThreshold = manifestFailureThreshold(response.status);
+                    LOG.debug("native:proxy", "Manifest poll failed for %s: HTTP %s (%s, %s/%s).", channelName, response.status, isClientError ? "client" : "server", video.consecutiveManifestFailures, effectiveThreshold);
+                    if (video.consecutiveManifestFailures >= effectiveThreshold) {
+                        escalateProxyFailure({ ctx, message: "manifest poll failed " + String(video.consecutiveManifestFailures) + " times (HTTP " +
+                                String(response.status) + ")" });
+                        return;
+                    }
+                    schedulePoll(nextBackoffDelay());
                     return;
                 }
-                schedulePoll(nextBackoffDelay());
-                return;
+                video.consecutiveManifestFailures = 0;
+                lifecycle.manifestBackoffMs = MANIFEST_BACKOFF_BASE;
+                body = await response.text();
+            }
+            finally {
+                // The bound covers this poll's own network wait and nothing past it: a bound is armed for exactly the wait it bounds and disposed the moment that wait
+                // settles, so the segment work below runs with no timer of this poll's left pending on the proxy's clock.
+                bound.cancel();
             }
-            video.consecutiveManifestFailures = 0;
-            lifecycle.manifestBackoffMs = MANIFEST_BACKOFF_BASE;
-            const body = await response.text();
             LOG.debug("native:proxy", "Manifest poll for %s completed in %sms.", channelName, pollElapsed());
             LOG.debug("native:manifest", "Variant manifest for %s:\n%s", channelName, body);
             // Fetch and store video and audio segments in parallel so neither delays the other, and generate playlists after both stores are updated. This ensures video
@@ -1046,7 +1070,7 @@ export function createNativeProxy(options) {
             schedulePoll(nextBackoffDelay());
             return;
         }
-        // Schedule the next poll at MANIFEST_BACKOFF_BASE (3000ms, ~half a typical 6s segment) for timely detection of new segments.
+        // Schedule the next poll at MANIFEST_BACKOFF_BASE for timely detection of new segments.
         lifecycle.manifestBackoffMs = MANIFEST_BACKOFF_BASE;
         schedulePoll(MANIFEST_BACKOFF_BASE);
     }
@@ -1114,7 +1138,7 @@ export function createNativeProxy(options) {
      * Fetches and optionally decrypts a segment. This is the shared core used by both video and audio fetch paths, for media segments and for the initialization
      * segments an fMP4 source references. It handles the HTTP fetch, AES-128 decryption with key caching, and IV derivation. A caller with no key URL gets a plain
      * fetch, since the decryption block below gates on the key and the sequence argument only feeds keyed-IV derivation. Error tracking is the caller's
-     * responsibility since video and audio have independent failure thresholds.
+     * responsibility since video and audio keep separate consecutive-failure counts against the shared MAX_SEGMENT_FAILURES threshold.
      *
      * @param url - The segment URL.
      * @param sequence - The media sequence number (for IV derivation).
@@ -1124,15 +1148,23 @@ export function createNativeProxy(options) {
      * @returns The segment data (decrypted if necessary), or null on failure.
      */
     async function fetchAndDecryptSegment(url, sequence, ivHex, segKeyUrl, abortSignal) {
-        // The caller's cancellation and this fetch's own timeout are composed, so the segment ends on whichever arrives first and a caller with nothing to cancel
-        // gets the timeout alone.
-        const timeout = AbortSignal.timeout(SEGMENT_FETCH_TIMEOUT);
-        const response = await chromeFetch(url, { signal: abortSignal ? AbortSignal.any([abortSignal, timeout]) : timeout });
-        if (!response.ok) {
-            LOG.debug("native:proxy", "Segment fetch failed for %s: HTTP %s.", channelName, response.status);
-            return null;
+        // The caller's cancellation and this fetch's own bound are composed, so the segment ends on whichever arrives first and a caller with nothing to cancel gets
+        // the bound alone.
+        const bound = timeoutSignal(SEGMENT_FETCH_TIMEOUT, { clock });
+        let data;
+        try {
+            const response = await chromeFetch(url, { signal: abortSignal ? AbortSignal.any([abortSignal, bound.signal]) : bound.signal });
+            if (!response.ok) {
+                LOG.debug("native:proxy", "Segment fetch failed for %s: HTTP %s.", channelName, response.status);
+                return null;
+            }
+            data = Buffer.from(await response.arrayBuffer());
+        }
+        finally {
+            // The bound covers the segment's own fetch and body read. The key lookup below carries its own bound, and the decryption is pure work, so neither belongs
+            // inside this one.
+            bound.cancel();
         }
-        let data = Buffer.from(await response.arrayBuffer());
         // Decrypt if this segment has a key URL. The manifest's #EXT-X-KEY tag is authoritative - DAI streams can switch between clear and AES-128 mid-stream (e.g., ad
         // pods encrypted while main content is clear), so the initial probe classification cannot be relied upon. Segments before the first #EXT-X-KEY tag have
         // segKeyUrl === null (clear).
@@ -1142,7 +1174,7 @@ export function createNativeProxy(options) {
             if (!key) {
                 // The key fetch receives the raw cancellation signal rather than the composed one above, so it gets its own full timeout budget instead of inheriting
                 // whatever this segment's fetch has already spent.
-                key = await fetchDecryptionKey(segKeyUrl, abortSignal) ?? undefined;
+                key = await fetchDecryptionKey(segKeyUrl, { clock, signal: abortSignal }) ?? undefined;
                 if (!key) {
                     LOG.debug("native:proxy", "Decryption key unavailable for %s (key URL: %s).", channelName, segKeyUrl.slice(0, 80));
                     return null;
@@ -1193,10 +1225,10 @@ export function createNativeProxy(options) {
     }
     /**
      * Generates playlists from the stored segments. For streams without separate audio, generates a single variant playlist. When preroll is active (muxed audio only),
-     * produces a composite playlist with fMP4 preroll entries and MPEG-TS real entries bridged by a DISCONTINUITY tag. The preroll entries use the same fMP4 segments
-     * served during the standalone preroll phase, ensuring smooth MEDIA-SEQUENCE progression. For streams with separate audio, generates the video variant playlist
-     * and the master playlist referencing video.m3u8 and audio.m3u8 (no preroll - preroll is muxed and can't be split into separate renditions); the audio variant
-     * playlist is produced separately by generateAudioPlaylist(), which the poll loop calls alongside this function.
+     * produces a composite playlist with fMP4 preroll entries and the relayed source's real entries (MPEG-TS or fMP4) bridged by a DISCONTINUITY tag. The preroll
+     * entries use the same fMP4 segments served during the standalone preroll phase, ensuring smooth MEDIA-SEQUENCE progression. For streams with separate audio,
+     * generates the video variant playlist and the master playlist referencing video.m3u8 and audio.m3u8 (no preroll - preroll is muxed and can't be split into
+     * separate renditions); the audio variant playlist is produced separately by generateAudioPlaylist(), which the poll loop calls alongside this function.
      *
      * @param targetDuration - The #EXT-X-TARGETDURATION value from the service's manifest.
      */
@@ -1207,10 +1239,11 @@ export function createNativeProxy(options) {
         }
         const segmentEntries = Array.from(stream.hls.segments.keys());
         if (!hasAudio) {
-            if ((prerollSegmentCount > 0) && stream.hls.prerollStartTime && stream.hls.prerollBaseUrl) {
-                // Composite playlist with fMP4 preroll entries + MPEG-TS real entries. The prerollStartTime check ensures we only include preroll entries when the deferred
-                // timer has fired and the client is actually watching preroll. Without this check, fast native streams (where real content arrives before the preroll delay)
-                // would include unnecessary preroll entries. The compositor handles the sliding window with the maxPrerollInWindow cap.
+            if ((prerollSegmentCount > 0) && (stream.hls.prerollStartTime !== null) && stream.hls.prerollBaseUrl) {
+                // Composite playlist with fMP4 preroll entries and the relayed source's real entries (MPEG-TS or fMP4). The prerollStartTime check ensures we only
+                // include preroll entries when the deferred timer has fired and the client is actually watching preroll. Without this check, fast native streams (where
+                // real content arrives before the preroll delay) would include unnecessary preroll entries. The compositor handles the sliding window with the
+                // preroll-in-window cap.
                 updatePlaylist(streamId, buildCompositePlaylist({
                     composite,
                     prerollBaseUrl: stream.hls.prerollBaseUrl,
@@ -1220,19 +1253,19 @@ export function createNativeProxy(options) {
                     segmentIndex: video.segmentIndex,
                     targetDuration,
                     videoMetadata: video.metadata
-                }));
+                }), clock.now());
             }
             else {
                 // No preroll active - standard variant playlist. The segment index may still be offset (starting at prerollSegmentCount) to reserve the index space, but no
                 // preroll entries are included.
-                updatePlaylist(streamId, buildVariantPlaylist(segmentEntries, video.metadata, "segment", targetDuration));
+                updatePlaylist(streamId, buildVariantPlaylist(segmentEntries, video.metadata, "segment", targetDuration), clock.now());
             }
         }
         else {
             // Separate audio - generate video variant playlist and master playlist. Preroll is not supported for separate audio streams (preroll is muxed).
             updateVideoPlaylist(streamId, buildVariantPlaylist(segmentEntries, video.metadata, "segment", targetDuration));
             // Estimate bandwidth from stored segment sizes and durations. Sum total bytes and total duration across video segments, then convert to bits per second.
-            // Falls back to 5 Mbps when no duration data is available (first segment before durations are populated).
+            // Falls back to 5 Mbps when the video window holds no segment with a usable duration yet, such as an audio advance arriving before the first video segment.
             let bandwidth = 5000000;
             let totalBytes = 0;
             let totalDuration = 0;
@@ -1252,7 +1285,7 @@ export function createNativeProxy(options) {
                 "#EXT-X-MEDIA:TYPE=AUDIO,GROUP-ID=\"audio\",NAME=\"English\",DEFAULT=YES,AUTOSELECT=YES,URI=\"audio.m3u8\"\n" +
                 "#EXT-X-STREAM-INF:BANDWIDTH=" + String(bandwidth) + ",AUDIO=\"audio\"\n" +
                 "video.m3u8\n";
-            updatePlaylist(streamId, masterPlaylist);
+            updatePlaylist(streamId, masterPlaylist, clock.now());
         }
         // Release initialization segments the freshly-generated window no longer references. This runs after generation so the retain set reflects exactly the
         // segments the playlist just published.
@@ -1276,11 +1309,11 @@ export function createNativeProxy(options) {
         pruneTrackInits(streamId, "audio", audio.metadata, audioEntries);
     }
     /**
-     * Schedules the next manifest poll after a delay. The sleep is awaited through the injected Clock port (defaulting to realClock) so tests can virtualize the
-     * polling cadence without depending on real timers. Cancellation semantics: stop() flips lifecycle.stopped, and the post-sleep guard catches that flip before
-     * issuing the next poll. The in-flight sleep itself is not cancelled - in production a stopped proxy lingers for at most the currently scheduled poll delay,
-     * which can be as long as MANIFEST_BACKOFF_CAP once jittered, before the awaiter wakes and exits cleanly. This is the same shape as retryOperation in
-     * utils/retry.ts which already adopted the Clock port for the same reason.
+     * Schedules the next manifest poll after a delay. The sleep is awaited through the injected Clock port (defaulting to the system clock) so tests drive the
+     * polling cadence on a virtual timeline rather than against real timers. Cancellation semantics: stop() flips lifecycle.stopped, and the post-sleep guard
+     * catches that flip before issuing the next poll. The in-flight sleep itself is not cancelled - in production a stopped proxy lingers for at most the currently
+     * scheduled poll delay, which can be as long as MANIFEST_BACKOFF_CAP once jittered, before the awaiter wakes and exits cleanly. This is the same shape
+     * retryOperation in utils/retry.ts takes, for the same reason.
      *
      * @param delayMs - Delay in milliseconds before the next poll.
      */
@@ -1289,28 +1322,27 @@ export function createNativeProxy(options) {
             return;
         }
         void (async () => {
-            await clock.sleep(delayMs);
+            await clock.delay(delayMs);
             if (lifecycle.stopped) {
                 return;
             }
             void pollManifest();
         })();
     }
-    // The proxy's teardown: flip the lifecycle flag the polling awaiter checks, and cancel the pending token-refresh timer. Defined as a const so it can be exposed
-    // both as stop() (the established domain verb) and as [Symbol.dispose] (the TC39 protocol), making the proxy a self-disposing node without duplicating the body.
+    // The proxy's teardown: flip the lifecycle flag the polling awaiter checks, cancel the proxy's open fetches, and cancel the pending token-refresh timer.
+    // Defined as a const so it can be exposed both as stop() (the established domain verb) and as [Symbol.dispose] (the TC39 protocol), making the proxy a
+    // self-disposing node without duplicating the body.
     const stop = () => {
         lifecycle.stopped = true;
         // Cancel every fetch the proxy still has open - segments, initialization segments, and decryption keys - so teardown does not wait on a CDN and no
         // straggler write can land after the stream's state has been cleared.
         lifecycle.abortController.abort();
-        // The polling cadence sleep is owned by schedulePoll's awaiter and is not cancelled here - the awaiter checks lifecycle.stopped after clock.sleep resolves
+        // The polling cadence sleep is owned by schedulePoll's awaiter and is not cancelled here - the awaiter checks lifecycle.stopped after clock.delay resolves
         // and exits before issuing the next poll. See schedulePoll's docblock for the cancellation contract.
         // Cancel the pending token refresh timer to prevent fire-after-termination. Without this, the timer fires on a stopped proxy and attempts to navigate a
         // potentially closed or reused page.
-        if (lifecycle.tokenRefreshTimer) {
-            clearTimeout(lifecycle.tokenRefreshTimer);
-            lifecycle.tokenRefreshTimer = null;
-        }
+        lifecycle.tokenRefreshTimer?.[Symbol.dispose]();
+        lifecycle.tokenRefreshTimer = null;
         LOG.debug("native:proxy", "Stopped native proxy for %s.", channelName);
     };
     return {
@@ -1345,9 +1377,7 @@ export function createNativeProxy(options) {
          * handle is live when the stream ends.
          */
         setTokenRefreshTimer: (timer) => {
-            if (lifecycle.tokenRefreshTimer) {
-                clearTimeout(lifecycle.tokenRefreshTimer);
-            }
+            lifecycle.tokenRefreshTimer?.[Symbol.dispose]();
             lifecycle.tokenRefreshTimer = timer;
         },
         start: () => {