prismcast 1.13.0 → 1.14.0

package/dist/streaming/setup.js

@@ -50,11 +50,11 @@ var __disposeResources = (this && this.__disposeResources) || (function (Suppres
     var e = new Error(message);
     return e.name = "SuppressedError", e.error = error, e.suppressed = suppressed, e;
 });
-import { BrowserCaptureImpairedError, BrowserSupersededError, BrowserUnavailableError, acquireCaptureStream, confirmSharedWindowPlacement, emulateCaptureSurface, emulateLayoutSurface, getBrowserInstance, getCaptureImpairment, getCurrentBrowser, installActivationHeal, noteBrowserCaptureImpaired, registerManagedPage, resolveSharedWindowCarrier, setCaptureProbe, syncWindowVisibility, unregisterManagedPage } from "../browser/index.js";
+import { BrowserCaptureImpairedError, BrowserSupersededError, BrowserUnavailableError, CaptureLaunchError, acquireCaptureStream, confirmSharedWindowPlacement, emulateCaptureSurface, emulateLayoutSurface, getBrowserInstance, getCaptureImpairment, getCurrentBrowser, installActivationHeal, noteBrowserCaptureImpaired, reaffirmCaptureSurface, registerManagedPage, resolveSharedWindowCarrier, setCaptureProbe, syncWindowVisibility, unregisterManagedPage } from "../browser/index.js";
 import { CAPTURE_SOURCE_UNAVAILABLE_MESSAGE, isChannelSelectionProfile } from "../types/index.js";
 import { CaptureAbandonedError, CaptureTurnTimeoutError, createCaptureLock } from "./captureLock.js";
 import { FINALIZE_SETTLE_DELAY, installManifestInterceptor } from "../browser/manifestInterceptor.js";
-import { LOG, chromeFetch, delay, extractDomain, formatError, getStreamContext, maxRetryDuration, registerAbortController, resolveFFmpegPath, retryOperation, runWithStreamContext, spawnFFmpeg, startTimer, timeoutSignal, waitWithTimeout } from "../utils/index.js";
+import { LOG, chromeFetch, extractDomain, formatError, getStreamContext, maxRetryDuration, registerAbortController, resolveFFmpegPath, retryOperation, runWithStreamContext, spawnFFmpeg, startTimer, timeoutSignal, toError, waitWithTimeout } from "../utils/index.js";
 import { getAuthDomainForChannel, getServiceDisplayName, resolveServiceKey } from "../config/services.js";
 import { getDomainConfig, getProfileForChannel, getProfileForUrl, resolveProfile } from "../config/profiles.js";
 import { getProviderByStrategy, invalidateDirectUrl, resolveDirectUrl } from "../browser/channelSelection.js";
@@ -65,17 +65,15 @@ import { getBuiltinProfile } from "../config/sites.js";
 import { getCachedEncryption } from "../native/probe.js";
 import { getCaptureMimeType } from "./codec.js";
 import { getDomainAuthState } from "../config/health.js";
-import { getNextStreamId } from "./registry.js";
 import { getUserProfiles } from "../config/userProfiles.js";
 import { isCaptureInfrastructureError } from "./recovery.js";
 import { monitorPlaybackHealth } from "./monitor.js";
 import { mutateChannels } from "../config/userChannels.js";
 import { openSharedWindowTab } from "../browser/tabSelection.js";
 import { pipeline } from "node:stream/promises";
-import { reaffirmCaptureSurface } from "../browser/cdp.js";
 import { startOverlayHandling } from "../browser/consent.js";
 import { systemClock } from "homebridge-plugin-utils";
-/* This module contains the common stream setup logic for HLS streaming. The core logic is split into two functions:
+/* This module contains the common stream setup logic for HLS streaming. At its core are createPageWithCapture() and setupStream():
  *
  * 1. createPageWithCapture(): Creates a browser page, starts media capture, navigates to the URL, and sets up video playback. This is the reusable core that both
  *    initial stream setup and tab replacement recovery use.
@@ -83,12 +81,16 @@ import { systemClock } from "homebridge-plugin-utils";
  * 2. setupStream(): Orchestrates stream creation by calling createPageWithCapture(), then starting the health monitor. This is the
  *    entry point for new stream requests.
  *
- * The separation allows tab replacement recovery (in monitor.ts) to reuse the capture setup logic without duplicating code. When a browser tab becomes unresponsive,
- * the recovery handler can close the old tab, call createPageWithCapture() to create a fresh one, and continue with the same stream ID.
+ * Beside them, the module holds the shared channel playback establishment (establishChannelPlayback), native manifest re-establishment
+ * (reestablishChannelManifest), the capture-system verification (verifyCaptureSystem), and the passive mid-life capture detector.
+ *
+ * The separation allows tab replacement recovery, built in hls.ts and invoked by the monitor, to reuse the capture setup logic without duplicating code. When a
+ * browser tab becomes unresponsive, the recovery handler calls createPageWithCapture() to establish a fresh page while the existing capture keeps serving, then
+ * swaps to the new page under the same stream ID.
  *
  * createPageWithCapture() handles:
  * - Browser page creation with CSP bypass
- * - Media stream initialization (native fMP4 or Matroska+FFmpeg)
+ * - Media stream initialization (a Matroska capture that FFmpeg remuxes to fMP4)
  * - Navigation with retry
  * - Video element detection and playback setup
  *
@@ -97,8 +99,6 @@ import { systemClock } from "homebridge-plugin-utils";
  * - Health monitor startup
  * - Cleanup function creation
  */
-// Native fMP4 capture uses MP4/AAC for direct HLS segmentation without transcoding.
-const NATIVE_FMP4_MIME_TYPE = "video/mp4;codecs=avc1,mp4a.40.2";
 // Capture initialization is serialized through a task-scoped lock. Chrome's tabCapture extension can only initialize one capture at a time - a second start while
 // one is in flight fails with "Cannot capture a tab with an active stream" - so every acquisition runs as a task on this one process-wide lock, which holds the
 // turn until the task's promise settles. Once a capture is established it runs concurrently with other captures without issue.
@@ -129,9 +129,9 @@ const PROBE_TEARDOWN_ALLOWANCE_MS = STOP_RECORDING_CEILING_MS + PAGE_CLOSE_MARGI
 // that retry while still preventing a pathological hang if multiple internal timeouts chain sequentially. Consumed by both the phase-2 race and the interception
 // budget below.
 const PLAYBACK_INIT_TIMEOUT = 45000;
-// Margin folded into the interception budget beyond the phases it explicitly sizes: the small span between phase-2 finishing and finalize firing (the window
-// resize and minimize, setupStream's pre-verification work) plus true slack. The interception window is a leak bound for a tune that dies without unwinding, not a
-// latency bound - no healthy path waits on it - so its generosity costs nothing.
+// Margin folded into the interception budget beyond the phases it explicitly sizes: the small span between phase-2 finishing and finalize firing (the
+// capture-surface re-affirmation and the window-visibility sync, setupStream's pre-verification work) plus true slack. The interception window is a leak bound for
+// a tune that dies without unwinding, not a latency bound - no healthy path waits on it - so its generosity costs nothing.
 const INTERCEPTION_BUDGET_MARGIN_MS = 5000;
 // The caller-visible capture-timeout messages, each defined once so the lock's deadline errors and any assertion test read the exact text. Both match
 // isCaptureInfrastructureError via its "timed out" substring, so they are exported for the classification assertion that locks that contract.
@@ -294,8 +294,8 @@ export function validateStreamUrl(url) {
 // Page and Capture Creation.
 /**
  * Disposes a browser page acquired during stream setup: unregisters it from managed-page tracking and closes it if still open. The close is fire-and-forget with a
- * debug log on error, matching the long-standing setup-failure cleanup behavior. Used as the DisposableStack disposer for pages in createPageWithCapture and
- * setupStream, and by the setup-result cleanup closure, so every setup-phase page teardown flows through one definition.
+ * debug log on error, because a page that fails to close during setup cleanup has no caller left to report to. Used as the DisposableStack disposer for pages in
+ * createPageWithCapture and setupStream, and by the setup-result cleanup closure, so every setup-phase page teardown flows through one definition.
  * @param page - The page to dispose.
  */
 function disposePage(page) {
@@ -307,18 +307,18 @@ function disposePage(page) {
     }
 }
 const defaultCreatePageWithCaptureDeps = { acquireCaptureStream, awaitCaptureVerdict: noteClassifiedCaptureFailure,
-    emulateCaptureSurface, getCurrentBrowser, installActivationHeal, openSharedWindowTab, reaffirmCaptureSurface, spawnFFmpeg, startOverlayHandling,
-    syncWindowVisibility };
+    emulateCaptureSurface, getCurrentBrowser, installActivationHeal, openSharedWindowTab, reaffirmCaptureSurface, resolveFFmpegPath, spawnFFmpeg,
+    startOverlayHandling, syncWindowVisibility };
 /* The window-topology answers the open primitive needs and cannot reach for itself: tabSelection.ts speaks to the capture extension alone, so the CDP-side carrier
- * resolution and placement confirmation arrive from here, where both modules are already in view. One record, referenced by both call sites, because the two call
- * sites want the identical pair.
+ * resolution and placement confirmation arrive from here, where both modules are already in view. One record, referenced by every call site, because every call
+ * site wants the identical pair.
  */
 const SHARED_WINDOW_TOPOLOGY = { confirmPlacement: confirmSharedWindowPlacement, resolveCarrier: resolveSharedWindowCarrier };
 /**
  * Creates a browser page with media capture and navigates to the URL. This is the reusable core function used by both initial stream setup and tab replacement
  * recovery. It handles:
  * - Creating a new browser page with CSP bypass
- * - Initializing media capture (native fMP4 or Matroska+FFmpeg)
+ * - Initializing media capture (a Matroska capture that FFmpeg remuxes to fMP4)
  * - Navigating to the URL with retry
  * - Setting up video playback via navigateToPage() + initializePlayback()
  * - Re-entering itself once, on a fresh page through a freshly acquired browser, when Chrome refuses the capture start and the mid-life probe's verdict says a
@@ -328,19 +328,22 @@ const SHARED_WINDOW_TOPOLOGY = { confirmPlacement: confirmSharedWindowPlacement,
  * - Creating the segmenter and attaching it to the capture session via captureSession.attachSegmenter()
  * - Registering/updating the stream in the registry
  * - Starting/updating the health monitor
- * - Handling cleanup on failure
+ *
+ * On failure the function disposes everything it acquired, so the caller owns only what a successful return hands over.
  *
  * @param options - Options for page and capture creation.
- * @param deps - The injected browser and overlay-poll collaborators; defaults to defaultCreatePageWithCaptureDeps. Threaded so a test drives this function without a
- * live Chrome by substituting the shared-browser accessor, the capture acquisition, and the static-capture overlay poll.
- * @returns The page, context, and capture session (which owns the raw capture stream and any FFmpeg child).
- * @throws Error if page creation, capture initialization, or navigation fails.
+ * @param deps - The injected browser-boundary collaborators (see CreatePageWithCaptureDeps); defaults to defaultCreatePageWithCaptureDeps, so a test can drive this
+ * function without a live Chrome.
+ * @returns The page, context, and capture session (which owns the raw capture stream and its FFmpeg child).
+ * @throws DirectUrlEstablishmentError when a resolved direct watch URL failed on evidence against it (the hint is already evicted); the browser supervisor's own
+ *   refusal errors from the browser accessor unchanged; a plain Error when Chrome crashed during capture initialization more times than the retry cap allows;
+ *   otherwise the page-creation, capture-initialization, or navigation failure as it was raised.
  */
 export async function createPageWithCapture(options, deps = defaultCreatePageWithCaptureDeps) {
     const env_1 = { stack: [], error: void 0, hasError: false };
     try {
         const captureElapsed = startTimer();
-        const { comment, onFFmpegError, profile, streamId, url } = options;
+        const { comment, onFFmpegError, profile, settings, streamId, url } = options;
         /* Bring the window on screen before anything else. Capture reads the compositor's output for the shared window, and that output is only composed correctly for a
          * window the desktop is presenting, so the sync has to land ahead of capture acquisition rather than alongside it. The pending registry entry is already in
          * capture mode by the time any caller reaches here, on both request paths, so the policy reads capture-active and this resolves to a window on screen.
@@ -349,7 +352,7 @@ export async function createPageWithCapture(options, deps = defaultCreatePageWit
         // Acquire every resource on a DisposableStack so that any throw - in capture initialization, navigation, or playback setup - disposes them structurally as the
         // function unwinds, in last-acquired-first order (capture session before page, so the capture stream is destroyed and STOP_RECORDING fires while the browser is
         // still connected, before the page closes). On success we move() the stack to disarm it and transfer ownership to the caller. This centralizes teardown that
-        // would otherwise be repeated in each failure path, and closes the navigation-path leak of the manifest interceptor.
+        // would otherwise be repeated in each failure path, and keeps the manifest interceptor inside the same teardown on every exit.
         const resources = __addDisposableResource(env_1, new DisposableStack(), false);
         /* Create browser page. The establishment goes on to start a capture, so a browser that can no longer start one refuses here, before a page exists. The page is
          * opened as a tab of the shared window rather than wherever Chrome would place it, because a capture tab rooted in a discovery window keeps that window alive
@@ -373,40 +376,38 @@ export async function createPageWithCapture(options, deps = defaultCreatePageWit
         // Install the tab-activation heal alongside it, before capture is acquired, so the page is enrolled and carries its listener from its first document onward:
         // whichever way this tab becomes the selected one, the capture's composition moves back to the emulated surface about a second later.
         await deps.installActivationHeal(page);
-        // Select MIME type based on capture mode. FFmpeg mode is more stable for long recordings because Chrome's native fMP4 MediaRecorder can become unstable. The
-        // codec decision (H.264 vs HEVC) is delegated to the codec module, which considers the user's allowlist and GPU hardware capabilities.
-        const useFFmpeg = CONFIG.streaming.captureMode === "ffmpeg";
-        const captureMimeType = useFFmpeg ? getCaptureMimeType() : NATIVE_FMP4_MIME_TYPE;
+        // The capture's Matroska MIME type carries the codec decision, which is the codec module's: it weighs the user's allowlist against the GPU's hardware encoders.
+        const captureMimeType = getCaptureMimeType();
         // Resolve the FFmpeg binary path up front, before the raw capture stream is acquired below. resolveFFmpegPath is a memoized resolver that can sticky-reject; if its
         // await sat between acquiring the raw capture stream and wrapping it in a CaptureSession, a rejection would strand the stream undestroyed (STOP_RECORDING never
         // fires, leaving chrome.tabCapture active). Resolving it here keeps any rejection on a path with no capture resource yet acquired, so the CaptureSession remains
-        // the single owner from the instant the stream exists. Falls back to "ffmpeg" so spawn() defers to PATH lookup; only meaningful in FFmpeg mode.
-        const ffmpegBin = useFFmpeg ? ((await resolveFFmpegPath()) ?? "ffmpeg") : "ffmpeg";
-        // The capture-pipeline composite, assigned once the raw capture stream and optional FFmpeg child exist and registered on the DisposableStack the moment it is built.
+        // the single owner from the instant the stream exists. Falls back to "ffmpeg" so spawn() defers to PATH lookup.
+        const ffmpegBin = (await deps.resolveFFmpegPath()) ?? "ffmpeg";
+        // The capture-pipeline composite, assigned once the raw capture stream and its FFmpeg child exist and registered on the DisposableStack the moment it is built.
         let captureSession;
         // Initialize media stream capture. The whole capture-init phase runs inside one try so a browser crash detected at turn grant drives the closed-page recursion,
         // while every other failure unwinds through the DisposableStack.
         try {
             const streamOptions = {
                 audio: true,
-                audioBitsPerSecond: CONFIG.streaming.audioBitsPerSecond,
+                audioBitsPerSecond: settings.audioBitsPerSecond,
                 mimeType: captureMimeType,
                 video: true,
-                videoBitsPerSecond: CONFIG.streaming.videoBitsPerSecond,
+                videoBitsPerSecond: settings.videoBitsPerSecond,
                 /* The dimension bounds hold the track to exactly the surface emulateCaptureSurface declared on this page, rather than to a second read of the configured
                  * preset, so a preset saved mid-establishment cannot leave the encoder constrained to dimensions the page was never emulated at.
                  *
-                 * The frame rate is constrained to a 30-60 fps band: 60 is the live-TV ceiling, and a 30 floor keeps motion smooth even when the user configures a lower
-                 * rate. The ceiling is fixed at 60 while the floor follows the user's configured rate (clamped into the band), so the encoder favours the requested rate but
-                 * never drops below 30. The readiness probe (attemptCaptureProbe) instead holds both bounds to a flat 30 because its acquisition fails or succeeds at the
-                 * tabCapture API level before encoding matters, so a representative-but-minimal constraint set suffices there.
+                 * Both frame-rate bounds hold the stream's frame rate, so the track is held to exactly the rate the stream started with, on its first capture and on every
+                 * tab replacement alike. The configuration load keeps that rate inside the range the setting's metadata declares, 60 being the live-TV ceiling and 30 the
+                 * floor below which motion judders. The readiness probe (attemptCaptureProbe) instead holds both bounds to a flat 30 because its acquisition fails or
+                 * succeeds at the tabCapture API level before encoding matters, so a representative-but-minimal constraint set suffices there.
                  */
                 videoConstraints: {
                     mandatory: {
-                        maxFrameRate: 60,
+                        maxFrameRate: settings.frameRate,
                         maxHeight: surface.height,
                         maxWidth: surface.width,
-                        minFrameRate: Math.max(30, Math.min(60, CONFIG.streaming.frameRate)),
+                        minFrameRate: settings.frameRate,
                         minHeight: surface.height,
                         minWidth: surface.width
                     }
@@ -444,61 +445,57 @@ export async function createPageWithCapture(options, deps = defaultCreatePageWit
                 },
                 turnWaitMs: CONFIG.streaming.navigationTimeout
             });
-            // For FFmpeg mode, spawn FFmpeg to transcode the Matroska stream to fMP4. FFmpeg copies the H264 video and transcodes Opus audio to AAC. The binary path was
-            // resolved up front (above) so no throwable await sits between acquiring the raw capture stream and wrapping it in the CaptureSession that owns it. The spawn and
-            // pipeline wiring below are synchronous, so the stream is owned the instant it exists.
-            let ffmpegProcess = null;
-            if (useFFmpeg) {
-                const ffmpeg = deps.spawnFFmpeg(ffmpegBin, CONFIG.streaming.audioBitsPerSecond, (error) => {
-                    LOG.error("FFmpeg process error: %s.", formatError(error));
-                    if (onFFmpegError) {
-                        onFFmpegError(error);
-                    }
-                }, streamId, comment);
-                ffmpegProcess = ffmpeg;
-                /* A disposed pipeline must never fire its error callback. The two listeners below sit on the process's own streams rather than inside the spawn wrapper,
-                 * so they are the two places a post-kill teardown event can still reach a caller, and each gates on the same teardown flag the wrapper's own handlers use.
-                 *
-                 * The gate is what keeps a tab replacement's discard silent. A replacement disposes the outgoing pipeline in the same synchronous frame it installs the
-                 * incoming one, so a stray event from the killed FFmpeg lands a tick later - against a registry that already holds a healthy new pipeline - and this
-                 * closure's callback would break the circuit on the very stream the replacement just saved. String filters cannot cover that: they name the errors
-                 * teardown is known to produce, and the point here is every error a killed pipeline produces.
-                 */
-                const isTornDown = () => ffmpeg.isShuttingDown();
-                // Handle pipe errors on stdout. Stdin errors are handled by pipeline() below.
-                ffmpeg.stdout.on("error", (error) => {
-                    const errorMessage = formatError(error);
-                    if (errorMessage.includes("EPIPE") || isTornDown()) {
-                        LOG.debug("streaming:ffmpeg", "FFmpeg stdout pipe closed: %s.", errorMessage);
-                    }
-                    else {
-                        LOG.error("FFmpeg stdout pipe error: %s.", errorMessage);
-                        ffmpeg.kill();
-                        if (onFFmpegError) {
-                            onFFmpegError(error);
-                        }
-                    }
-                });
-                // Pipe the Matroska capture stream to FFmpeg's stdin using pipeline() for proper cleanup. When FFmpeg is killed during tab replacement, pipeline() automatically
-                // destroys the source stream, preventing "write after end" errors that would occur with .pipe().
-                pipeline(stream, ffmpeg.stdin).catch((error) => {
-                    const errorMessage = formatError(error);
-                    // EPIPE, "write after end", and "Premature close" errors are expected during cleanup when FFmpeg is killed or the capture stream is destroyed, and a
-                    // pipeline whose FFmpeg is being torn down produces whatever it produces.
-                    if (errorMessage.includes("EPIPE") || errorMessage.includes("write after end") || errorMessage.includes("Premature close") || isTornDown()) {
-                        return;
-                    }
-                    // Unexpected pipeline errors require cleanup.
-                    LOG.error("Capture pipeline error: %s.", errorMessage);
+            // Spawn FFmpeg to remux the Matroska capture to fMP4: it copies the captured video and transcodes the Opus audio to AAC. The binary path was resolved up front
+            // (above) so no throwable await sits between acquiring the raw capture stream and wrapping it in the CaptureSession that owns it. The spawn and pipeline wiring
+            // below are synchronous, so the stream is owned the instant it exists.
+            const ffmpeg = deps.spawnFFmpeg(ffmpegBin, settings.audioBitsPerSecond, (error) => {
+                LOG.error("FFmpeg process error: %s.", formatError(error));
+                if (onFFmpegError) {
+                    onFFmpegError(error);
+                }
+            }, streamId, comment);
+            /* A disposed pipeline must never fire its error callback. The listeners below sit on the process's own streams rather than inside the spawn wrapper, so
+             * they are the places a post-kill teardown event can still reach a caller, and each gates on the same teardown flag the wrapper's own handlers use.
+             *
+             * The gate is what keeps a tab replacement's discard silent. A replacement disposes the outgoing pipeline in the same synchronous frame it installs the
+             * incoming one, so a stray event from the killed FFmpeg lands a tick later - against a registry that already holds a healthy new pipeline - and this
+             * closure's callback would break the circuit on the very stream the replacement just saved. String filters cannot cover that: they name the errors
+             * teardown is known to produce, and the point here is every error a killed pipeline produces.
+             */
+            const isTornDown = () => ffmpeg.isShuttingDown();
+            // Handle pipe errors on stdout. Stdin errors are handled by pipeline() below.
+            ffmpeg.stdout.on("error", (error) => {
+                const errorMessage = formatError(error);
+                if (errorMessage.includes("EPIPE") || isTornDown()) {
+                    LOG.debug("streaming:ffmpeg", "FFmpeg stdout pipe closed: %s.", errorMessage);
+                }
+                else {
+                    LOG.error("FFmpeg stdout pipe error: %s.", errorMessage);
                     ffmpeg.kill();
                     if (onFFmpegError) {
-                        onFFmpegError(error instanceof Error ? error : new Error(String(error)));
+                        onFFmpegError(error);
                     }
-                });
-            }
-            // Wrap the raw capture stream and optional FFmpeg child as one self-disposing pipeline unit, and register it for structural teardown. The session derives the
-            // segmenter input internally (FFmpeg's stdout in FFmpeg mode, the raw stream in native-fMP4 mode); the caller attaches the segmenter once it is created.
-            captureSession = createCaptureSession({ ffmpegProcess, rawCaptureStream: stream });
+                }
+            });
+            // Pipe the Matroska capture stream to FFmpeg's stdin using pipeline() for proper cleanup. When FFmpeg is killed during tab replacement, pipeline() automatically
+            // destroys the source stream, preventing "write after end" errors that would occur with .pipe().
+            pipeline(stream, ffmpeg.stdin).catch((error) => {
+                const errorMessage = formatError(error);
+                // EPIPE, "write after end", and "Premature close" errors are expected during cleanup when FFmpeg is killed or the capture stream is destroyed, and a
+                // pipeline whose FFmpeg is being torn down produces whatever it produces.
+                if (errorMessage.includes("EPIPE") || errorMessage.includes("write after end") || errorMessage.includes("Premature close") || isTornDown()) {
+                    return;
+                }
+                // Unexpected pipeline errors require cleanup.
+                LOG.error("Capture pipeline error: %s.", errorMessage);
+                ffmpeg.kill();
+                if (onFFmpegError) {
+                    onFFmpegError(toError(error));
+                }
+            });
+            // Wrap the raw capture stream and its FFmpeg child as one self-disposing pipeline unit, and register it for structural teardown. The session feeds the segmenter
+            // from FFmpeg's fMP4 stdout; the caller attaches the segmenter once it is created.
+            captureSession = createCaptureSession({ ffmpegProcess: ffmpeg, rawCaptureStream: stream });
             resources.use(captureSession);
         }
         catch (error) {
@@ -540,7 +537,7 @@ export async function createPageWithCapture(options, deps = defaultCreatePageWit
             }
             // Every other rejection - a caller-deadline CaptureDeadlineError, a refusal the one retry has already been spent on, or any other capture-init failure - just
             // unwinds. The verdict still gets the failure, because a browser that cannot start captures is worth marking whoever asked; nothing waits on it here.
-            // Resource teardown (page, interceptor, and the capture session once built) is handled by the DisposableStack as this throw unwinds the function scope.
+            // Resource teardown (the page, and the capture session once built) is handled by the DisposableStack as this throw unwinds the function scope.
             void deps.awaitCaptureVerdict(error);
             throw error;
         }
@@ -583,8 +580,8 @@ export async function createPageWithCapture(options, deps = defaultCreatePageWit
                  */
                 const tuneResult = await establishChannelPlayback(page, profile, manifestInterception, {
                     initOptions: { persistResolution: options.persistResolution, requestedUrl: navigationUrl, skipChannelSelection: usedDirectUrl },
-                    // Navigate with retry. The 10-second navigationTimeout is appropriate for page loads, and retryOperation correctly reloads the page on genuine navigation
-                    // failures. The retry ladder is this path's own policy, kept separate from channel selection so its timeout does not race the internal click retry loops
+                    // Navigate with retry. The configured navigationTimeout bounds each page load, and retryOperation reloads the page on genuine navigation failures. The
+                    // retry ladder is this path's own policy, kept separate from channel selection so its timeout does not race the internal click retry loops
                     // in channel selection strategies (guideGrid can take 15-20 seconds for binary search + click retries).
                     navigate: async () => {
                         await retryOperation({
@@ -771,7 +768,8 @@ const defaultEstablishChannelPlaybackDeps = { initializePlayback };
  * only per-path policy differs.
  * @param page - The page being established.
  * @param profile - The resolved site profile whose strategy drives navigation and channel selection.
- * @param handle - The interceptor observing this establishment, or null when nothing is observing it (a tab replacement, or an install that failed).
+ * @param handle - The interceptor observing this establishment, or null when nothing is observing it (a tab replacement, a skipped interception for a
+ * capture-locked or DRM-cached channel, or an install that failed).
  * @param options - The caller's navigation policy, its initialization options, and an optional settlement hook. See EstablishChannelPlaybackOptions.
  * @param deps - Injected browser-boundary collaborator; defaults to the real playback initializer in production.
  * @returns The result playback initialization produced: the video context for subsequent monitoring, and the strategy's direct-tune flag where it resolved one.
@@ -820,20 +818,17 @@ export async function adjudicateChannelSelection(handle, profile, directTune) {
  *
  * @param options - Stream configuration options.
  * @param onCircuitBreak - Callback invoked when the circuit breaker trips (stream unrecoverable).
- * @param deps - The injected browser and overlay-poll collaborators, forwarded to every establishment attempt this function makes; defaults to
- * defaultCreatePageWithCaptureDeps. Threaded for the same reason createPageWithCapture takes them: a test drives the establishment sequence - including its guide
- * fallback - without a live Chrome by substituting the shared-browser accessor, the capture launcher, and the overlay poll.
+ * @param deps - The injected browser-boundary collaborators (see CreatePageWithCaptureDeps), forwarded to every establishment attempt this function makes and
+ * read directly by its cleanup closure; defaults to defaultCreatePageWithCaptureDeps. Threaded for the same reason createPageWithCapture takes them: a test drives
+ * the establishment sequence - including its guide fallback - without a live Chrome.
  * @returns Setup result with capture session, cleanup function, and metadata.
  * @throws StreamSetupError if setup fails with appropriate status code and message.
  */
 export async function setupStream(options, onCircuitBreak, deps = defaultCreatePageWithCaptureDeps) {
-    const { channel, channelName, channelSelector, clickSelector, clickToPlay, onTabReplacementFactory, probeIdentity, profileOverride, staticCapture, url } = options;
-    // Use pre-allocated IDs from a pending registry entry when available, or generate new ones. Pre-allocated IDs ensure the abort controller, health monitor, and
-    // tab replacement handler all reference the same stream identity as the pending entry in the registry.
-    const streamId = options.streamId ?? generateStreamId(channelName, url);
-    const numericStreamId = options.numericStreamId ?? getNextStreamId();
-    // Stream setup is a composition point - it builds the capture lock, the health monitor, and the page - so it reads the system clock at its own boundary.
-    const startTime = systemClock.now();
+    const { channel, channelName, channelSelector, clickSelector, clickToPlay, numericStreamId, onTabReplacementFactory, probeIdentity, profileOverride, settings, staticCapture, streamId, url } = options;
+    // The stream's start instant is its registry entry's, taken at registration, so the health monitor's status and the tune-time line report the one instant the
+    // registry holds.
+    const { startTime } = options;
     // Create and register the AbortController for this stream. This allows pending evaluate calls to be cancelled immediately when the stream is terminated.
     const abortController = new AbortController();
     registerAbortController(streamId, abortController);
@@ -916,8 +911,8 @@ export async function setupStream(options, onCircuitBreak, deps = defaultCreateP
             try {
                 /* Skip CDP manifest interception when the channel is locked to screen capture, or when the probe cache already knows this stream's binding resolves to
                  * DRM. The per-channel override short-circuits first, so a forced channel never installs the interceptor: nothing intercepts a manifest, no native
-                 * attempt runs, no probe fires, and the encryption cache stays untouched by that stream. The cache half avoids creating a CDP session that sits idle for
-                 * 15 seconds before the interceptor timeout cleans it up; every stream carries an identity, ad-hoc URLs included, so that lookup needs no guard.
+                 * attempt runs, no probe fires, and the encryption cache stays untouched by that stream. The cache half avoids creating a CDP observer that can produce
+                 * nothing a DRM stream could use; every stream carries an identity, ad-hoc URLs included, so that lookup needs no guard.
                  */
                 const skipInterception = (channel?.forceCapture === true) || (getCachedEncryption(probeIdentity, systemClock.now()) === "drm");
                 // Build the persistResolution closure for the active channel. When the resolution layer in selectChannel() converts a category selector to a concrete call
@@ -932,6 +927,7 @@ export async function setupStream(options, onCircuitBreak, deps = defaultCreateP
                     onFFmpegError: onCircuitBreak,
                     persistResolution,
                     profile,
+                    settings,
                     skipManifestInterception: skipInterception,
                     streamId,
                     url
@@ -977,7 +973,8 @@ export async function setupStream(options, onCircuitBreak, deps = defaultCreateP
                     throw new StreamSetupError("Browser temporarily unavailable.", 503, "The browser can no longer start captures and will relaunch as soon as nothing is " +
                         "using it. Please retry shortly.", { cause: error });
                 }
-                // createPageWithCapture handles its own cleanup on failure (closes page, kills FFmpeg).
+                // createPageWithCapture disposes everything it acquired on failure (the capture session with its FFmpeg child, the interceptor, and the page), so nothing is
+                // left here to clean up.
                 const errorMessage = formatError(error);
                 const lowerMessage = errorMessage.toLowerCase();
                 const benignPatterns = ["abort", "session closed"];
@@ -985,14 +982,16 @@ export async function setupStream(options, onCircuitBreak, deps = defaultCreateP
                 if (!isBenign) {
                     LOG.error("Stream setup failed for %s: %s.", url, errorMessage);
                 }
-                /* Capture infrastructure errors should return 503 to signal Channels DVR to back off. These include Chrome capture state issues, capture-lock turn-wait
-                 * timeouts, and stream initialization failures. Using 503 with Retry-After prevents retry storms when there's a systemic issue. isCaptureInfrastructureError
-                 * (recovery.ts) is the single source of truth for this judgment, shared with the browser supervisor's readiness detection.
+                /* Capture infrastructure errors should return 503 to signal Channels DVR to back off. These include a browser whose capture system failed a launch gate,
+                 * Chrome capture state issues, capture-lock turn-wait timeouts, and stream initialization failures. Using 503 with Retry-After prevents retry storms when
+                 * there's a systemic issue. A launch-gate failure is answered by its type, a CaptureLaunchError, before the classifier reads any message, so the gate's
+                 * messages are free to state what happened. isCaptureInfrastructureError (recovery.ts) is the single source of truth for every other failure, shared with the
+                 * browser supervisor's readiness detection.
                  *
                  * The read here is purely for the client-facing status. The side effect that judgment also drives - handing the failure to the passive mid-life capture
                  * detector - fires inside createPageWithCapture's own catches, where every caller of the acquisition reaches it rather than only this one.
                  */
-                const isCaptureError = isCaptureInfrastructureError(errorMessage);
+                const isCaptureError = (error instanceof CaptureLaunchError) || isCaptureInfrastructureError(errorMessage);
                 // A failed tune on a service currently marked needs-sign-in most likely failed AT the auth wall, so the user-facing message leads with the remedy.
                 throw new StreamSetupError("Stream error.", isCaptureError ? 503 : 500, withSignInGuidance("Failed to start stream.", channelName, serviceName), { cause: error });
             }
@@ -1011,10 +1010,10 @@ export async function setupStream(options, onCircuitBreak, deps = defaultCreateP
             // Tune verification. The shared adjudication stage finalizes the manifest interceptor and confirms the captured master manifest URL belongs to the channel
             // that was just tuned. This step makes setupStream "verified by construction" - every consumer of StreamSetupResult (HLS preroll, HLS blocking, MPEG-TS,
             // native proxy, capture mode) receives a stream guaranteed to be on the requested channel without having to opt in or coordinate. Streams with no manifest
-            // interception at all (DRM-cached channels, tab replacements) have nothing to adjudicate and skip the step entirely; verifyManifestSelection owns which of
-            // the remaining ones it can speak to. A failure reason throws StreamSetupError so the existing failure path marks channel health, terminates the pending
-            // registry entry, and surfaces a clear error - never silently delivers the wrong channel. The scope guard disposes the capture session, interceptor, and page
-            // as the throw unwinds.
+            // interception at all (a channel locked to screen capture, a DRM-cached binding, or an install that failed) have nothing to adjudicate and skip the step
+            // entirely; verifyManifestSelection owns which of the remaining ones it can speak to. A failure reason throws StreamSetupError so the existing failure path
+            // marks channel health, terminates the pending registry entry, and surfaces a clear error - never silently delivers the wrong channel. The scope guard disposes
+            // the capture session, interceptor, and page as the throw unwinds.
             if (manifestInterception) {
                 const verifyError = await adjudicateChannelSelection(manifestInterception, profile, directTune);
                 if (verifyError) {
@@ -1022,12 +1021,13 @@ export async function setupStream(options, onCircuitBreak, deps = defaultCreateP
                     throw new StreamSetupError("Tune verification failed: " + verifyError, 502, withSignInGuidance("Tune verification failed for " + failureLabel + ". " + verifyError, channelName, serviceName));
                 }
             }
-            // Monitor stream info for status updates. The serviceTag enables service-specific monitoring flags (e.g., tinySegmentThreshold).
+            // Monitor stream info for status updates. The serviceTag enables service-specific monitoring flags (e.g., tinySegmentEvidenceSeconds).
             const monitorStreamInfo = {
                 channelName: channel?.name ?? null,
                 numericStreamId,
                 serviceName,
                 serviceTag: getDomainConfig(url)?.serviceTag,
+                settings,
                 startTime
             };
             // Start the health monitor for this stream.
@@ -1049,7 +1049,7 @@ export async function setupStream(options, onCircuitBreak, deps = defaultCreateP
                 await deps.syncWindowVisibility();
             };
             // Success: transfer ownership out of the scope guard. The cleanup closure and, once the session is installed on the registry entry, terminateStream become
-            // responsible for disposing the page and capture session; the interceptor continues into tune verification and native streaming.
+            // responsible for disposing the page and capture session; the interceptor, already finalized and verified above, continues into the native upgrade.
             owned.move();
             // Return the setup result.
             return {
@@ -1065,7 +1065,6 @@ export async function setupStream(options, onCircuitBreak, deps = defaultCreateP
                 profile,
                 profileName,
                 serviceName,
-                startTime,
                 streamId,
                 url
             };
@@ -1181,15 +1180,17 @@ export async function reestablishChannelManifest(options) {
  * times with a delay between attempts, giving the system time to settle before giving up. At boot this prevents a rapid restart storm where the service manager
  * relaunches PrismCast repeatedly, each attempt orphaning a Chrome process; at relaunch it provides in-launch settling before the supervisor counts a launch failure.
  * @param browser - The Chrome instance to verify (the local instance being launched, passed in rather than re-acquired to avoid re-entering the launch in flight).
+ * @param clock - The clock the wait between attempts and each attempt's own timing run on. Defaults to the system clock.
+ * @throws CaptureLaunchError when every attempt failed.
  */
-export async function verifyCaptureSystem(browser) {
+export async function verifyCaptureSystem(browser, clock = systemClock) {
     const PROBE_MAX_ATTEMPTS = 3;
     const PROBE_RETRY_DELAY = 5000;
     for (let attempt = 1; attempt <= PROBE_MAX_ATTEMPTS; attempt++) {
         // The launch gate runs its capture probe OFF the capture lock, deliberately: it fires pre-publish, when supervisor.current() is null, so a wedged gate task would
         // have no recovery target and would jam the shared lock. GATE mode keeps the acquisition bounded internally instead.
         // eslint-disable-next-line no-await-in-loop -- Sequential retries are intentional; each probe must complete before deciding whether to retry.
-        const result = await attemptCaptureProbe(browser, { boundMs: CAPTURE_PROBE_TIMEOUT_MS, kind: "gate" });
+        const result = await attemptCaptureProbe(browser, { boundMs: CAPTURE_PROBE_TIMEOUT_MS, kind: "gate" }, clock);
         // Probe succeeded.
         if (result === null) {
             return;
@@ -1198,57 +1199,62 @@ export async function verifyCaptureSystem(browser) {
         if (attempt < PROBE_MAX_ATTEMPTS) {
             LOG.warn("Capture probe attempt %d of %d failed: %s. Retrying in %ds.", attempt, PROBE_MAX_ATTEMPTS, result, PROBE_RETRY_DELAY / 1000);
             // eslint-disable-next-line no-await-in-loop -- Deliberate delay between sequential retry attempts.
-            await delay(PROBE_RETRY_DELAY);
+            await clock.delay(PROBE_RETRY_DELAY);
         }
         else {
             /* On Windows the probe's own error rarely names the cause, and two conditions account for nearly every failure there: a virtualization layer sitting between
              * Chrome and the display, and a profile that will not load an unpacked extension. Naming both in the thrown message saves the user a support round trip.
-             * The message is unchanged on every other platform, and the hint is appended after the probe's own text so the "timed out" substring the
-             * capture-infrastructure classifier reads is still present.
+             * The message is unchanged on every other platform, and the hint follows the probe's own text so the cause the probe named still leads. The failure's
+             * status comes from its type rather than from any wording here, so the hint is free to read as plain advice.
              */
             const windowsHint = (process.platform === "win32") ? " On Windows, Hyper-V or WSL can interfere with Chrome's capture pipeline, and Chrome refuses to " +
                 "load the capture extension unless the profile has extension developer mode enabled." : "";
             // The probe's message is a diagnostic fragment that may or may not end in a period, so we terminate it before appending a sentence of our own.
             const detail = ((windowsHint.length > 0) && !result.endsWith(".")) ? (result + ".") : result;
-            throw new Error("Capture system verification failed after " + String(PROBE_MAX_ATTEMPTS) + " attempts: " + detail + windowsHint);
+            throw new CaptureLaunchError("Capture system verification failed after " + String(PROBE_MAX_ATTEMPTS) + " attempts: " + detail + windowsHint);
         }
     }
 }
 /**
- * Executes a single capture probe attempt. Creates a temporary page on the given browser, tries to start a capture stream, and tears everything down cleanly. It
- * NEVER throws in either mode: it returns null on success or an error-message string on failure, so callers branch on the string. The two modes differ only in how
- * the acquisition is bounded - see CaptureProbeMode.
+ * Executes a single capture probe attempt. Creates a temporary page on the given browser, tries to start a capture stream, and tears everything down cleanly. A
+ * failed attempt never throws in any mode: it returns null on success or an error-message string on failure, so callers branch on the string. Opening the page
+ * and emulating its layout surface run inside the same try as the acquisition, so a rejection from either is reported the same way, releasing the page when one
+ * was opened, and the gate's retry loop goes on to its next attempt. The modes differ only in how the acquisition is bounded - see CaptureProbeMode.
  * @param browser - The Chrome instance to probe.
  * @param mode - The operating mode: gate (internal acquisition race) or midlife (self-timed acquisition on the lock).
  * @param clock - Clock used for the mid-life self-timing and the teardown confirmation. Defaults to the system clock.
- * @returns Null on success, or an error message string on failure.
+ * @returns Null on success, or an error message string on a failed attempt.
  */
 async function attemptCaptureProbe(browser, mode, clock = systemClock) {
-    /* The mid-life probe runs against a browser that is serving streams, so its page is opened as a tab of the shared window for the reason a stream's page is: a
-     * probe tab rooted in a discovery window would hold that window open for as long as the probe took. The launch gate keeps the plain create: it runs pre-publish,
-     * when the browser has exactly one window and no discovery window can exist yet, so its tab has no wrong window to land in - and a gate that has to stay bounded
-     * gains nothing from queuing behind the selection executor to prove it.
-     */
-    const page = (mode.kind === "midlife") ? await openSharedWindowTab(browser, { deps: SHARED_WINDOW_TOPOLOGY }) : await browser.newPage({ background: true });
-    registerManagedPage(page);
-    // The probe page carries the preset-sized layout at the display's density, the surface a capture page starts from before its own declaration, so the probe's
-    // acquisition keeps the shape the field validated.
-    const surface = await emulateLayoutSurface(page);
-    // Tears the probe page down cleanly: retire the raw capture stream (destroy plus the stop confirmation) while the browser is still connected, unregister the
-    // managed page, then close it. Shared by every success and self-timed-failure path in both modes.
-    const teardown = async (stream) => {
-        await retireRawStream(stream, clock);
-        unregisterManagedPage(page);
-        if (!page.isClosed()) {
-            await page.close();
-        }
-    };
+    // The page the attempt opened, held outside the try so the catch can release it. It stays null until the open resolves, so an open that rejects leaves the catch
+    // no page to close.
+    let openedPage = null;
     try {
+        /* The mid-life probe runs against a browser that is serving streams, so its page is opened as a tab of the shared window for the reason a stream's page is: a
+         * probe tab rooted in a discovery window would hold that window open for as long as the probe took. The launch gate keeps the plain create: it runs
+         * pre-publish, when the browser has exactly one window and no discovery window can exist yet, so its tab has no wrong window to land in - and a gate that has
+         * to stay bounded gains nothing from queuing behind the selection executor to prove it.
+         */
+        const page = (mode.kind === "midlife") ? await openSharedWindowTab(browser, { deps: SHARED_WINDOW_TOPOLOGY }) : await browser.newPage({ background: true });
+        openedPage = page;
+        registerManagedPage(page);
+        // The probe page carries the preset-sized layout at the display's density, the surface a capture page starts from before its own declaration, so the probe's
+        // acquisition keeps the shape the field validated.
+        const surface = await emulateLayoutSurface(page);
+        // Tears the probe page down cleanly: retire the raw capture stream (destroy plus the stop confirmation) while the browser is still connected, unregister the
+        // managed page, then close it. The launch gate, which races its acquisition internally, calls it on success; the mid-life probe, the only one that self-times
+        // its acquisition, calls it before judging that latency, so the page is torn down whether the acquisition lands inside the bound or past it.
+        const teardown = async (stream) => {
+            await retireRawStream(stream, clock);
+            unregisterManagedPage(page);
+            if (!page.isClosed()) {
+                await page.close();
+            }
+        };
         // Use the same capture MIME type and surface as the runtime. The stale state error occurs at the tabCapture API level before encoding matters, so matching
         // those runtime constraints ensures the probe exercises a representative acquisition. The constraints are held to the dimensions the declaration above
         // returned, so the probe holds its track to the surface the page actually carries rather than to a second read of the preset.
-        const useFFmpeg = CONFIG.streaming.captureMode === "ffmpeg";
-        const captureMimeType = useFFmpeg ? getCaptureMimeType() : NATIVE_FMP4_MIME_TYPE;
+        const captureMimeType = getCaptureMimeType();
         const streamOptions = {
             audio: true,
             mimeType: captureMimeType,
@@ -1295,8 +1301,9 @@ async function attemptCaptureProbe(browser, mode, clock = systemClock) {
         const stream = await acquireCaptureStream(page, streamOptions);
         const elapsed = clock.now() - startedAt;
         await teardown(stream);
-        // Report failure when the caller abandoned this probe at the lock's outer deadline (unobservable in practice - the lock already rejected the caller - but it keeps
-        // the never-throw contract and prevents stranding a capture), or when the acquisition's own latency exceeded the criterion bound.
+        // Report failure when the caller abandoned this probe at the lock's outer deadline (unobservable in practice - the lock already rejected the caller - but it
+        // reports the abandonment as a returned string, the way every failed capture here is reported, and prevents stranding a capture), or when the acquisition's
+        // own latency exceeded the criterion bound.
         if (mode.signal.aborted || (elapsed > mode.boundMs)) {
             return CAPTURE_PROBE_TIMEOUT_MESSAGE;
         }
@@ -1305,10 +1312,12 @@ async function attemptCaptureProbe(browser, mode, clock = systemClock) {
     }
     catch (error) {
         const errorMessage = formatError(error);
-        // Clean up the test page.
-        unregisterManagedPage(page);
-        if (!page.isClosed()) {
-            page.close().catch(() => { });
+        // Clean up the test page, when the attempt got as far as opening one.
+        if (openedPage) {
+            unregisterManagedPage(openedPage);
+            if (!openedPage.isClosed()) {
+                openedPage.close().catch(() => { });
+            }
         }
         return errorMessage;
     }
@@ -1342,8 +1351,8 @@ let captureVerdictInFlight = null;
  * Classifies a throw from the probe's run on the capture lock into a verdict or the absence of one. A turn-wait timeout means the probe never got to run: with
  * other streams tuning at the same moment it queued behind their legitimate acquisitions, and a lock that is busy says something about load, not about the browser
  * - a holder that is genuinely hung marks the browser through its own wedge. Every other value, the outer deadline above all, means the probe held its turn and its
- * own acquisition did not settle, which is exactly the failure the mark exists for. Pure and total, so the distinction the detector rests on is pinnable without a
- * browser.
+ * own acquisition did not settle, which is exactly the failure the mark exists for. Pure and total, so a test can assert the distinction the detector rests on
+ * without a browser.
  * @param error - The value the lock run threw.
  * @returns The outcome the detector acts on.
  */
@@ -1369,7 +1378,8 @@ async function probeCaptureSerialized(browser, timeout) {
             deadlineMessage: CAPTURE_PROBE_TIMEOUT_MESSAGE,
             deadlineMs: timeout + PROBE_TEARDOWN_ALLOWANCE_MS,
             // The probe's wedge is a loud warning only, never a second verdict: by wedge time the detector has already marked this browser from the returned failure
-            // (the outer deadline fires roughly 22s earlier), so a mark raised here would land on an instance that already carries one.
+            // (the outer deadline always fires first, because the lock derives the wedge bound to land strictly after the deadline), so a mark raised here would land
+            // on an instance that already carries one.
             onWedge: () => {
                 LOG.warn("A mid-life capture probe has wedged past the recovery bound; the browser was already marked when the probe's deadline fired, so this wedge " +
                     "is informational.");
@@ -1386,17 +1396,18 @@ async function probeCaptureSerialized(browser, timeout) {
  * Classifies an establishment failure and, when it carries a capture-infrastructure signature, hands it to the passive mid-life detector.
  *
  * This sits at the acquisition chokepoint rather than in one caller's catch, so every path that establishes a capture gets the detection: a fresh stream's setup,
- * a tab replacement, and anything added later. Both of createPageWithCapture's own catch blocks call it, which is what extends the coverage across phases - the
+ * a tab replacement, and anything added later. Each of createPageWithCapture's own catch blocks calls it, which is what extends the coverage across phases - the
  * acquisition catch sees a refused capture start, the establishment catch sees the playback-initialization timeout the pattern list also names.
  *
- * Every logical setup classifies at most once. What holds that rule at the two call sites is where each call sits: each classifies the failure it is about to
- * rethrow raw, and never one it is about to wrap for a retry. So a failure blamed on a direct watch URL classifies nothing, and the standing attempt that follows
- * it classifies for both. The alternative would hand the readiness detector two failures from one setup, which is two background probes deciding a single
- * browser's fate.
+ * Classification is skipped for the typed direct-URL failure: a failure blamed on a direct watch URL leaves createPageWithCapture wrapped for a retry and
+ * classifies nothing, and the standing attempt that follows it classifies for both. The refusal retry is the deliberate exception - the acquisition catch classifies the
+ * first refusal and waits on its verdict, because waiting on that verdict is the retry policy. A retry that is refused again, or whose navigation then fails,
+ * classifies a second time: the shared in-flight slot or the impairment already recorded against the browser absorbs that call when the first verdict is still
+ * pending or marked the browser, and otherwise it is a fresh question about a browser that has failed again since its last verdict.
  *
- * DirectUrlEstablishmentError is excluded here as well, as the backstop that keeps the rule true of a call site added later rather than as a filter the current
- * two depend on: neither of them can reach this with one, because the type exists only to leave this function, and the path that wraps into it throws before
- * the classification line is reached.
+ * DirectUrlEstablishmentError is excluded here as well, as the backstop that keeps the skip true of a call site added later rather than as a filter the existing
+ * call sites depend on: none of them can reach this with one, because the type exists only to leave createPageWithCapture, and the path that wraps into it throws
+ * before the classification line is reached.
  * @param error - The failure the establishment is about to rethrow.
  * @returns The verdict the detector reached, or null when this failure called for none.
  */