[TheCryptoDonkey]

Chrome TV playback repeatedly discarded its buffer on recoveries, and prepared clips could end with missing audio. This change keeps a continuous padded AAC clock, overlaps bounded whole-fragment downloads and retains older buffered programme across small reconnect gaps. A twenty-second live target and an operational 48-segment receiver window provide jitter headroom. Playout enables a temporary 2x FFmpeg catch-up rate when supported, while older FFmpeg remains compatible. The publisher now supervises the existing Tor-only tunnel without falling back to a direct connection.

The standalone TV page uses Sapflow's MIT H.264/AAC fMP4 player, with in-picture play/pause, mute, volume, fullscreen and return-to-live controls. Pause preserves the MediaSource. Stop watching explicitly says You stopped watching and offers Play to rejoin. An authenticated Tor-only lifecycle notice distinguishes Ctrl+C from tunnel loss, with session scoping to reject late shutdowns. Temporary source loss displays Broadcast interrupted. Lifecycle state survives receiver-adapter restarts in an atomic private checkpoint. Read-only channel checks continue after an end and announce a returning broadcast without autoplay. Connection observations refresh on network events, on request and every fifteen seconds. Observed address changes close peer assistance; this is not a VPN kill switch. Bounded complete-read retries preserve the media buffer across a brief network change. A confirmed broadcast end drains buffered media, closes peer connections and displays a clear ended card; a temporary interruption remains reconnecting. Generated Sunburst artwork and a silent six-second Higgsfield ident have source prompts, provenance and digest receipts.

Public viewer RelaySwarm defaults on when Play is pressed, with a visible opt-out beside Watch and a persistent VPN recommendation, verified media commitments, bounded peer wait/upload and receiver fallback. Its diagram uses actual local peer/transfer metrics. iPhone Safari now selects ManagedMediaSource when ordinary MediaSource is absent, enables the same complete-fragment buffering and peer loader, obeys streaming hints and restores the remote-playback setting on Stop. Native-only fallback uses the complete-fragment mirror with a twenty-second start offset. A separate generated Chrome gate exercises managed capability selection, transfer suspension and cleanup; it is not physical Safari acceptance. An in-memory audience service counts expiring active player sessions; it does not claim unique people or retain IP history. The edge returns each viewer's own approximate IP location and identifying request metadata, using the actual navigation receipt and withholding secret values. Private Mac preview uses only trusted local assets, Tor media and a strict aggregate-only audience response, with peers and IP lookups disabled.

Validation: 59 JavaScript regressions, including an actual receiver test that distinguishes a missing fragment from confirmed master-playlist removal, 22 playout/preparation, 20 publisher and 19 preview and 5 lifecycle-client Python checks, three finite 20,000-input mutation gates, generated-video Chromium decoding with audio and all three clip changes, a delayed fragment, pause/resume without engine replacement, fullscreen, confirmed end, Stop and mobile/desktop screenshots. A separate generated-media browser gate verified changed-IP metadata, buffer preservation through an offline/online transition, a new-broadcast announcement and explicit rejoin. Two Chromium contexts verified real peer transfer, commitment rejection, publisher reconnect and origin fallback. Runtime dependency licences are distributed and reproducibly checked; hls.js and its Apache notices are removed from the new player.

Live qualification is recorded separately from CI. The final public player completed 810.439 seconds with 20,260 presented frames, zero waiting events and zero dropped frames. The separate Mac Tor preview completed the same observation with nine waiting events totalling 14.236 seconds, zero drops and no engine resets; it did not pass uninterrupted-playback acceptance. Metrics-only browser monitors and a reversible receiver deployment preserve existing relay policy and publisher isolation. Generated track joins and short reconnects pass the bounded decoding checks. A later full live Mac-preview observation found a Tor-side download slowdown after ten clean minutes: the buffer drained and recovered without an engine reset while the public player and receiver stayed live. This remains a private-preview continuity limitation; a sustained Tor outage can exhaust any finite buffer. The media CI job pins Ubuntu 24.04 and uses the upstream package mirror after an Azure-mirror download timeout. An iOS 18.3 WebKit simulator with actual ManagedMediaSource decoded 1,624 frames over 64.49 media seconds across all three generated tracks, with zero drops and zero buffering events. A separate public two-context run exchanged 4.9 MiB and 3.4 MiB of verified peer video over sixty seconds with zero drops or buffering. Both public contexts ran on one host; cross-network NAT and physical Safari/iPhone acceptance remain open. No real programme media, camera frames, operational hostnames, keys or private deployment evidence are included.

Additional bounded hardware observation: generated 3840 x 2160 H.264 was hardware-encoded and decoded through loopback Sapflow on an Apple M1, advancing 12.021 seconds with 299 frames and zero dropped frames. This does not qualify sustained Tor 4K ingest or programme quality.