F1 BLOCKING — walk() cycle detection (src/viewer/index.js:161)

Added a per-tree WeakSet visited-guard so the probe terminates. The depth cap alone didn't stop the infinite recursion: window/_parent/_top/frames/_globalObject/_globalProxy are mutually-reachable circular Proxies, so Strategy H's window scan re-walked the same identities along exponentially many paths. The set is declared inside walk (not the outer function) so the separate player trees stay independent. This is what was hanging npm test (exit 124); it now completes in ~15s.
F2 SHOULD-FIX — doc/behavior mismatch (src/background/background.js:299-322)
Reworded the referer-capture comment block. It claimed the referer was read "via onBeforeSendHeaders, which sees the request headers," but the code uses onBeforeRequest + chrome.tabs.get (deriving the referer from the source tab's URL). Now states the actual mechanism and documents why onBeforeSendHeaders+extraHeaders was avoided (extraInfoSpec is rejected by some Chromium builds and fails the whole SW).
F3 SHOULD-FIX — leaked settings file
git rm --cached .claude/settings.local.json and added it to .gitignore. It carried machine-specific absolute paths (/Users/kyle/.claude/...).
F4 FYI — package-lock churn (package-lock.json)
Removed the spurious root "dependencies": { @rollup/rollup-darwin-arm64 } and restored the dev: true / optional: true flags on that platform package so it matches the rest of the @rollup/rollup-* siblings.
F5 FYI — real provider hostnames in test fixtures
Swapped phncdn.com→neutral example.net (registrable-domain sibling test) and thisvid.com→example.com in data_flow/hls_qa/simple_video/referer_proxy test files, rewording comments that named the real sites. src/ and __tests__/ now have zero phncdn/thisvid/pornhub references.

__tests__/referer_proxy.test.mjs

@@ -252,26 +252,26 @@ describe('PR#5: per-host referer capture + proxy race', () => {
        });
     await loadBackground(env);
 
-       // Capture the provider referer for hv-h.phncdn.com (one edge subdomain).
-    await capture(env, 'https://hv-h.phncdn.com/hls/live/seg-1.ts', 'https://provider.example.com/watch');
+       // Capture the provider referer for hv-h.example.net (one edge subdomain).
+    await capture(env, 'https://hv-h.example.net/hls/live/seg-1.ts', 'https://provider.example.com/watch');
 
-       // Proxy a SIBLING subdomain ev-h.phncdn.com with NO referer in the message:
+       // Proxy a SIBLING subdomain ev-h.example.net with NO referer in the message:
      // the SW must resolve it from the domain-keyed store.
     const handler = env.handlers.onMessage[env.handlers.onMessage.length - 1];
     let resp;
-    handler({ type: 'GOON_PROXY_FETCH', url: 'https://ev-h.phncdn.com/hls/live/seg-1.ts' }, {}, (r) => { resp = r; });
+    handler({ type: 'GOON_PROXY_FETCH', url: 'https://ev-h.example.net/hls/live/seg-1.ts' }, {}, (r) => { resp = r; });
     await new Promise(r => setTimeout(r, 20));
 
     if (!resp || !resp.ok) throw new Error('sibling proxy failed: ' + JSON.stringify(resp));
     const rules = env.getSessionRules();
-    const rule = Object.values(rules).find(r => r.condition?.requestDomains?.includes('phncdn.com'));
-    if (!rule) throw new Error('no domain-scoped DNR rule for phncdn.com; rules=' + JSON.stringify(rules));
+    const rule = Object.values(rules).find(r => r.condition?.requestDomains?.includes('example.net'));
+    if (!rule) throw new Error('no domain-scoped DNR rule for example.net; rules=' + JSON.stringify(rules));
     const ref = rule.action.requestHeaders?.find(h => h.header.toLowerCase() === 'referer')?.value;
     if (ref !== 'https://provider.example.com/watch') {
       throw new Error('sibling edge served wrong referer: ' + ref);
        }
      // The rule is scoped to the registrable domain, NOT the exact subdomain.
-    if (rule.condition.requestDomains?.includes('ev-h.phncdn.com')) {
+    if (rule.condition.requestDomains?.includes('ev-h.example.net')) {
       throw new Error('rule scoped to exact subdomain instead of registrable domain');
        }
     });
@@ -313,23 +313,23 @@ describe('PR#5: per-host referer capture + proxy race', () => {
     global.chrome = env.chrome;
     await loadBackground(env);
 
-        // Capture for hv-h.phncdn.com only.
-    await capture(env, 'https://hv-h.phncdn.com/hls/live/seg-1.ts', 'https://provider.example.com/watch');
+        // Capture for hv-h.example.net only.
+    await capture(env, 'https://hv-h.example.net/hls/live/seg-1.ts', 'https://provider.example.com/watch');
 
     const handler = env.handlers.onMessage[env.handlers.onMessage.length - 1];
     let resp;
     handler(
-       { type: 'GOON_GET_REFERERS', hosts: ['ev-h.phncdn.com', 'hv-h.phncdn.com', 'cdnA.example.com'] },
+       { type: 'GOON_GET_REFERERS', hosts: ['ev-h.example.net', 'hv-h.example.net', 'cdnA.example.com'] },
        {},
        (r) => { resp = r; });
     await new Promise(r => setTimeout(r, 15));
 
     if (!resp || !resp.ok) throw new Error('GOON_GET_REFERERS failed: ' + JSON.stringify(resp));
     const referers = resp.referers || {};
-    if (referers['ev-h.phncdn.com'] !== 'https://provider.example.com/watch') {
+    if (referers['ev-h.example.net'] !== 'https://provider.example.com/watch') {
       throw new Error('sibling subdomain did not resolve the captured referer: ' + JSON.stringify(referers));
        }
-    if (referers['hv-h.phncdn.com'] !== 'https://provider.example.com/watch') {
+    if (referers['hv-h.example.net'] !== 'https://provider.example.com/watch') {
       throw new Error('captured subdomain did not resolve its own referer: ' + JSON.stringify(referers));
        }
     if ('cdnA.example.com' in referers) {