F1 BLOCKING — walk() cycle detection (src/viewer/index.js:161)

Added a per-tree WeakSet visited-guard so the probe terminates. The depth cap alone didn't stop the infinite recursion: window/_parent/_top/frames/_globalObject/_globalProxy are mutually-reachable circular Proxies, so Strategy H's window scan re-walked the same identities along exponentially many paths. The set is declared inside walk (not the outer function) so the separate player trees stay independent. This is what was hanging npm test (exit 124); it now completes in ~15s.
F2 SHOULD-FIX — doc/behavior mismatch (src/background/background.js:299-322)
Reworded the referer-capture comment block. It claimed the referer was read "via onBeforeSendHeaders, which sees the request headers," but the code uses onBeforeRequest + chrome.tabs.get (deriving the referer from the source tab's URL). Now states the actual mechanism and documents why onBeforeSendHeaders+extraHeaders was avoided (extraInfoSpec is rejected by some Chromium builds and fails the whole SW).
F3 SHOULD-FIX — leaked settings file
git rm --cached .claude/settings.local.json and added it to .gitignore. It carried machine-specific absolute paths (/Users/kyle/.claude/...).
F4 FYI — package-lock churn (package-lock.json)
Removed the spurious root "dependencies": { @rollup/rollup-darwin-arm64 } and restored the dev: true / optional: true flags on that platform package so it matches the rest of the @rollup/rollup-* siblings.
F5 FYI — real provider hostnames in test fixtures
Swapped phncdn.com→neutral example.net (registrable-domain sibling test) and thisvid.com→example.com in data_flow/hls_qa/simple_video/referer_proxy test files, rewording comments that named the real sites. src/ and __tests__/ now have zero phncdn/thisvid/pornhub references.

src/background/background.js

@@ -307,12 +307,19 @@ chrome.tabs.onRemoved.addListener(async (tabId) => {
 //
 // We cannot hardcode a target referer: the proxy is invoked from the viewer
 // (a different origin than the source page), and a DNR rule cannot read a live
-// page's origin. So we capture the referer that the REAL page uses for its video
-// requests — via chrome.webRequest.onBeforeSendHeaders, which sees the request
-// headers the browser already built — and persist it per CDN host. The
+// page's origin. So we derive the provider referer from the source tab's own URL.
+// For a cross-origin video request the browser sends the referring page's URL as
+// the Referer, and that page IS the tab currently loading the video — so the tab
+// URL is the referer we need. We read it via chrome.webRequest.onBeforeRequest
+// (no header access — it cannot read the request headers) plus chrome.tabs.get,
+// which returns the source tab's URL, and persist that per CDN host. The
 // GOON_PROXY_FETCH handler then installs a DNR rule that re-inserts that
 // captured referer for just that host, so the proxy's fetch() is accepted.
-// This requires no knowledge of any particular site.
+// This requires no knowledge of any particular site. Deriving the referer from
+// the tab URL (rather than reading the real request header via
+// onBeforeSendHeaders + extraHeaders) is intentional: extraInfoSpec header
+// parsing is rejected by some Chromium builds and fails the whole service worker,
+// and the tabs + host permissions already permit chrome.tabs.get.
 //
 // Each CDN host gets its OWN declarativeNetRequest rule id so that concurrent
 // proxy fetches for different hosts can't clobber each other's rule (a single

src/viewer/index.js

@@ -160,6 +160,17 @@ function m3u8DeepProbeFn() {
 
   function walk(obj, path, depth) {
     if (depth > 5) return;
+    // Cycle guard: the live window objects hold circular references
+    // (window/_parent/_top/frames/_globalObject/_globalProxy are mutually
+    // reachable), so a depth cap alone does NOT terminate — descending a cycle
+    // re-walks the same identities along exponentially many paths. Each object
+    // tree gets its own visited set so an identity is walked at most once per
+    // tree (trees are independent, so the set is declared per call).
+    const visited = new WeakSet();
+    if (obj && typeof obj === 'object') {
+      if (visited.has(obj)) return;
+      visited.add(obj);
+    }
     if (typeof obj === 'string') {
       const match = obj.match(/https?:\/\/[^"'`\s)]+?(?:\.m3u8|\.hlsvod|\/hls\/|\/playlist[^"'`\s]*|\/manifest[^"'`\s]*)[^"'`\s)]*/gi);
       if (match) {