Widen the MSE probe to audio, detached elements and the scene at a stall; name the stub in the working report (#100, #105)

[PatrickSt1991]

Two reports came in on 2026-10-03 and this is the build after both.

#100 — the freeze trail, with the hold in. FUSIONOF's gist (a build-e1a648d page with the whole native output) is the first trail to show the one-video hold and a freeze side by side. The hold did its job: the live stream next in the feed was held at rs0 ns0, its HEVC pipeline opened only on the release, and it then played. The reel on screen stopped anyway with the whole reel buffered, and at that second the native output has a fourth pipeline — GstTZAppSrc → omxtzaudiodec3 → mmaudiosink3, no video decoder — that nothing the probe watched had asked for. The probe watched <video> elements in the document and nothing else. So NuiMseWatch now:

• takes <audio> elements in the same listeners, named from the shared namer and marked (audio);
• wraps the src/srcObject setters and load() on HTMLMediaElement.prototype, pass-through, and writes v4 src blob not ours, detached / v4 load() ..., detached for an element that is not in the document, keeping such elements by WeakRef only (a strong list would keep a dead element's pipeline alive, which is the thing being hunted);
• lists the document's video and audio elements and then the detached ones at a stall, four at most;
• ends every stall with scene: N video, N audio in the document, N detached known, N iframes (N not ours).

The hold is unchanged. tools/msewatch/run.sh holds the new behaviour (audio named and listed, detached src and load() each leaving a line and the element listed, the setter reading back and reaching the attribute, a refused srcObject throwing the engine's own TypeError and leaving no line, the scene line telling about:blank from another origin) and passes; tools/msehold/run.sh still passes.

#105 — the AU7200 runs Overscan. sahlansahin's build-91f53ce page: ledger written on the first launch, and on the second the ladder, the census (the predicted four PS_* names exactly), engine stub: loaded from …, Chromium initialized, refcount=1, WebView created, the start screen loaded. The page a running engine serves had no engine stub: header line — only the failure page and the no-provider page did — so it gets one under engine init:.

INTERNALS has both readings (The hold held, and the reel froze anyway; the AU7200 paragraph under The census came back, and the stub ships) and the two state sections say what the next page decides. ./build.sh all passes.