From 57ac7cf87a12cd33e9c99cee3e5b00ffe9ced077 Mon Sep 17 00:00:00 2001
From: Patrick Stel <patrick@madebypatrick.nl>
Date: Sat, 3 Oct 2026 12:41:24 +0200
Subject: [PATCH] Widen the MSE probe to audio, detached elements and the scene
 at a stall; say in the working report's header that the stub is in (#100,
 #105)

FUSIONOF's 2026-10-03 page (build-e1a648d) is the first trail with the one-video
hold in and a freeze anyway: the live stream next in the feed was held at rs0 ns0
and its HEVC pipeline opened only on the release, the reel on screen stopped with
the whole reel buffered, and at that second the native output has a fourth
pipeline with an audio decoder and no video decoder that nothing the probe
watched asked for. The probe watched <video> elements in the document and nothing
else. It now names <audio> elements too, writes down a src, srcObject or load()
on a media element that is not in the document (from the prototype, pass-through,
the element kept by WeakRef only) and lists such elements at a stall, and closes
every stall with a scene line: video, audio, detached-known and foreign-frame
counts. The hold is unchanged. tools/msewatch holds all of it.

sahlansahin's 2026-10-03 page (build-91f53ce) says the AU7200 runs Overscan with
the stub in: refcount=1, WebView created, start screen loaded. The page a running
engine serves had no engine stub: header line (only the failure page and the
no-provider page did), so it gets one under engine init:.

INTERNALS records both readings; the 2025-sets and issue 105 state sections say
what the next page decides.
---
 CLAUDE.md                    |   6 +-
 docs/INTERNALS.md            | 201 +++++++++++++++++++++++++++++++++++
 src/elm/BrowserApp.cs        |   3 +
 src/nui/NuiMseWatch.cs       | 148 ++++++++++++++++++++++++--
 tools/msewatch/build-page.py |  45 +++++++-
 tools/msewatch/run.sh        |   6 ++
 6 files changed, 399 insertions(+), 10 deletions(-)

diff --git a/CLAUDE.md b/CLAUDE.md
index 16f7723..681b676 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -132,7 +132,11 @@ reads an init segment's codec and size, counts a second one as a switch, and
 reports a stall and its end without pausing, playing, loading or seeking. It
 also holds the per-element half to naming an MSE element and a plain-URL one,
 listing the other elements at a stall, and not reading a sample entry out of
-the ftyp's brand list.
+the ftyp's brand list; and, since the first trail with the hold in and a freeze
+anyway, to naming an `<audio>` element, writing down a `src` or `load()` on a
+media element that is not in the document and listing it at a stall, a refused
+`srcObject` throwing the engine's own error and leaving no line, and the
+`scene:` line telling a frame of ours from another origin's.
 
 ### The one-video harness
 
diff --git a/docs/INTERNALS.md b/docs/INTERNALS.md
index ae4250a..e6d1a94 100644
--- a/docs/INTERNALS.md
+++ b/docs/INTERNALS.md
@@ -1487,6 +1487,68 @@ install; the second serves the page that shows it), and the whole `:8081` page 
 and says in advance which of the five readings above means the AU7200 runs
 Overscan and which means it does not.
 
+**The AU7200 runs Overscan (2026-10-03, 08:24 UTC).** His page from
+`build-91f53ce` came with "This time I could see the header as Overscan, as well
+as the action list of remote controller keys on the right hand side", and it is
+the first reading in the list above, line for line. It took the two launches the
+reply asked for, though not for the reason the reply gave: the install had no
+ledger. Its `previous run` (11:14:44 on the TV's clock) is a launch with no census
+and no stub, the ladder starting *after* `ENGINE FAILURE` the way it does on an
+install the engine has never failed on — so `data/` did not come across with the
+install, and the first launch failed the ordinary way and wrote the ledger. The
+second (`this run`, 11:15:19) did everything in front of the engine: the ladder in
+266 ms, the census in 1124 ms reading the line predicted above to the letter
+(`115 needed (1 refused: libprivileged-service-client.so), 2520 imports, 4
+unresolved: PS_Mknod (FUNC), PS_Mount (FUNC), PS_ErrorToString (FUNC), PS_Umount
+(FUNC)`, with `libwgt-manifest-handlers.so.1` held back and loaded on the second
+pass), and then:
+
+```
+engine stub: loading /opt/usr/apps/org.apps2samsung.overscan/res/libprivileged-service-client.so (5148 bytes) RTLD_NOW|RTLD_GLOBAL
+engine stub: loaded from /opt/usr/apps/org.apps2samsung.overscan/res/libprivileged-service-client.so — the loader has libprivileged-service-client.so from us; the engine is asked with it in
+EFL subsystems: all up (9 checked)
+Chromium.Initialize()
+Chromium initialized, refcount=1
+WebView created
+...
+engine UA: Mozilla/5.0 (SMART-TV; LINUX; Tizen 6.0) AppleWebKit/537.36 (KHTML, like Gecko) 76.0.3809.146/6.0 TV Safari/537.36
+home screen shown
+load finished: data:text/html;... (the start screen)
+```
+
+The header reads `state : running`, `engine init: refcount=1`, and the start
+screen's own probe answered (`page sees : ... | 1920 | 1080 | 1 | Overscan`). So
+on this 2021 set the privileged-service client is the whole wall; four no-ops
+under its soname are enough for `ewk_init`; and the loader does honour an
+`RTLD_GLOBAL` handle in the app's namespace when it walks the implementation's
+`DT_NEEDED` — the third and fourth readings above are not this firmware. What the
+no-ops cost is not known: the engine wanted them for a sandbox mount, and if a
+page needs anything that mount would have carried it will show up as whatever
+does not work on that set from here on. Every launch on that install now loads
+the stub (the ledger gating it is permanent), and `engine-stub.txt` gains a
+`trying` and a `came back  engine started` line per launch, so the two-strikes
+rule never trips on a set where it works.
+
+One thing the page did not say, and the build after this fixes: the report a
+*running* engine serves had no `engine stub:` header line. The failure page and
+the no-provider page had one; the page everyone had been reading until now was
+one of those two, and the working page was never going to be served on this set
+until the stub was in. It carries the line now, under `engine init:`, so the next
+page from that set says in its header that the stub is loaded.
+
+What it changes elsewhere: **#95's Q70A is a Tizen 6.0 set on this same
+package**, closed 2026-09-09 on the Q80's inference that there was nowhere to put
+a stub. The AU7200 says a 6.0 set can map one from `res/`; whether the Q70A can is
+the ladder's question, and `build-91f53ce`'s `Overscan-tizen6.tpk` carries the
+ladder, the census and the stub, gated the same way. Whether to say so on a closed
+issue is Patrick's call; the reading, if it is tried, is the same five-way list
+above.
+
+**State of #105 (2026-10-03, afternoon):** the question the issue is named for
+is answered — the set runs Overscan on `build-91f53ce`, with the stub in. Nothing
+is waiting on a page. What comes next is whatever the browser does on that set,
+which on a Tizen 6.0 engine (Chromium 76) is a new question per report.
+
 ### `ELM_ACCEL` has to be set before the window exists
 
 `libchromium-ewk.so` has a library constructor whose entire body is
@@ -2662,6 +2724,126 @@ The one thing it cannot answer off-device is whether TikTok's player tolerates
 its preload waiting. The automatic pause/play that was set aside is the fallback
 if it does not.
 
+### The hold held, and the reel froze anyway
+
+The page FUSIONOF posted on 2026-10-03 (08:33 UTC, a gist, 628 KB with the whole
+native output) is from `build-e1a648d` — the hold in it is the same code as
+`build-91f53ce`'s, which touched neither script — and its `previous run` is the
+launch he reopened the issue over: a TikTok session ending at 13:58:04 on the TV's
+clock with `OnTerminate — closing normally`, relaunched at 13:58:15 for the page.
+It has the freeze, with the hold in and working, and it is the first trail to show
+the freeze and the hold's `hold`/`release` lines side by side:
+
+```
+13:55:11  load started: https://www.tiktok.com/            47 s to finish; probe and hold go in at 13:55:58
+13:55:27  native: omxtzuhdvideodec0 + omxtzaudiodec0        the landing reel, readied during the load
+13:56:02  media: playing=1 of 2 — 576x576 rs1 ... stuck     thirty seconds, not one mse: line — nothing of ours saw v1 load
+13:56:34  native: omxtzuhdvideodec1 ; mse: v1 playing t 0.3  a second pipeline for the same element, with no load event
+13:57:09  media: ... rs4 starved ; 13:57:10 v1 pause t 20.9  the swipe
+13:57:11  mse: v2 playing t 0.3 ; media: playing=1 of 1     v1 is out of the document
+13:57:18  mse: asks mse video/mp4;codecs="avc1.64001f,mp4a.40.2" -> yes
+13:57:18  native: GstTZAppSrc -> omxtzaudiodec3 -> mmaudiosink3   NO video decoder
+13:57:20  media: 768x576 rs4 stuck ; asks hev1.1.6.L93.B0,mp4a.40.2 -> yes ; hold v3 blob while v2 plays (twice: src set again)
+13:57:21  mse: stall v2 blob not ours t 6.3 buf 0.1-38.2 | frames 0
+13:57:21  mse: with v3 paused rs0 ns0 ms2, off screen, last no event seen
+13:57:29  v1 emptied ; hold: release v3 after 8.7s (play) ; v1 loadstart blob not ours
+13:57:30  ms2 add video hev1.1.6.L93.B0 + add audio mp4a.40.2 ; ms2 video init #1 hvc1 720x1280 ; v3 loadedmetadata 720x1280, dur inf
+13:57:30  ms4 add audio mp4a.40.29 + video avc1.64001f ; v1 loadedmetadata 1024x576, dur 18.6s, off screen
+13:57:31  native: omxtzh265dec0 + omxtzaudiodec4             the live stream's pipeline, after the release
+13:57:32  mse: v3 playing t 0.5 ... 13:57:53 v3 pause t 24.4  the live stream plays until the next swipe
+13:57:53  mse: v1 playing t 1.0 (1024x576)
+13:58:04  OnPause ; OnTerminate — closing normally
+```
+
+Read in order:
+
+- **The hold did what it was built to do.** v3 is the live stream (`hev1`, 720x1280,
+  `dur inf`), its blob set at 13:57:20 while v2 played and held — the `with` line a
+  second later has it at `rs0 ns0`, nothing loaded, no event — and its pipeline
+  (`omxtzh265dec0`, the run's one HEVC decoder) came up only after the release at
+  13:57:29. It then played for twenty seconds until he swiped, and v1 after it. So a
+  live stream next in the feed does not open a pipeline under the reel on screen any
+  more, and when it is its turn it plays.
+- **The reel on screen stopped anyway.** v2's playhead stopped at 6.3 s, about
+  13:57:17, with the whole reel buffered (`buf 0.1-38.2`), and stayed stopped until
+  the swipe at 13:57:29. That is the freeze he saw, "because of livestream" in the
+  sense that the live stream was next; the live stream's own pipeline had not opened.
+- **At that second a pipeline opened that nothing we watched asked for.** The native
+  output's fourth pipeline, 13:57:18: `GstTZAppSrc` → `omxtzaudiodec3` →
+  `mmaudiosink3`, and no `video_drm`, no `omxtzuhdvideodec` — every pipeline that
+  played a reel in this run has both. It is audio alone. On the trail, no `<video>`
+  in the document fired `loadstart`; v1 was out of the document (`playing=1 of 1`)
+  and paused; v3 was held. The one thing the page did at that second was ask
+  `isTypeSupported` for `avc1.64001f,mp4a.40.2` — the codec pair of the reel that
+  later became `ms4` on v1 — so TikTok was readying something, and the probe could
+  not see what it readied it on.
+- **What can open an audio-only pipeline unseen.** The probe listened to `<video>`
+  elements in the document (`tagName !== 'VIDEO'` returned early, `others()` walked
+  `getElementsByTagName('video')`). Outside that: an `<audio>` element; a media
+  element that is not in the document, whose events never reach the document's
+  listeners and which no DOM walk finds; a `<video>` in a frame of another origin,
+  where no script of ours runs at all; or the engine itself, rebuilding a playing
+  element's pipeline without its video track (Chromium does drop a video track as a
+  background optimisation; whether this engine does, and why it would on the
+  element on screen, nothing from here can say). The 13:56:34 line is a reminder
+  that the engine builds pipelines on its own account: v1 got a second decoder on
+  `play()` with no load event at all, which the earlier census of one pipeline per
+  reel had not allowed for.
+- **The first thirty seconds are the window the previous reading named.** v1 was
+  readied during a 47-second page load, before the scripts were in, and sat at
+  `rs1 stuck` — metadata and no data — from 13:56:02 until a fresh pipeline at
+  13:56:34 moved it. Not one line of ours covers it. Whether that was the proxy's
+  throughput or the engine is unknowable from this trail, and it is a second
+  symptom to keep apart from the freeze: a reel that never starts, not one that
+  stops.
+- **The proxy half held.** The first eight minutes of the launch are a different
+  proxy (`191.96.254.138:6185`) refusing every load (`load error ... Unknown, Unknown
+  (via proxy)` on TikTok, on `tiktok.com`, on DuckDuckGo), and `blank view: (never
+  blank)` with the session intact throughout — `build-7e24138`'s fix. He changed to
+  `198.23.243.226:6361` at 13:55 and everything above went through that one.
+
+The build after this asks the one question: **what asked for the pipeline that
+opened at the freeze.** `NuiMseWatch` now takes `<audio>` elements in the same
+listeners (named from the shared namer, marked `(audio)`); wraps the `src` and
+`srcObject` setters and `load()` on `HTMLMediaElement.prototype` — pass-through,
+the original's return and exceptions untouched, the probe's own line after a
+successful call — and writes `v4 src blob not ours, detached` / `v4 load() url
+host/seg, detached` when the element is not in the document; remembers every
+element it has heard of through a `WeakRef` (a strong list would keep a dead
+element and its pipeline alive, which is the thing being hunted; without `WeakRef`
+the registry is skipped and the lines still come); lists the document's video and
+audio elements and then the detached ones it knows at a stall, four at most; and
+ends every stall with `scene: N video, N audio in the document, N detached known,
+N iframes (N not ours)`, a frame being "not ours" when its `contentDocument` cannot
+be read. `tools/msewatch/run.sh` holds all of it: an audio element named and
+listed, a detached element's `src` and `load()` each leaving a line and the
+element listed at the stall, the setter reading back and reaching the attribute, a
+refused `srcObject` throwing the engine's own `TypeError` and leaving no line, and
+the scene line telling an `about:blank` frame from another origin's. The hold is
+unchanged; the harness run on it still passes.
+
+How to read the next freeze, said here first:
+
+- **An `(audio)` or a `detached` line in the second before the stall, or such an
+  element in the `with` lines with a recent event** — that is the element the hold
+  has to learn. A blob source on it is already held (the hold wraps
+  `HTMLMediaElement.prototype`, audio included, document or not); a plain URL would
+  mean lifting the plain-URL exemption for that element's kind, and the line names
+  the kind.
+- **`scene:` with a frame `not ours` and nothing else stirring** — it is in a frame
+  no script of ours enters. Nothing to hold from the top document.
+- **Nothing stirring at all** — the engine's own doing, below the page.
+
+The last two share a fix, and it is the one set aside in *Two videos, one decoder*:
+pause and play the stalled element from the probe's side once a stall has lasted a
+few seconds with nothing on the page to explain it. It was set aside because it
+recovers rather than prevents, and at the time every reel froze. With the freeze
+now confined to a live stream next in the feed, a two-second hiccup once in a
+session is a different trade from a stop on every reel, and `build-7e24138`'s
+reading — "pause and resume brings it back, which restarts the pipeline" — is the
+evidence it would work. It is not in this build: it changes playback, and the
+question of what opened the pipeline is worth one page first.
+
 ## What the NUI build never asked the engine for
 
 The two builds share `src/common` and nothing else, and everything the ElmSharp
@@ -3609,6 +3791,25 @@ the one its report has to come from. The state is:
   report forgets. Read it by the markers above: `dur inf` and `live page` name the
   stream, a `hold:` line in front of the stall says the hold was in, no `hold:` line
   on a page that was playing says it was not.
+  **That page came the same morning (2026-10-03, 08:33 UTC), from `build-e1a648d`
+  still, and it carries the freeze** — see *The hold held, and the reel froze
+  anyway* above for the whole reading. In one line: the hold did its job (the live
+  stream held at `rs0 ns0`, its HEVC pipeline opened only on the release, and it
+  then played), the reel in front of it stopped anyway with the whole reel
+  buffered, and at that second the native output has a fourth pipeline with an
+  audio decoder and no video decoder that nothing the probe watched had asked for.
+  The probe watched `<video>` elements in the document and nothing else, so the
+  build after this widens it, read-only: `<audio>` elements named and listed, a
+  `src`/`srcObject`/`load()` on a media element outside the document written down
+  and listed at a stall, and a `scene:` line closing every stall with the counts of
+  video, audio, detached and foreign-frame elements. The hold is unchanged.
+  **Waiting on:** the next freeze's page, read by those lines: an `(audio)` or
+  `detached` line at the stall's second names the element the hold has to learn;
+  a `scene:` with a frame `not ours` and nothing else puts it where no script of
+  ours runs; nothing stirring at all is the engine's own doing. The last two have
+  the same fix — the pause/play recovery set aside in *Two videos, one decoder*,
+  a different trade now that the freeze is confined to live streams — and the
+  first one has the hold.
 
 Five things about that set are settled and should not be re-derived: **key `5` is
 his, not ours** — the engine's overlay path is the only one that gives him a
diff --git a/src/elm/BrowserApp.cs b/src/elm/BrowserApp.cs
index 8c30d13..6e1cb6b 100644
--- a/src/elm/BrowserApp.cs
+++ b/src/elm/BrowserApp.cs
@@ -2413,6 +2413,9 @@ private string DiagnosticsText(bool full)
                    "state     : " + (_started ? "running" : "still starting") + "\n" +
                    "engine UA : " + _engineUserAgent + "\n" +
                    "engine init: " + _engineInit + "\n" +
+                   // Issue #105: on the AU7200 the engine only starts with our stub in,
+                   // and the one page that set runs now is this one, so it has to say so.
+                   "engine stub: " + EngineStub.Summary + "\n" +
                    "forced UA : " + forced + "\n" +
                    "page sees : " + _lastProbe + "\n" +
                    "view geom : " + _cachedGeometry + "\n" +
diff --git a/src/nui/NuiMseWatch.cs b/src/nui/NuiMseWatch.cs
index 291e2c0..210d64c 100644
--- a/src/nui/NuiMseWatch.cs
+++ b/src/nui/NuiMseWatch.cs
@@ -58,7 +58,24 @@ namespace Overscan
     /// stall is two videos holding the one hardware decoder. A stall with nothing
     /// else stirring is not that.
     ///
-    /// **This wraps four MSE calls and changes none of them.** Every wrapper calls the
+    /// `build-dccb5ad` made that a fact and <see cref="NuiMseHold"/> is the fix, and
+    /// the one freeze left (2026-10-03, a live stream next in the feed) has the hold
+    /// doing its job — the next element held at <c>rs0 ns0</c>, its pipeline opened
+    /// only on release — and the reel on screen stopping anyway, at the second a
+    /// fourth pipeline came up in the native output with an audio decoder and no
+    /// video decoder. Nothing this probe could see asked for it: it listened to
+    /// <c>&lt;video&gt;</c> elements in the document and nothing else. So it now
+    /// listens to <c>&lt;audio&gt;</c> too (named from the same namer, marked
+    /// <c>(audio)</c>), writes down a <c>src</c>, <c>srcObject</c> or <c>load()</c> on
+    /// a media element that is <em>not in the document</em> (<c>v4 src blob not ours,
+    /// detached</c>) and remembers that element weakly so a stall can list it, and
+    /// ends every stall with a <c>scene</c> line: how many video and audio elements
+    /// the document has, how many detached ones are known, and how many frames it
+    /// holds and how many of those are another origin's. A pipeline that opens with
+    /// none of that stirring is the engine's own doing, below the page.
+    ///
+    /// **This wraps four MSE calls and three media-element ones and changes none of
+    /// them.** Every wrapper calls the
     /// original with the same <c>this</c> and arguments and returns what it returned,
     /// and an exception from the original reaches the page unchanged after the wrapper
     /// has written down its name. Our own bookkeeping is in its own try, so a mistake
@@ -391,10 +408,121 @@ of the two ran first. */
 
   function tag(v) {
     var g = tags.get(v);
-    if (!g) { g = { id: name(v), ev: '', at: 0 }; tags.set(v, g); }
+    if (!g) {
+      g = { id: name(v) + (v.tagName === 'AUDIO' ? ' (audio)' : ''), ev: '', at: 0 };
+      tags.set(v, g);
+    }
     return g;
   }
 
+  /* --- elements the document cannot show ---
+
+     The 2026-10-03 trail: the hold held the next reel, and the reel on screen froze
+     at the second a pipeline with an audio decoder and no video decoder came up.
+     No <video> in the document had asked for anything. Two places such a pipeline
+     can come from without this probe hearing it: an <audio> element (the listeners
+     below took video only), and a media element that is not in the document at
+     all — events on one never reach the document, and no DOM walk finds it. So a
+     src, srcObject or load() on a detached element is written down here, from the
+     prototype, and the element is kept weakly so a stall can list it. WeakRef only:
+     a strong list would keep a page's dead element — and its pipeline — alive,
+     which is the very thing being looked for. Without WeakRef the registry is
+     skipped and the lines still come. Each wrapper calls the original with the same
+     this and arguments and returns what it returned; a throw reaches the page
+     unchanged. */
+  var ME = window.HTMLMediaElement;
+  var known = new WeakMap();
+  var detached = [];
+  var HasWeakRef = typeof WeakRef === 'function';
+
+  function remember(v) {
+    try {
+      if (!v || known.get(v) || !HasWeakRef) { return; }
+      known.set(v, true);
+      detached.push(new WeakRef(v));
+      if (detached.length > 12) { detached.shift(); }
+    } catch (e) {}
+  }
+
+  function describe(value) {
+    try {
+      var s = String(value);
+      var r = byUrl[s];
+      if (r) { return r.id; }
+      if (s.indexOf('blob:') === 0) { return 'blob not ours'; }
+      var a = document.createElement('a');
+      a.href = s;
+      return 'url ' + a.host + '/' + (a.pathname.split('/')[1] || '');
+    } catch (e) { return '?'; }
+  }
+
+  function sourced(v, what, how) {
+    remember(v);
+    if (v.isConnected) { return; }
+    report(tag(v).id + ' ' + what + ' ' + how + ', detached');
+  }
+
+  function wrapSetter(prop, how) {
+    if (!ME) { return; }
+    var d = Object.getOwnPropertyDescriptor(ME.prototype, prop);
+    if (!d || !d.set || !d.get || !d.configurable) { return; }
+    Object.defineProperty(ME.prototype, prop, {
+      configurable: true,
+      enumerable: d.enumerable,
+      get: d.get,
+      set: function (value) {
+        var r = d.set.call(this, value);
+        try { if (value) { sourced(this, prop, how(value)); } } catch (e) {}
+        return r;
+      }
+    });
+  }
+
+  wrapSetter('src', describe);
+  wrapSetter('srcObject', function () { return 'srcObject'; });
+
+  if (ME && typeof ME.prototype.load === 'function') {
+    var load = ME.prototype.load;
+    ME.prototype.load = function () {
+      var r = load.apply(this, arguments);
+      try { sourced(this, 'load()', origin(this)); } catch (e) {}
+      return r;
+    };
+  }
+
+  function elements() {
+    var out = [];
+    try {
+      var vs = document.querySelectorAll('video,audio');
+      for (var i = 0; i < vs.length; i++) { out.push(vs[i]); }
+      for (var j = 0; j < detached.length; j++) {
+        var o = detached[j].deref();
+        if (o && !o.isConnected) { out.push(o); }
+      }
+    } catch (e) {}
+    return out;
+  }
+
+  function scene() {
+    try {
+      var video = document.getElementsByTagName('video').length;
+      var audio = document.getElementsByTagName('audio').length;
+      var gone = 0;
+      for (var j = 0; j < detached.length; j++) {
+        var o = detached[j].deref();
+        if (o && !o.isConnected) { gone++; }
+      }
+      var frames = document.getElementsByTagName('iframe'), foreign = 0;
+      for (var i = 0; i < frames.length; i++) {
+        var doc = null;
+        try { doc = frames[i].contentDocument; } catch (e) {}
+        if (!doc) { foreign++; }
+      }
+      report('scene: ' + video + ' video, ' + audio + ' audio in the document, ' +
+             gone + ' detached known, ' + frames.length + ' iframes (' + foreign + ' not ours)');
+    } catch (e) {}
+  }
+
   /* Where an element's media comes from: one of our MediaSources by id, a blob we
      never saw made, a srcObject (a MediaSource handed over from a worker comes
      this way, and our wrappers on this window cannot see one), or a plain URL,
@@ -447,7 +575,8 @@ function where() {
     document.addEventListener(type, function (e) {
       try {
         var v = e.target;
-        if (!v || v.tagName !== 'VIDEO') { return; }
+        if (!v || (v.tagName !== 'VIDEO' && v.tagName !== 'AUDIO')) { return; }
+        remember(v);
         var g = tag(v);
         g.ev = type;
         g.at = Date.now();
@@ -461,21 +590,24 @@ function where() {
   });
 
   /* One line per other element, because a stall line already runs near the
-     trail's line length on its own. */
+     trail's line length on its own: the document's media elements first, then
+     the detached ones that are known, four at most, and the scene line last. */
   function others(v) {
     try {
-      var vs = document.getElementsByTagName('video');
-      for (var i = 0, n = 0; i < vs.length && n < 3; i++) {
+      var vs = elements();
+      for (var i = 0, n = 0; i < vs.length && n < 4; i++) {
         var o = vs[i];
         if (o === v) { continue; }
         n++;
         var g = tag(o);
         report('with ' + g.id + ' ' + (o.paused ? 'paused' : 'playing') +
                ' rs' + o.readyState + ' ns' + o.networkState + ' ' + origin(o) + ', ' +
-               onScreen(o) + ', last ' + (g.ev ? g.ev + ' ' + ago(g.at) : 'no event seen'));
+               (o.isConnected ? onScreen(o) : 'detached') +
+               ', last ' + (g.ev ? g.ev + ' ' + ago(g.at) : 'no event seen'));
       }
-      if (vs.length > 4) { report('with ' + (vs.length - 4) + ' more not listed'); }
+      if (vs.length > 5) { report('with ' + (vs.length - 5) + ' more not listed'); }
     } catch (e) {}
+    scene();
   }
 
   function look() {
diff --git a/tools/msewatch/build-page.py b/tools/msewatch/build-page.py
index 8e1a2ee..04362b8 100644
--- a/tools/msewatch/build-page.py
+++ b/tools/msewatch/build-page.py
@@ -86,6 +86,41 @@ def script():
 document.body.appendChild(plain);
 plain.src = 'https://example.invalid/video/reel.mp4';
 
+/* An <audio> element on a plain URL: the 2026-10-03 trail's pipeline had an audio
+   decoder and no video decoder, and the probe had been listening to <video> only.
+   It must be named from the same namer, marked, and left alone. */
+var aud = document.createElement('audio');
+aud.id = 'aud';
+aud.preload = 'auto';
+['pause','play','load'].forEach(function(f){ aud[f] = function(){ aud.__touched = f; }; });
+document.body.appendChild(aud);
+aud.src = 'https://example.invalid/audio/sound.mp3';
+
+/* A <video> that is never put in the document. Its events reach no listener on the
+   document and no DOM walk finds it, so the probe hears of it only from the
+   prototype: the src set and the load() must each leave a line saying `detached`,
+   the setter and load() must pass through, a refused srcObject must throw the
+   engine's own error and leave no line, and a stall must still list it. */
+var det = document.createElement('video');
+det.src = 'https://example.invalid/detached/reel.mp4';
+if (det.src !== 'https://example.invalid/detached/reel.mp4') { fail('src setter changed what src reads back: ' + det.src); }
+if (det.getAttribute('src') !== 'https://example.invalid/detached/reel.mp4') { fail('src setter did not reach the attribute'); }
+det.load();
+try {
+  det.srcObject = {};
+  fail('srcObject accepted a plain object');
+} catch (e) {
+  if (e.name !== 'TypeError') { fail('srcObject threw ' + e.name + ', not TypeError'); }
+}
+
+/* Two frames, one ours and one not: the scene line has to tell them apart. */
+var same = document.createElement('iframe');
+same.src = 'about:blank';
+document.body.appendChild(same);
+var other = document.createElement('iframe');
+other.src = 'https://example.invalid/frame/';
+document.body.appendChild(other);
+
 var ms = new MediaSource();
 var url = URL.createObjectURL(ms);
 if (typeof url !== 'string' || url.indexOf('blob:') !== 0) { fail('createObjectURL returned ' + url); }
@@ -175,9 +210,17 @@ def script():
   if (!has(/^v\\d loadstart url example\\.invalid\\/video, preload auto, (on|off) screen$/)) { fail('plain-URL element loadstart not reported'); }
   if (!has(/^with v\\d paused rs\\d ns\\d url example\\.invalid\\/video, (on|off) screen|no box, last \\w+ \\d+\\.\\ds ago$/)) { fail('stall does not list the plain-URL element'); }
   if (!has(/^with v\\d paused rs\\d ns\\d ms1, /)) { fail('stall does not list the other MSE element'); }
+  if (!has(/^v\\d \\(audio\\) loadstart url example\\.invalid\\/audio, preload auto, (no box|on screen|off screen)$/)) { fail('audio element loadstart not reported'); }
+  if (!has(/^v\\d src url example\\.invalid\\/detached, detached$/)) { fail('src on a detached element not reported'); }
+  if (!has(/^v\\d load\\(\\) url example\\.invalid\\/detached, detached$/)) { fail('load() on a detached element not reported'); }
+  if (has(/srcObject/)) { fail('a refused srcObject left a line'); }
+  if (!has(/^with v\\d paused rs\\d ns\\d url example\\.invalid\\/detached, detached, last no event seen$/)) { fail('stall does not list the detached element'); }
+  if (!has(/^with v\\d \\(audio\\) paused rs\\d ns\\d url example\\.invalid\\/audio, /)) { fail('stall does not list the audio element'); }
+  if (!has(/^scene: 3 video, 1 audio in the document, 1 detached known, 2 iframes \\(1 not ours\\)$/)) { fail('scene line wrong or missing: ' + mse.filter(function(l){ return /^scene/.test(l); })); }
+  if (mse.filter(function(l){ return /^scene/.test(l); }).length !== 1) { fail('scene reported other than once with the one stall'); }
   if (has(/^stall/) && mse.filter(function(l){ return /^stall/.test(l); }).length !== 1) { fail('one stall reported more than once'); }
 
-  [real, fake, plain].forEach(function(v){ if (v.__touched) { fail('probe called ' + v.__touched + ' on #' + (v.id || 'fake')); } });
+  [real, fake, plain, aud].forEach(function(v){ if (v.__touched) { fail('probe called ' + v.__touched + ' on #' + (v.id || 'fake')); } });
 
   document.getElementById('out').innerHTML =
     '<div id=RESULTS>RESULTS\\n' + (fails.length ? fails.join('\\n') : 'ok') +
diff --git a/tools/msewatch/run.sh b/tools/msewatch/run.sh
index c9b54ab..f6f5f9b 100755
--- a/tools/msewatch/run.sh
+++ b/tools/msewatch/run.sh
@@ -16,6 +16,12 @@
 # original reaches the caller with its own name, and the probe never pauses,
 # plays, loads or seeks. It also checks that it reads an init segment's codec
 # and size, counts a second init as a switch, and reports a stall and its end.
+# Since the 2026-10-03 trail (the hold holding and the reel freezing anyway, at
+# the second an audio-only pipeline opened) it also holds the probe to naming an
+# <audio> element, to writing down a src or load() on a media element that is
+# not in the document and listing it at a stall, to a refused srcObject throwing
+# the engine's own error and leaving no line, and to the scene line telling a
+# frame of ours from another origin's.
 #
 # The script is lifted out of src/nui/NuiMseWatch.cs rather than copied, for the
 # same reason as tools/msewatch: a harness that tests its own copy tests nothing.