[Nawid3333]

Each finding was checked against the code; the false ones were dropped. Every
fix in the player and the background has a test that fails without it.

Player

• FastStreamClient: a player whose setup() or setSource() throws is destroyed
  and no longer left in client.player, where its video and loader lived on,
  ticked by the main loop, after a load that ended in an error.
• HLS: a segment loaded by HLSLoader's fallback (one the fragment store has no
  place for) is decrypted too (HLSFragmentRequester.decryptionFor); it reached
  the decoder still encrypted.
• OPFSManager.setup: a worker whose init fails is terminated and forgotten.
• The quality menu closes and empties itself when the next video has no
  levels, as the audio and language menus do; a track without a language is
  read out as "Unknown", not "undefined".
• xml2vtt: a cue without a start is skipped, one without a duration lasts to
  the next cue (or 2 s); NaN timestamps broke the whole track.
• The speed menu saves the speed 500 ms after its last change, as the volume
  is saved: an arrow key held on the speed button wrote it at every repeat.
• Logs: a received source and an added source are logged by URL and mode,
  without their headers (the page's Cookie and Authorization).
• content.js: the visibility observer gets the 0.3 threshold its own check
  uses, so it fires on the way back too.

Background

• TabTracker.reset() forgets the tab's playing players.
• VpnProxyMirror guesses a tab's proxy for hosts the page was not seen
  asking only when it is Firefox VPN's (a proxy authorization header): a PAC
  file's per-host choice was overridden for an intranet CDN. A host the page
  itself reached through a proxy is copied as before (the first version
  dropped those too and failed firefox-vpn.e2e.mjs; docs/notes/player.md).
• A failed tabs.remove or permissions-page tabs.create no longer rejects
  unhandled.

Workflows

• ci.yml, firefox-beta.yml, firefox-stable.yml: the host log and the e2e logs
  are uploaded for a job that ran out of time (cancelled) too.
• live-streams.yml: the report names cancelled and timed-out jobs as well.
• security-alerts.yml: an advisory without a summary no longer breaks the
  table; update-prs.yml: a manifest path with a leading slash matches.

Tools

• setup-dev-profile resolves .dev-profile from the repository, not the
  working directory; recut-patch refuses an empty resolved file; rebuild's and
  the splicer's doc comments say what the code does; setup.sh states the
  Ubuntu releases it targets (the ones CI runs on).

Tests: lint, typecheck, unit (2807 passed), workflows.

Not changed, for a decision:

• A speed set with a key (the presets, +/-) is not saved for the next video; only the speed menu saves it.
• Two security trade-offs from the review (header rules through the player page, signed URL tokens in saved archives) are written up separately.

🤖 Generated with Claude Code