A VOD outlives the end AVPlayer calls while its own seekable range runs on (#287)

[superuser404notfound]

Fixes the ~53 s early stop reported in #287.

What happens

An MKV whose selected audio track outruns its video track ends tens of seconds early. AVPlayer fires didPlayToEndTime the moment its video renderer runs dry, and the engine forwards that as organic completion. .ended is terminal (#63/#164), so the audio-only tail is unreachable for the rest of the session, and a host that rebuilds the session at the boundary gets the same instant end again.

Measured, not inferred

Reproduced deterministically on macOS with aetherctl play on a synthesized MKV (60 s HEVC video, 113 s AAC audio):

	measured
container duration	113.023 s
video ends	59.93 s
playlist EXTINF sum	113.023 s (14 x 4.004 + 56.967)
didPlayToEndTime	60.03 s, final segment already fetched whole
53 s / 8 s / 2 s tail	all three end at 60.03 s

Two things this rules out. The playlist is not video-anchored: its EXTINF sum equals the container duration to the millisecond, so the presentation the engine advertises is self-consistent. And the tail length is irrelevant, so the trigger is the video exhaustion itself.

The fix

The engine cannot talk AVPlayer out of that call, so it stops repeating it. An end that lands more than a second inside the range AVPlayer itself still reports as seekable is refused; the item is re-seeked to the SAME position and resumed. That re-arms the renderers, and the tail plays out to an organic end at the real duration with nothing dropped.

The witness is the seekable range, not the loaded one that carries #169. At the instant of the premature end AVPlayer has already trimmed loadedTimeRanges back to the exhaustion point ([22.34, 60.01] against a playhead of 60.03), so the loaded range corroborates the mistake instead of refuting it, while seekableTimeRanges still reports [0, 113.02]. play() without the seek was measured too: it leaves the clock frozen at the boundary indefinitely.

Bounds: recoveries are capped at 3 per item and each must have moved the playhead, so a source that genuinely cannot continue costs one re-seek and then completes exactly as it does today. A live session fails the guard twice over (explicit flag, and its seekable end is the live edge). A real serve failure never reaches this path, failing the item with failedToPlayToEndTime / -12889 instead.

The transient pause AVPlayer takes across the re-seek is swallowed, so the engine never bounces through .paused for something the viewer must not notice.

Verification

fixture	before	after
53 s tail (dur 113.02)	ended 60.03	112.97, organic
8 s tail (dur 68.02)	ended 60.03	67.98, organic
2 s tail (dur 62.02)	ended 60.03	61.98, organic
equal-length A/V (dur 60.02)	ended 59.97	59.97, recovery never armed
resume at the boundary (60.03)	-	plays to 112.97

Each recovering fixture takes exactly one attempt.

• 1462 tests in 217 suites green (11 new in PrematureEndOfItemTests, written red first)
• strict Swift concurrency clean
• tvOS and iOS device builds green

aetherctl play gains --start-position, the resume anchor the reporter's hard-park arm needs to be reproducible at all.

🤖 Generated with Claude Code

https://claude.ai/code/session_01HX5zV3Fcf7Nzq4DYGdXvQE