diff --git a/Basis/Packages/com.basis.integration.ytdlp/Runtime/BasisYtDlpResolver.cs b/Basis/Packages/com.basis.integration.ytdlp/Runtime/BasisYtDlpResolver.cs
index a96d98421..47b9b01ae 100644
--- a/Basis/Packages/com.basis.integration.ytdlp/Runtime/BasisYtDlpResolver.cs
+++ b/Basis/Packages/com.basis.integration.ytdlp/Runtime/BasisYtDlpResolver.cs
@@ -96,6 +96,21 @@ public static async Task<BasisMediaSource> ResolveSourceAsync(string pageUrl, Ca
             BasisMediaSource source = SelectSource(info);
             if (source == null || string.IsNullOrEmpty(source.Uri))
                 throw new YtDlpException($"yt-dlp returned no player-ingestible format for '{BasisMediaUrlRouter.Redact(pageUrl)}'.");
+            // Carry display metadata on the source: the player keys its metadata on
+            // the page URL (matching what networking syncs, not the per-client CDN
+            // endpoint) and shows the real title. Everything here comes from the
+            // extraction that just ran — no extra fetch.
+            source.Metadata = new BasisMediaMetadata
+            {
+                SourceUrl = pageUrl,
+                Title = info.Title,
+                Uploader = info.Uploader,
+                ThumbnailUrl = info.Thumbnail,
+                Duration = info.Duration.HasValue && info.Duration.Value > 0
+                    ? TimeSpan.FromSeconds(info.Duration.Value)
+                    : (TimeSpan?)null,
+                Provider = "ytdlp",
+            };
             return source;
         }
 
diff --git a/Basis/Packages/com.basis.mediaplayer/Editor/BasisMediaPlayerPlaylistInspector.cs b/Basis/Packages/com.basis.mediaplayer/Editor/BasisMediaPlayerPlaylistInspector.cs
new file mode 100644
index 000000000..0d16e438c
--- /dev/null
+++ b/Basis/Packages/com.basis.mediaplayer/Editor/BasisMediaPlayerPlaylistInspector.cs
@@ -0,0 +1,69 @@
+using UnityEditor;
+using UnityEditor.UIElements;
+using UnityEngine;
+using UnityEngine.UIElements;
+
+[CustomEditor(typeof(BasisMediaPlayerPlaylist))]
+public class BasisMediaPlayerPlaylistInspector : Editor
+{
+    private const string UxmlPath = "Packages/com.basis.mediaplayer/Editor/StyleSheets/MediaPlayerPlaylistSDK.uxml";
+    private const string UssPath = "Packages/com.basis.mediaplayer/Editor/StyleSheets/MediaPlayerSDK.uss";
+
+    private BasisMediaPlayerPlaylist _target;
+    private VisualElement _root;
+    private Label _status;
+    private Button _previousBtn, _nextBtn;
+
+    public override VisualElement CreateInspectorGUI()
+    {
+        _target = (BasisMediaPlayerPlaylist)target;
+        _root = new VisualElement();
+
+        var tree = AssetDatabase.LoadAssetAtPath<VisualTreeAsset>(UxmlPath);
+        var sheet = AssetDatabase.LoadAssetAtPath<StyleSheet>(UssPath);
+        if (tree == null)
+        {
+            _root.Add(new HelpBox("MediaPlayerPlaylistSDK.uxml missing.", HelpBoxMessageType.Error));
+            return _root;
+        }
+        tree.CloneTree(_root);
+        if (sheet != null) _root.styleSheets.Add(sheet);
+        _root.Bind(serializedObject);
+
+        _status = _root.Q<Label>("StatusLabel");
+        _previousBtn = _root.Q<Button>("PreviousButton");
+        _nextBtn = _root.Q<Button>("NextButton");
+
+        if (_previousBtn != null) _previousBtn.clicked += () => { if (_target != null) _target.Previous(); };
+        if (_nextBtn != null) _nextBtn.clicked += () => { if (_target != null) _target.Next(); };
+
+        _root.schedule.Execute(Refresh).Every(250);
+        Refresh();
+        return _root;
+    }
+
+    private void Refresh()
+    {
+        bool playing = Application.isPlaying;
+        DisplayStyle buttons = playing ? DisplayStyle.Flex : DisplayStyle.None;
+        if (_previousBtn != null) _previousBtn.style.display = buttons;
+        if (_nextBtn != null) _nextBtn.style.display = buttons;
+
+        if (_status == null || _target == null) return;
+        int count = _target.Entries != null ? _target.Entries.Count : 0;
+        if (!playing)
+        {
+            _status.text = count == 1 ? "1 entry" : $"{count} entries";
+            return;
+        }
+        int i = _target.CurrentIndex;
+        if (i < 0 || i >= count)
+        {
+            _status.text = $"Nothing loaded from this playlist yet ({count} entries).";
+            return;
+        }
+        var entry = _target.Entries[i];
+        string name = entry == null ? "" : (!string.IsNullOrEmpty(entry.DisplayName) ? entry.DisplayName : entry.Url);
+        _status.text = $"Entry {i + 1}/{count} — {name}";
+    }
+}
diff --git a/Basis/Packages/com.basis.mediaplayer/Editor/BasisMediaPlayerPlaylistInspector.cs.meta b/Basis/Packages/com.basis.mediaplayer/Editor/BasisMediaPlayerPlaylistInspector.cs.meta
new file mode 100644
index 000000000..59828241e
--- /dev/null
+++ b/Basis/Packages/com.basis.mediaplayer/Editor/BasisMediaPlayerPlaylistInspector.cs.meta
@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: cc8d35b5c0814ac29eb1d806d77d6086
diff --git a/Basis/Packages/com.basis.mediaplayer/Editor/StyleSheets/MediaPlayerPlaylistSDK.uxml b/Basis/Packages/com.basis.mediaplayer/Editor/StyleSheets/MediaPlayerPlaylistSDK.uxml
new file mode 100644
index 000000000..0f9fea713
--- /dev/null
+++ b/Basis/Packages/com.basis.mediaplayer/Editor/StyleSheets/MediaPlayerPlaylistSDK.uxml
@@ -0,0 +1,27 @@
+<engine:UXML xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:engine="UnityEngine.UIElements" xmlns:editor="UnityEditor.UIElements" noNamespaceSchemaLocation="../../UIElementsSchema/UIElements.xsd" editor-extension-mode="False">
+    <engine:VisualElement class="bvp-root">
+        <engine:VisualElement name="HeaderCard" class="bvp-card bvp-header-card">
+            <engine:Label text="Basis Media Playlist" name="HeaderTitle" selectable="false" class="bvp-header-title"/>
+            <engine:Label text="Ordered play queue for a Basis Media Player" name="HeaderSubtitle" selectable="false" class="bvp-header-subtitle"/>
+        </engine:VisualElement>
+
+        <engine:Foldout text="Playlist" name="PlaylistFoldout" value="true" class="bvp-foldout">
+            <editor:PropertyField name="PlayerField" binding-path="Player"/>
+            <editor:PropertyField name="EntriesField" binding-path="Entries"/>
+        </engine:Foldout>
+
+        <engine:Foldout text="Behaviour" name="BehaviourFoldout" value="true" class="bvp-foldout">
+            <editor:PropertyField name="AdvanceField" binding-path="Advance"/>
+            <editor:PropertyField name="PlayOnStartField" binding-path="PlayOnStart"/>
+        </engine:Foldout>
+
+        <engine:VisualElement name="StatusCard" class="bvp-card">
+            <engine:Label text="" name="StatusLabel" selectable="false" class="bvp-mini-note"/>
+        </engine:VisualElement>
+
+        <engine:VisualElement name="ActionsCard" class="bvp-card bvp-actions-card">
+            <engine:Button text="Previous" name="PreviousButton" class="bvp-secondary-button"/>
+            <engine:Button text="Next" name="NextButton" class="bvp-primary-button"/>
+        </engine:VisualElement>
+    </engine:VisualElement>
+</engine:UXML>
diff --git a/Basis/Packages/com.basis.mediaplayer/Editor/StyleSheets/MediaPlayerPlaylistSDK.uxml.meta b/Basis/Packages/com.basis.mediaplayer/Editor/StyleSheets/MediaPlayerPlaylistSDK.uxml.meta
new file mode 100644
index 000000000..45dc1d8c0
--- /dev/null
+++ b/Basis/Packages/com.basis.mediaplayer/Editor/StyleSheets/MediaPlayerPlaylistSDK.uxml.meta
@@ -0,0 +1,10 @@
+fileFormatVersion: 2
+guid: b2b0e27c2f2741e0b22e5c3b479bde81
+ScriptedImporter:
+  internalIDToNameTable: []
+  externalObjects: {}
+  serializedVersion: 2
+  userData:
+  assetBundleName:
+  assetBundleVariant:
+  script: {fileID: 13804, guid: 0000000000000000e000000000000000, type: 0}
diff --git a/Basis/Packages/com.basis.mediaplayer/Native~/android/basis_android_decode.c b/Basis/Packages/com.basis.mediaplayer/Native~/android/basis_android_decode.c
index 0a7b93c39..25e224d82 100644
--- a/Basis/Packages/com.basis.mediaplayer/Native~/android/basis_android_decode.c
+++ b/Basis/Packages/com.basis.mediaplayer/Native~/android/basis_android_decode.c
@@ -84,6 +84,12 @@ struct basis_decoder {
     int asr, ach;
     int apcm_float; /* decoder emits float PCM (pcm-encoding 4) instead of 16-bit */
 
+    basis_codec_t ac;       /* audio lane: AAC (MediaCodec) or LPCM (direct convert) */
+    int aLpcmAssign;        /* Blu-ray channel_assignment (from the format's config blob) */
+    int aLpcmBits;          /* 16 or 24 */
+    float* lpcmBuf;         /* conversion scratch, grown to the largest frame batch */
+    int lpcmBufCap;
+
     basis_vk_present* vk;
 
     pthread_t worker;
@@ -276,6 +282,7 @@ void basis_decoder_destroy(basis_decoder_t* d) {
     if (d->reader) AImageReader_delete(d->reader);
     if (d->vk) basis_vk_destroy(d->vk);
     ring_free(&d->pcm);
+    free(d->lpcmBuf);
     free(d);
 }
 
@@ -351,7 +358,28 @@ int basis_decoder_set_video_format(basis_decoder_t* d, basis_codec_t codec,
 
 int basis_decoder_set_audio_format(basis_decoder_t* d, basis_codec_t codec,
                                    int sample_rate, int channels, const uint8_t* asc, int asc_len) {
-    if (!d || d->aconfigured || codec != BASIS_CODEC_AAC) return 0;
+    if (!d || d->aconfigured) return 0;
+
+    if (codec == BASIS_CODEC_LPCM) {
+        /* Decoder bypass, mirroring the Windows lane: no MediaCodec involved —
+         * submit_audio converts straight into the ring. 48 kHz / 16- or 24-bit
+         * only; the TS demuxer filters to these before announcing, this is the
+         * matching backstop. The config blob carries the Blu-ray
+         * channel_assignment + bits code. */
+        if (sample_rate != 48000 || channels < 1 || channels > 8 || !asc || asc_len < 2) return 0;
+        int bits = asc[1] == 1 ? 16 : asc[1] == 3 ? 24 : 0;
+        if (!bits) return 0; /* 20-bit unsupported */
+        d->ac = BASIS_CODEC_LPCM;
+        d->asr = sample_rate; d->ach = channels;
+        d->aLpcmAssign = asc[0];
+        d->aLpcmBits = bits;
+        ring_set_frame(&d->pcm, channels);
+        d->aconfigured = 1;
+        return 0;
+    }
+
+    if (codec != BASIS_CODEC_AAC) return 0;
+    d->ac = BASIS_CODEC_AAC;
     d->asr = sample_rate; d->ach = channels;
     ring_set_frame(&d->pcm, channels ? channels : 2);
     AMediaFormat* fmt = AMediaFormat_new();
@@ -389,8 +417,61 @@ int basis_decoder_submit_video(basis_decoder_t* d, const uint8_t* annexb, int le
     return 0;
 }
 
+/* Source-order -> WAVE-order channel map for the Blu-ray HDMV LPCM
+ * channel_assignment values whose stream order differs from WAVE (Blu-ray
+ * places the LFE last and the side pair before the rears). Same tables as the
+ * Windows lane, which match ffmpeg's pcm_bluray remap for assignments 9 (5.1),
+ * 10 (7.0) and 11 (7.1) and were verified by ear against a 7.1 channel-marker
+ * stream. NULL = identity (mono/stereo/3.0/4.0/5.0 already arrive in WAVE
+ * order). */
+static const int* lpcm_remap(int assign) {
+    static const int k51[6] = { 0, 1, 2, 4, 5, 3 };
+    static const int k70[7] = { 0, 1, 2, 5, 3, 4, 6 };
+    static const int k71[8] = { 0, 1, 2, 6, 4, 5, 7, 3 };
+    if (assign == 9) return k51;
+    if (assign == 10) return k70;
+    if (assign == 11) return k71;
+    return NULL;
+}
+
+/* LPCM bypass: big-endian 16/24-bit Blu-ray-order PCM -> interleaved WAVE-order
+ * float, straight into the ring. Whole frames only, so the ring keeps its
+ * channel phase (the alignment contract in the ring comment above). */
+static void submit_lpcm(basis_decoder_t* d, const uint8_t* p, int len) {
+    int ch = d->ach;
+    int bytes = d->aLpcmBits / 8;
+    int frame_bytes = ch * bytes;
+    int frames = frame_bytes > 0 ? len / frame_bytes : 0;
+    if (frames <= 0) return;
+    int floats = frames * ch;
+    if (floats > d->lpcmBufCap) {
+        float* nb = (float*)realloc(d->lpcmBuf, sizeof(float) * (size_t)floats);
+        if (!nb) return;
+        d->lpcmBuf = nb; d->lpcmBufCap = floats;
+    }
+    const int* map = lpcm_remap(d->aLpcmAssign);
+    for (int f = 0; f < frames; ++f) {
+        const uint8_t* s = p + f * frame_bytes;
+        float* o = d->lpcmBuf + f * ch;
+        for (int c = 0; c < ch; ++c) {
+            int oc = map ? map[c] : c;
+            if (bytes == 2) {
+                int v = (int16_t)((s[c * 2] << 8) | s[c * 2 + 1]);
+                o[oc] = v / 32768.0f;
+            } else {
+                int v = (s[c * 3] << 16) | (s[c * 3 + 1] << 8) | s[c * 3 + 2];
+                if (v & 0x800000) v -= 0x1000000;
+                o[oc] = v / 8388608.0f;
+            }
+        }
+    }
+    ring_write(&d->pcm, d->lpcmBuf, floats);
+}
+
 int basis_decoder_submit_audio(basis_decoder_t* d, const uint8_t* data, int len, int64_t pts_us) {
-    if (!d || !d->acodec) return -1;
+    if (!d || !data || len <= 0) return -1;
+    if (d->ac == BASIS_CODEC_LPCM) { submit_lpcm(d, data, len); return 0; }
+    if (!d->acodec) return -1;
     ssize_t ii = AMediaCodec_dequeueInputBuffer(d->acodec, 2000);
     if (ii >= 0) {
         size_t cap = 0;
diff --git a/Basis/Packages/com.basis.mediaplayer/Native~/basis_media_core.c b/Basis/Packages/com.basis.mediaplayer/Native~/basis_media_core.c
index 01e6ffabc..8e4ba917d 100644
--- a/Basis/Packages/com.basis.mediaplayer/Native~/basis_media_core.c
+++ b/Basis/Packages/com.basis.mediaplayer/Native~/basis_media_core.c
@@ -169,6 +169,21 @@ struct basis_media_engine {
     /* diagnostics (demux thread writes, main thread reads; minor races OK) */
     volatile long video_au_count;
     volatile long audio_frame_count;
+
+    /* Total media duration reported by the demuxer (VOD); 0 = unknown/live.
+     * Demux thread writes once, main thread reads — a torn read on 32-bit is
+     * the worst case and Windows/Android are 64-bit. */
+    volatile int64_t duration_us;
+
+    /* Absolute-seek handshake. The main thread posts target+seq under e->lock;
+     * each demux leg takes a posted request once (its own taken counter — a
+     * split source's two legs both reposition). HLS repositions at the segment
+     * source instead: active_hls is set while run_hls owns a context. */
+    long seek_seq;
+    int64_t seek_target_us;
+    volatile long seek_taken_main;
+    volatile long seek_taken_audio;
+    void* active_hls;   /* guarded by e->lock */
 };
 
 /* ---- state/error helpers (exported to internal) ------------------------- */
@@ -247,10 +262,13 @@ static void sink_video_format(void* user, basis_codec_t codec, const uint8_t* ed
     basis_decoder_set_video_format(e->decoder, codec, ed, ed_len, w, h);
     mutex_unlock(&e->submit_lock);
 }
-static void sink_video_au(void* user, const uint8_t* au, int len, int64_t pts, int key) {
+static void sink_video_au(void* user, const uint8_t* au, int len, int64_t pts, int64_t dts, int key) {
     basis_media_engine_t* e = (basis_media_engine_t*)user;
     if (!e->running) return;
-    pace_gate(e, pts);              /* paced mode: hold until ~real time; no-op otherwise */
+    /* Pace on the decode timestamp: gating on pts would sleep out a composition
+     * offset the decoder still needs the AU inside of, and starve the other
+     * track's earlier samples queued behind this one on the demux thread. */
+    pace_gate(e, dts);              /* paced mode: hold until ~real time; no-op otherwise */
     if (!e->running) return;        /* may have been stopped while pacing */
     e->video_au_count++;
     mutex_lock(&e->submit_lock);
@@ -284,8 +302,35 @@ static void sink_audio_frame(void* user, const uint8_t* data, int len, int64_t p
 static void sink_state(void* user, basis_media_state_t s) { basis_engine_set_state((basis_media_engine_t*)user, s); }
 static void sink_error(void* user, const char* m) { basis_engine_set_error((basis_media_engine_t*)user, m); }
 static void sink_eos(void* user) { basis_engine_set_state((basis_media_engine_t*)user, BASIS_MEDIA_STATE_ENDED); }
+static void sink_duration(void* user, int64_t us) { basis_media_engine_t* e = (basis_media_engine_t*)user; if (us > 0) e->duration_us = us; }
 static int  sink_is_running(void* user) { basis_media_engine_t* e = (basis_media_engine_t*)user; return e->running; }
 
+static int take_seek_common(basis_media_engine_t* e, volatile long* taken, int64_t* out_target_us) {
+    if (*taken == e->seek_seq) return 0;
+    mutex_lock(&e->lock);
+    long seq = e->seek_seq;
+    int64_t us = e->seek_target_us;
+    /* Re-anchor delivery pacing: only post-seek samples flow on this leg from
+     * here, and against the old anchor they'd read as far-future (a forward
+     * seek stalls the demux thread for the jump distance) or as late (a
+     * backward seek floods through unpaced and fast-forwards back). The next
+     * paced sample re-establishes base/wall from its own timestamp. */
+    if (*taken != seq) e->pace_started = 0;
+    mutex_unlock(&e->lock);
+    if (*taken == seq) return 0;
+    *taken = seq;
+    *out_target_us = us;
+    return 1;
+}
+static int sink_take_seek(void* user, int64_t* out_target_us) {
+    basis_media_engine_t* e = (basis_media_engine_t*)user;
+    return take_seek_common(e, &e->seek_taken_main, out_target_us);
+}
+static int audio_sink_take_seek(void* user, int64_t* out_target_us) {
+    basis_media_engine_t* e = (basis_media_engine_t*)user;
+    return take_seek_common(e, &e->seek_taken_audio, out_target_us);
+}
+
 static void install_sink(basis_media_engine_t* e) {
     e->sink.user = e;
     e->sink.on_video_format = sink_video_format;
@@ -295,6 +340,8 @@ static void install_sink(basis_media_engine_t* e) {
     e->sink.on_state = sink_state;
     e->sink.on_error = sink_error;
     e->sink.on_end_of_stream = sink_eos;
+    e->sink.on_duration = sink_duration;
+    e->sink.take_seek = sink_take_seek;
     e->sink.is_running = sink_is_running;
 }
 
@@ -306,8 +353,8 @@ static void install_sink(basis_media_engine_t* e) {
 static void audio_sink_video_format(void* user, basis_codec_t codec, const uint8_t* ed, int ed_len, int w, int h) {
     (void)user; (void)codec; (void)ed; (void)ed_len; (void)w; (void)h;
 }
-static void audio_sink_video_au(void* user, const uint8_t* au, int len, int64_t pts, int key) {
-    (void)user; (void)au; (void)len; (void)pts; (void)key;
+static void audio_sink_video_au(void* user, const uint8_t* au, int len, int64_t pts, int64_t dts, int key) {
+    (void)user; (void)au; (void)len; (void)pts; (void)dts; (void)key;
 }
 static void audio_sink_state(void* user, basis_media_state_t s) { (void)user; (void)s; }
 static void audio_sink_eos(void* user) { (void)user; }
@@ -321,6 +368,8 @@ static void install_audio_sink(basis_media_engine_t* e) {
     e->audio_sink.on_state = audio_sink_state;
     e->audio_sink.on_error = sink_error;               /* a failed audio leg is an engine error */
     e->audio_sink.on_end_of_stream = audio_sink_eos;
+    e->audio_sink.on_duration = sink_duration;         /* either leg may know the timeline */
+    e->audio_sink.take_seek = audio_sink_take_seek;    /* both legs reposition on a seek */
     e->audio_sink.is_running = sink_is_running;
 }
 
@@ -403,6 +452,8 @@ typedef struct {
     int cap, head, tail, count;   /* count/head/tail guarded by lock */
     int eof;                      /* producer done (reader hit EOF/error) */
     int closing;                  /* consumer done (tells the reader to stop) */
+    volatile int reseek_park;     /* consumer repositioning: reader must park */
+    volatile int reader_parked;   /* reader acknowledged the park */
     volatile int* running;        /* engine running flag, for prompt stop */
     basis_mutex_t lock;
 } byte_ring_t;
@@ -439,7 +490,7 @@ static void ring_write(byte_ring_t* r, const uint8_t* data, int n, volatile int*
         int closing = r->closing;
         mutex_unlock(&r->lock);
         if (off < n) {
-            if (!*running || closing) return;
+            if (!*running || closing || r->reseek_park) return; /* parked writes drop pre-seek bytes */
             sleep_ms(2);   /* full: wait for the demuxer to drain */
         }
     }
@@ -479,8 +530,23 @@ typedef struct {
 static void reader_body(reader_args_t* a) {
     uint8_t tmp[65536];
     while (*a->running && !a->ring->closing) {
+        if (a->ring->reseek_park) {
+            /* The demuxer is repositioning the source underneath us: acknowledge
+             * and idle until it finishes (http_reseek aborts a parked read, so a
+             * blocked net_read also lands here via n <= 0). */
+            a->ring->reader_parked = 1;
+            sleep_ms(2);
+            continue;
+        }
+        if (a->ring->eof) { sleep_ms(5); continue; } /* drained; stay alive for a reseek */
         int n = a->net_read(a->net_ctx, tmp, (int)sizeof(tmp));
-        if (n <= 0) break;   /* EOF or error */
+        if (n <= 0) {
+            if (a->ring->reseek_park) continue;  /* aborted for a reseek, not EOF */
+            mutex_lock(&a->ring->lock);
+            a->ring->eof = 1;
+            mutex_unlock(&a->ring->lock);
+            continue;
+        }
         ring_write(a->ring, tmp, n, a->running);
     }
     mutex_lock(&a->ring->lock);
@@ -494,15 +560,62 @@ static DWORD WINAPI reader_entry(LPVOID p) { reader_body((reader_args_t*)p); ret
 static void* reader_entry(void* p) { reader_body((reader_args_t*)p); return NULL; }
 #endif
 
+#if defined(_WIN32)
+/* Byte-source reseek for the HTTP VOD path (handed to the MP4 demuxer). Parks
+ * the read-ahead reader, swaps the response for a ranged one, flushes buffered
+ * bytes and the replayed sniff prefix, and resumes. Runs on the demux thread. */
+typedef struct {
+    void* http;
+    byte_ring_t* ring;      /* NULL when the demuxer reads the source directly */
+    prefix_src_t* ps;
+    volatile int* running;
+} http_seek_src_t;
+
+static int http_reseek(void* ctx, int64_t abs_offset) {
+    http_seek_src_t* s = (http_seek_src_t*)ctx;
+    if (s->ring) {
+        s->ring->reseek_park = 1;
+        basis_win_http_abort(s->http);   /* unblock a read the reader is parked in */
+        while (!s->ring->reader_parked && *s->running) sleep_ms(1);
+    } else {
+        basis_win_http_abort(s->http);   /* demux thread is the only reader */
+    }
+    int rc = basis_win_http_reseek(s->http, abs_offset);
+    s->ps->prefix_pos = s->ps->prefix_len;   /* sniffed offset-0 bytes must not replay */
+    if (s->ring) {
+        mutex_lock(&s->ring->lock);
+        s->ring->head = s->ring->tail = s->ring->count = 0;
+        s->ring->eof = (rc != 0);            /* failed reseek reads as end-of-stream */
+        mutex_unlock(&s->ring->lock);
+        s->ring->reader_parked = 0;
+        s->ring->reseek_park = 0;
+    }
+    return rc;
+}
+#endif
+
 /* HLS / LL-HLS: the URL is a playlist, not a continuous byte stream. The HLS
  * source fetches+parses the M3U8, stitches segments (and LL-HLS parts) into one
- * byte stream, and the existing TS/fMP4 demuxers consume it. Windows fetches via
- * WinHTTP; Android/Quest support is planned. */
+ * byte stream, and the existing TS/fMP4 demuxers consume it. Playlist and
+ * segment fetches ride the platform HTTP byte source: WinHTTP on Windows, the
+ * JNI HttpsURLConnection bridge on Android. */
+#if defined(__ANDROID__)
+/* Binds the provider's open(url) to basis_jni_https_open's (url, timeout).
+ * 60s read timeout: LL-HLS blocking playlist reloads hold the response open
+ * for up to a few target durations, well past a connect-scale timeout. */
+static void* hls_jni_https_open(const char* url) { return basis_jni_https_open(url, 60000); }
+#endif
 static void run_hls(demux_ctx_t* c) {
+#if defined(_WIN32) || defined(__ANDROID__)
 #if defined(_WIN32)
     basis_http_provider_t provider = {
         basis_win_http_open, basis_win_http_read, basis_win_http_close
     };
+#else
+    basis_http_provider_t provider = {
+        hls_jni_https_open, basis_jni_https_read, basis_jni_https_close
+    };
+#endif
     int is_fmp4 = 0;
     void* hls = basis_hls_open(c->url, &provider, c->sink->is_running, c->sink->user, &is_fmp4);
     if (!hls) {
@@ -514,39 +627,63 @@ static void run_hls(demux_ctx_t* c) {
      * has no endlist. A forced hint skips this. */
     if (c->e->paced_hint == 0 && basis_hls_is_vod(hls))
         c->e->paced = 1;
+    /* Report the timeline only when seeks will actually work (a non-zero
+     * duration is the managed layer's seekability signal): TS-segment VOD.
+     * fMP4 VOD plays fine but stays timeline-less for now. */
+    if (basis_hls_can_seek(hls)) {
+        long total_ms = basis_hls_duration_ms(hls);
+        if (total_ms > 0 && c->sink->on_duration)
+            c->sink->on_duration(c->sink->user, (int64_t)total_ms * 1000);
+    }
     /* HLS buffers segments and delivers faster than real time, so always pace delivery —
      * even for live (paced=0), which still presents at and converges to the live edge.
      * This replaces basis_hls.c's byte-rate token bucket (disabled there) with PTS-exact
      * AU pacing that tracks VBR and recovers from stalls. */
     c->e->pace_delivery = 1;
     c->sink->on_state(c->sink->user, BASIS_MEDIA_STATE_BUFFERING);
+    /* Seeks reposition inside the HLS source (segment granularity) via
+     * basis_media_seek_us -> basis_hls_seek_ms, so the demuxer gets no
+     * byte-level reseek here. */
+    mutex_lock(&c->e->lock);
+    c->e->active_hls = hls;
+    mutex_unlock(&c->e->lock);
     if (is_fmp4)
-        basis_mp4_run(c->sink, basis_hls_read, hls);
+        basis_mp4_run(c->sink, basis_hls_read, hls, NULL, NULL);
     else
         basis_ts_run(c->sink, basis_hls_read, hls);
+    mutex_lock(&c->e->lock);
+    c->e->active_hls = NULL;
+    mutex_unlock(&c->e->lock);
     basis_hls_close(hls);
 #else
-    c->sink->on_error(c->sink->user, "HLS playback currently requires the Windows backend.");
+    c->sink->on_error(c->sink->user, "HLS playback requires the Windows or Android backend.");
 #endif
 }
 
 static void run_http_like(demux_ctx_t* c) {
+    /* HLS playlists are not a single continuous stream — hand off to the HLS
+     * source before the OS-extractor attempt (which can't stitch segments) and
+     * the plain TS/fMP4 byte-source path. (.m3u8 may carry a query.) */
+    if (strstr(c->parts->path, ".m3u8")) {
+        run_hls(c);
+        return;
+    }
+
     /* Android: the OS extractor can demux the URL itself (TLS included). Primary
      * leg only — an audio-only leg must feed the shared decoder's audio path, not
-     * hand a whole muxed file to the OS extractor. */
-    if (c->allow_os_demux && basis_decoder_try_open_url(c->e->decoder, c->url)) {
+     * hand a whole muxed file to the OS extractor. m2ts is also kept away from
+     * it: that container exists here to carry HDMV LPCM (stream_type 0x80),
+     * which the extractor doesn't surface — it would play the video with the
+     * audio silently missing, where the portable TS demuxer + LPCM bypass play
+     * both. */
+    int os_demux = c->allow_os_demux &&
+                   !ends_with_ci(c->parts->path, ".m2ts") && !ends_with_ci(c->parts->path, ".mts");
+    if (os_demux && basis_decoder_try_open_url(c->e->decoder, c->url)) {
         c->sink->on_state(c->sink->user, BASIS_MEDIA_STATE_BUFFERING);
         while (c->e->running) sleep_ms(20);
         return;
     }
 
-    /* HLS playlists are not a single continuous stream — hand off to the HLS
-     * source before the plain TS/fMP4 byte-source path. (.m3u8 may carry a query.) */
-    if (strstr(c->parts->path, ".m3u8")) {
-        run_hls(c);
-        return;
-    }
-
     void* src = NULL;
     basis_read_fn rd = NULL;
 
@@ -633,8 +770,20 @@ static void run_http_like(demux_ctx_t* c) {
         else { ring_free(&ring); use_readahead = 0; }
     }
 
+    /* A seekable VOD body gets a reseek hook so the MP4 demuxer can honour
+     * absolute seeks with a ranged refetch; everything else demuxes as before. */
+    basis_reseek_fn reseek = NULL;
+    void* reseek_ctx = NULL;
+#if defined(_WIN32)
+    http_seek_src_t seek_src = { src, use_readahead ? &ring : NULL, &ps, &c->e->running };
+    if (c->e->paced && basis_win_http_can_reseek(src)) {
+        reseek = http_reseek;
+        reseek_ctx = &seek_src;
+    }
+#endif
+
     if (is_mp4)
-        basis_mp4_run(c->sink, demux_read, demux_ctx);
+        basis_mp4_run(c->sink, demux_read, demux_ctx, reseek, reseek_ctx);
     else
         basis_ts_run(c->sink, demux_read, demux_ctx); /* default to MPEG-TS */
 
@@ -998,6 +1147,29 @@ BASIS_API int64_t BASIS_CALL basis_media_get_position_us(basis_media_engine_t* e
     return basis_decoder_get_position_us(e->decoder);
 }
 
+BASIS_API int64_t BASIS_CALL basis_media_get_duration_us(basis_media_engine_t* e) {
+    return e ? e->duration_us : 0; /* 0 = unknown / live */
+}
+
+BASIS_API int BASIS_CALL basis_media_seek_us(basis_media_engine_t* e, int64_t target_us) {
+    if (!e || target_us < 0) return -1;
+    int64_t dur = e->duration_us;
+    if (dur <= 0) return -1;                 /* no seekable timeline (live / unindexed) */
+    if (target_us > dur) target_us = dur;
+    mutex_lock(&e->lock);
+    e->seek_target_us = target_us;
+    e->seek_seq++;
+    void* hls = e->active_hls;
+    int rc = hls ? basis_hls_request_seek(hls, target_us / 1000) : 0;
+    /* HLS repositions inside the segment source — the TS demuxer never sees a
+     * take_seek, so re-anchor pacing here. A stray pre-flush sample can win the
+     * re-anchor, but it costs one more re-anchor when the flushed data lands,
+     * not a stall. */
+    if (hls && rc == 0) e->pace_started = 0;
+    mutex_unlock(&e->lock);
+    return rc;
+}
+
 BASIS_API int BASIS_CALL basis_media_poll_caption(basis_media_engine_t* e, char* buf, int buf_size,
                                                   int64_t* out_start_us, int64_t* out_end_us) {
     if (!e || !buf || buf_size <= 0) return -1;
diff --git a/Basis/Packages/com.basis.mediaplayer/Native~/basis_media_internal.h b/Basis/Packages/com.basis.mediaplayer/Native~/basis_media_internal.h
index 1ed9d62ff..133255309 100644
--- a/Basis/Packages/com.basis.mediaplayer/Native~/basis_media_internal.h
+++ b/Basis/Packages/com.basis.mediaplayer/Native~/basis_media_internal.h
@@ -47,10 +47,13 @@ typedef struct basis_media_sink {
                             const uint8_t* extradata, int extradata_len,
                             int width, int height);
 
-    /* One coded video access unit in Annex B form (start-code separated NALUs),
-     * with presentation timestamp in microseconds. key != 0 marks an IDR/keyframe. */
+    /* One coded video access unit in Annex B form (start-code separated NALUs).
+     * pts_us is the presentation timestamp; dts_us the decode timestamp, used
+     * for delivery pacing (composition offsets can put pts_us further ahead
+     * than the pacing lead — a demuxer without decode timestamps passes
+     * pts_us for both). key != 0 marks an IDR/keyframe. */
     void (*on_video_au)(void* user, const uint8_t* annexb, int len,
-                        int64_t pts_us, int key);
+                        int64_t pts_us, int64_t dts_us, int key);
 
     /* Called once when the audio codec/config is first known. For AAC, `asc` is
      * the AudioSpecificConfig (2+ bytes) when available. */
@@ -67,6 +70,17 @@ typedef struct basis_media_sink {
     void (*on_error)(void* user, const char* message);
     void (*on_end_of_stream)(void* user);
 
+    /* Total media duration once the container/playlist reveals one (VOD).
+     * Live sources never call it. May be NULL (standalone harnesses); may fire
+     * again on a reconnect re-parsing the same index. */
+    void (*on_duration)(void* user, int64_t duration_us);
+
+    /* Absolute-seek handshake for on-demand sources. A demuxer that can seek
+     * polls it between samples: returns 1 and writes the target when a request
+     * is pending, 0 otherwise. Each sink hands out a request once. May be NULL
+     * (standalone harnesses, sources that never seek). */
+    int (*take_seek)(void* user, int64_t* out_target_us);
+
     /* Demuxers poll this in their read loops; return 0 to unwind and exit. */
     int (*is_running)(void* user);
 } basis_media_sink_t;
@@ -75,6 +89,12 @@ typedef struct basis_media_sink {
  * (MPEG-TS / fMP4 over TCP or HTTP). Returns bytes read, 0 on EOF, <0 on error. */
 typedef int (*basis_read_fn)(void* ctx, uint8_t* buf, int len);
 
+/* Repositions a byte source to an absolute offset (a ranged HTTP refetch).
+ * Returns 0 on success — subsequent reads deliver from `abs_offset`. Called by
+ * a demuxer between its own reads, on its own thread; sources that can't
+ * reposition simply aren't given one (demuxers receive NULL). */
+typedef int (*basis_reseek_fn)(void* ctx, int64_t abs_offset);
+
 /* ---- Platform decode/present backend (windows/ + android/) --------------- */
 
 typedef struct basis_decoder basis_decoder_t;
diff --git a/Basis/Packages/com.basis.mediaplayer/Native~/basis_media_native.h b/Basis/Packages/com.basis.mediaplayer/Native~/basis_media_native.h
index cd39f8320..375cfd94a 100644
--- a/Basis/Packages/com.basis.mediaplayer/Native~/basis_media_native.h
+++ b/Basis/Packages/com.basis.mediaplayer/Native~/basis_media_native.h
@@ -121,6 +121,21 @@ BASIS_API int BASIS_CALL basis_media_get_frame_origin(basis_media_engine_t* engi
  * microseconds from stream start. -1 if unknown. */
 BASIS_API int64_t BASIS_CALL basis_media_get_position_us(basis_media_engine_t* engine);
 
+/* Total media duration in microseconds for on-demand sources whose container or
+ * playlist reveals one (progressive MP4 sample tables, HLS VOD segment totals).
+ * 0 while unknown and for live sources — a non-zero value is also the signal
+ * that the source has a seekable timeline. May become available only after the
+ * container index has been parsed, so poll rather than reading once at open. */
+BASIS_API int64_t BASIS_CALL basis_media_get_duration_us(basis_media_engine_t* engine);
+
+/* Requests an absolute seek to target_us on a source with a seekable timeline
+ * (basis_media_get_duration_us > 0; targets past the end clamp to it). Seeking
+ * is asynchronous: the demuxer repositions at the next sample boundary and
+ * playback resumes from the preceding keyframe, so the landing position is at
+ * or shortly before the target — observe basis_media_get_position_us. Returns
+ * 0 when the request was accepted, -1 when the source cannot seek. */
+BASIS_API int BASIS_CALL basis_media_seek_us(basis_media_engine_t* engine, int64_t target_us);
+
 /* Copies the in-band caption cue (CEA-608 CC1) active at the current presentation
  * position into buf (UTF-8, NUL-terminated). Returns bytes written (0 = no active
  * cue), or -1 on bad args. out_start_us/out_end_us receive the active cue's time
diff --git a/Basis/Packages/com.basis.mediaplayer/Native~/protocol/basis_bitstream.c b/Basis/Packages/com.basis.mediaplayer/Native~/protocol/basis_bitstream.c
index ba239fd2d..fa8f26bf5 100644
--- a/Basis/Packages/com.basis.mediaplayer/Native~/protocol/basis_bitstream.c
+++ b/Basis/Packages/com.basis.mediaplayer/Native~/protocol/basis_bitstream.c
@@ -94,6 +94,12 @@ int basis_avcc_to_annexb(const uint8_t* in, int in_len, int nls, uint8_t* out, i
     return op;
 }
 
+int basis_avcc_annexb_cap(int in_len, int nal_length_size) {
+    int nls = (nal_length_size >= 1 && nal_length_size <= 4) ? nal_length_size : 4;
+    if (in_len < 0) in_len = 0;
+    return in_len + (4 - nls) * (in_len / (nls + 1)) + 64;
+}
+
 /* avcC: [0]=1 [1]=profile [2]=compat [3]=level [4]=0xFC|lengthSizeMinus1
  *       [5]=0xE0|numSPS, then SPS (u16 len + data)..., numPPS, PPS... */
 static int avcc_to_annexb(const uint8_t* cfg, int cfg_len, uint8_t* out, int out_cap,
diff --git a/Basis/Packages/com.basis.mediaplayer/Native~/protocol/basis_bitstream.h b/Basis/Packages/com.basis.mediaplayer/Native~/protocol/basis_bitstream.h
index e2a333516..42b3c01ed 100644
--- a/Basis/Packages/com.basis.mediaplayer/Native~/protocol/basis_bitstream.h
+++ b/Basis/Packages/com.basis.mediaplayer/Native~/protocol/basis_bitstream.h
@@ -11,8 +11,8 @@ extern "C" {
 /* ---- Annex B (start-code) NAL iteration --------------------------------- */
 
 /* Finds the next NAL unit (between 00 00 01 / 00 00 00 01 start codes) at or
- * after `from`. On success sets *nal_off/*nal_len (payload excluding the start
- * code) and returns the index just past this NAL; returns -1 when none remain. */
+ * after `from`. On success sets *nal_off / *nal_len (payload excluding the
+ * start code) and returns the index just past this NAL; -1 when none remain. */
 int basis_annexb_next(const uint8_t* data, int size, int from, int* nal_off, int* nal_len);
 
 /* H.264 NAL type = byte & 0x1F ; H.265 NAL type = (byte >> 1) & 0x3F */
@@ -31,6 +31,12 @@ int basis_h265_is_keyframe(const uint8_t* annexb, int len);
 int basis_avcc_to_annexb(const uint8_t* in, int in_len, int nal_length_size,
                          uint8_t* out, int out_cap);
 
+/* Worst-case output size for basis_avcc_to_annexb: each NAL's length prefix
+ * (nal_length_size bytes) becomes a 4-byte start code, and a NAL occupies at
+ * least nal_length_size + 1 input bytes, which bounds the per-NAL growth.
+ * Includes a small constant of extra headroom. */
+int basis_avcc_annexb_cap(int in_len, int nal_length_size);
+
 /* Builds an Annex B extradata blob from an avcC/hvcC config record (as carried
  * in MP4 stsd or FLV AVCDecoderConfigurationRecord). Writes the contained
  * SPS/PPS (and VPS for HEVC) as start-code-prefixed NALUs. Returns bytes written
diff --git a/Basis/Packages/com.basis.mediaplayer/Native~/protocol/basis_hls.c b/Basis/Packages/com.basis.mediaplayer/Native~/protocol/basis_hls.c
index d10c760ac..2a2909e2f 100644
--- a/Basis/Packages/com.basis.mediaplayer/Native~/protocol/basis_hls.c
+++ b/Basis/Packages/com.basis.mediaplayer/Native~/protocol/basis_hls.c
@@ -93,6 +93,15 @@ typedef struct basis_hls {
     long part_target_ms;
     long target_duration_ms;
     int  endlist_seen;
+    long total_ms;               /* VOD: summed EXTINF durations (0 when live/unknown) */
+
+    /* VOD seek index: every full segment in playlist order, retained at open so
+     * a seek can rebuild the fetch queue from any point. TS segments only. */
+    char (*vod_uri)[HLS_MAX_URI];
+    long* vod_dur_ms;
+    int   vod_count;
+    volatile int  seek_pending;  /* producer repositions at its next iteration */
+    volatile long seek_target_ms;
 
     int  map_served;             /* fMP4: init segment already streamed once */
     char map_uri[HLS_MAX_URI];
@@ -506,6 +515,29 @@ static void ring_write(basis_hls_t* h, const uint8_t* data, int n) {
 static void hls_producer(basis_hls_t* h) {
     uint8_t tmp[16384];
     while (hls_should_run(h)) {
+        if (h->seek_pending) {
+            /* Reposition: drop the current segment, rebuild the queue from the
+             * segment containing the target, flush buffered bytes. The consumer
+             * may hold a partial TS packet from before the jump — the TS
+             * demuxer resynchronises on the 0x47 sync byte. */
+            h->seek_pending = 0;
+            if (h->vod_count > 0) {
+                if (h->seg_ctx) { h->http.close(h->seg_ctx); h->seg_ctx = NULL; }
+                long acc = 0;
+                int idx = 0;
+                for (; idx < h->vod_count - 1; ++idx) {
+                    if (acc + h->vod_dur_ms[idx] > h->seek_target_ms) break;
+                    acc += h->vod_dur_ms[idx];
+                }
+                h->pending_head = 0;
+                h->pending_count = 0;
+                for (int i = idx; i < h->vod_count; ++i)
+                    queue_push(h, h->vod_uri[i], h->vod_dur_ms[i]);
+                hls_mutex_lock(&h->lock);
+                h->ring_head = h->ring_tail = h->ring_count = 0;
+                hls_mutex_unlock(&h->lock);
+            }
+        }
         if (!h->seg_ctx) {
             if (h->is_fmp4 && !h->map_served && h->map_uri[0]) {
                 h->seg_ctx = h->http.open(h->map_uri); /* fMP4 init segment first */
@@ -614,6 +646,31 @@ void* basis_hls_open(const char* url, const basis_http_provider_t* http,
     h->part_target_ms = pl.part_target_ms;
     h->target_duration_ms = pl.target_duration_ms ? pl.target_duration_ms : 6000;
     h->endlist_seen = pl.has_endlist;
+    if (pl.has_endlist) {
+        /* Sum whole segments only — parts subdivide the same media time. A VOD
+         * beyond HLS_MAX_ITEMS is truncated at parse, so this under-reports in
+         * lockstep with what actually plays. */
+        for (int i = 0; i < pl.item_count; ++i)
+            if (pl.items[i].part < 0) h->total_ms += pl.items[i].dur_ms;
+        /* Retain the segment list so a seek can rebuild the queue from any
+         * index. fMP4 VOD is excluded: a mid-stream ring flush would land the
+         * demuxer inside a box, and it can't resynchronise the way TS does. */
+        if (!pl.is_fmp4) {
+            h->vod_uri = (char (*)[HLS_MAX_URI])malloc((size_t)pl.item_count * HLS_MAX_URI);
+            h->vod_dur_ms = (long*)malloc((size_t)pl.item_count * sizeof(long));
+            if (h->vod_uri && h->vod_dur_ms) {
+                for (int i = 0; i < pl.item_count; ++i) {
+                    if (pl.items[i].part >= 0) continue;
+                    memcpy(h->vod_uri[h->vod_count], pl.items[i].uri, HLS_MAX_URI);
+                    h->vod_dur_ms[h->vod_count] = pl.items[i].dur_ms;
+                    h->vod_count++;
+                }
+            } else {
+                free(h->vod_uri); h->vod_uri = NULL;
+                free(h->vod_dur_ms); h->vod_dur_ms = NULL;
+            }
+        }
+    }
     if (pl.map_uri[0]) snprintf(h->map_uri, sizeof(h->map_uri), "%s", pl.map_uri);
 
     /* VOD (EXT-X-ENDLIST): start at the first segment so the whole recording
@@ -692,6 +749,24 @@ int basis_hls_is_vod(void* ctx) {
     return h ? h->endlist_seen : 0;
 }
 
+long basis_hls_duration_ms(void* ctx) {
+    basis_hls_t* h = (basis_hls_t*)ctx;
+    return h ? h->total_ms : 0;
+}
+
+int basis_hls_can_seek(void* ctx) {
+    basis_hls_t* h = (basis_hls_t*)ctx;
+    return h && h->vod_count > 0 && !h->producer_done;
+}
+
+int basis_hls_request_seek(void* ctx, long long target_ms) {
+    basis_hls_t* h = (basis_hls_t*)ctx;
+    if (!basis_hls_can_seek(ctx) || target_ms < 0) return -1;
+    h->seek_target_ms = (long)target_ms;
+    h->seek_pending = 1;
+    return 0;
+}
+
 void basis_hls_close(void* ctx) {
     basis_hls_t* h = (basis_hls_t*)ctx;
     if (!h) return;
@@ -699,6 +774,8 @@ void basis_hls_close(void* ctx) {
     hls_thread_join(h);
     if (h->seg_ctx) { h->http.close(h->seg_ctx); h->seg_ctx = NULL; }
     hls_mutex_destroy(&h->lock);
+    free(h->vod_uri);
+    free(h->vod_dur_ms);
     free(h->ring);
     free(h);
 }
diff --git a/Basis/Packages/com.basis.mediaplayer/Native~/protocol/basis_hls.h b/Basis/Packages/com.basis.mediaplayer/Native~/protocol/basis_hls.h
index f556d32ec..b53c0e10b 100644
--- a/Basis/Packages/com.basis.mediaplayer/Native~/protocol/basis_hls.h
+++ b/Basis/Packages/com.basis.mediaplayer/Native~/protocol/basis_hls.h
@@ -7,8 +7,9 @@
  * (basis_mp4_run) demuxers then consume it unchanged.
  *
  * Transport is injected as a basis_http_provider so the protocol code stays
- * portable: on Windows the engine passes the basis_win_http_* trio (TLS, redirects
- * and chunked handled there). Playlists and segments are fetched through it.
+ * portable: on Windows the engine passes the basis_win_http_* trio, on Android
+ * the basis_jni_https_* trio (TLS, redirects and chunked handled by each).
+ * Playlists and segments are fetched through it.
  *
  * Low latency: when the origin advertises EXT-X-SERVER-CONTROL:CAN-BLOCK-RELOAD
  * with EXT-X-PART parts, the client starts near the live edge, reloads the media
@@ -16,7 +17,7 @@
  * produced — targeting ~PART-HOLD-BACK latency. Against a plain (non-LL) origin it
  * falls back to live-edge, segment-by-segment playback (segment-bound latency).
  *
- * Scope: clear streams, single rendition, Windows fetch. Android/Quest planned.
+ * Scope: clear streams, single rendition, Windows and Android fetch.
  */
 #ifndef BASIS_HLS_H
 #define BASIS_HLS_H
@@ -54,6 +55,22 @@ int basis_hls_read(void* ctx, uint8_t* buf, int len);
  * playlist parsed at open, so the caller can pick live-vs-on-demand pacing. */
 int basis_hls_is_vod(void* ctx);
 
+/* Total VOD duration in milliseconds (summed segment EXTINF values), 0 for live
+ * or unknown. Playlists beyond the internal segment cap report the truncated
+ * total, matching what actually plays. */
+long basis_hls_duration_ms(void* ctx);
+
+/* 1 when the source can honour a seek: a TS-segment VOD playlist whose segment
+ * producer is still alive. fMP4 VOD reports 0 — repositioning the stitched
+ * byte stream mid-box can't be resynchronised the way TS can. */
+int basis_hls_can_seek(void* ctx);
+
+/* Requests a reposition to target_ms. Asynchronous: the segment producer
+ * rebuilds its fetch queue from the segment containing the target and flushes
+ * buffered bytes; playback resumes from that segment boundary. Returns 0 when
+ * accepted, -1 when the source can't seek. */
+int basis_hls_request_seek(void* ctx, long long target_ms);
+
 void basis_hls_close(void* ctx);
 
 #ifdef __cplusplus
diff --git a/Basis/Packages/com.basis.mediaplayer/Native~/protocol/basis_mp4.c b/Basis/Packages/com.basis.mediaplayer/Native~/protocol/basis_mp4.c
index e21f5a4a9..23947d767 100644
--- a/Basis/Packages/com.basis.mediaplayer/Native~/protocol/basis_mp4.c
+++ b/Basis/Packages/com.basis.mediaplayer/Native~/protocol/basis_mp4.c
@@ -19,7 +19,7 @@
  * progressive files, flagged for iteration):
  *   - one video track + one audio track
  *   - one trun per traf, mdat samples contiguous in trun order
- *   - 4-byte NAL length (from avcC); version 0/1 boxes; stsz (not stz2)
+ *   - version 0/1 boxes; stsz sample sizes (stz2 raises a clear error)
  */
 
 #include "basis_mp4.h"
@@ -31,6 +31,7 @@
 #define MP4_MAX_FRAGS 4   /* per-moof trun runs (audio + video, with headroom) */
 #define MP4_MAX_BOX   (256LL * 1024 * 1024)  /* cap for boxes buffered whole (moov/moof/fragment mdat) */
 #define MP4_MAX_TABLE (16u * 1024 * 1024)    /* per-table entry cap (~hours of samples) */
+#define MP4_MAX_FRAG_SAMPLES (1u << 20)      /* per-trun sample cap (a fragment is seconds of media) */
 
 /* Classic (progressive) sample tables + walk cursor. Valid when sample_count
  * and chunk_count are non-zero; fMP4 init segments carry these boxes with zero
@@ -41,8 +42,10 @@ typedef struct {
     uint32_t* sizes;          /* per-sample sizes when const_size == 0 */
     uint32_t  stts_count;     /* {sample_count, delta} run pairs */
     uint32_t* stts;
-    uint32_t  ctts_count;     /* {sample_count, offset} run pairs; offset read signed */
+    uint32_t  ctts_count;     /* {sample_count, offset} run pairs; sign depends on ctts_version */
     uint32_t* ctts;
+    int       ctts_version;   /* FullBox version: 0 = unsigned offsets, 1 = signed */
+    int       has_stz2;       /* compact sample sizes present (unsupported) */
     uint32_t  stsc_count;     /* {first_chunk, samples_per_chunk} pairs */
     uint32_t* stsc;
     uint32_t  chunk_count;
@@ -50,6 +53,12 @@ typedef struct {
     uint32_t  stss_count;     /* sync-sample numbers, 1-based; NULL => all sync */
     uint32_t* stss;
 
+    /* edit-list mapping onto the movie timeline (from elst, resolved once the
+     * movie timescale is known): presentation = media time - media_start,
+     * shifted late by pts_delay_us of initial empty edits. */
+    int64_t   media_start;    /* media-timescale ticks */
+    int64_t   pts_delay_us;
+
     /* cursor: the next sample to emit */
     uint32_t next;            /* global sample index, 0-based */
     uint32_t chunk;           /* current chunk, 0-based */
@@ -73,8 +82,10 @@ typedef struct {
     uint8_t asc[16];
     int asc_len;
     int sr, ch, obj;
-    int64_t next_dts; /* running, in track timescale */
     int announced;
+    /* raw elst entries; durations are movie-timescale, media times media-timescale */
+    uint32_t elst_count;
+    struct { uint64_t duration; int64_t media_time; } elst[8];
     mp4_ctab_t ctab;
 } mp4_track_t;
 
@@ -85,7 +96,7 @@ typedef struct {
     int       track_id;
     int       data_offset;
     int64_t   base_dts;
-    int       default_dur;
+    uint32_t  default_dur;
     uint32_t* sizes;
     uint32_t* durs;
     int32_t*  ctos;
@@ -97,8 +108,12 @@ typedef struct {
     basis_media_sink_t* sink;
     basis_read_fn read;
     void* ctx;
+    basis_reseek_fn reseek; /* NULL: the byte source can't reposition */
+    void* reseek_ctx;
     mp4_track_t tracks[2];
     int ntracks;
+    int movie_timescale;    /* from mvhd; units of elst segment durations */
+    int64_t movie_duration; /* from mvhd, movie-timescale ticks; 0 when absent */
 
     int64_t pos;          /* absolute stream offset consumed so far */
     int     mdat_skipped; /* media data streamed past before any index arrived */
@@ -111,6 +126,15 @@ typedef struct {
 static uint32_t rd32(const uint8_t* p) { return ((uint32_t)p[0]<<24)|((uint32_t)p[1]<<16)|((uint32_t)p[2]<<8)|p[3]; }
 static uint64_t rd64(const uint8_t* p) { return ((uint64_t)rd32(p)<<32)|rd32(p+4); }
 
+/* Timescale ticks -> microseconds. Splitting into whole seconds + remainder
+ * keeps the intermediate multiply in range for any stream-supplied timescale
+ * (v * 1000000 directly overflows past ~2.5 hours at a crafted ~1 GHz scale). */
+static int64_t ticks_to_us(int64_t v, int timescale) {
+    int64_t ts = timescale > 0 ? timescale : 90000;
+    int64_t s = v / ts, r = v % ts;
+    return s * 1000000 + r * 1000000 / ts;
+}
+
 static int read_exact(mp4_t* m, uint8_t* buf, int n) {
     int got = 0;
     while (got < n) {
@@ -173,7 +197,7 @@ static void parse_stsd(mp4_track_t* t, const uint8_t* p, int len) {
         int esize = (int)rd32(p + off);
         uint32_t etype = rd32(p + off + 4);
         const uint8_t* ent = p + off;
-        if (esize < 8 || off + esize > len) break;
+        if (esize < 8 || esize > len - off) break;
 
         if (etype == 0x61766331 /*avc1*/ || etype == 0x68766331 /*hvc1*/ || etype == 0x68657631 /*hev1*/) {
             t->is_video = 1;
@@ -183,7 +207,7 @@ static void parse_stsd(mp4_track_t* t, const uint8_t* p, int len) {
             while (co + 8 <= esize) {
                 int csz = (int)rd32(ent + co);
                 uint32_t ct = rd32(ent + co + 4);
-                if (csz < 8 || co + csz > esize) break;
+                if (csz < 8 || csz > esize - co) break;
                 if (ct == 0x61766343 /*avcC*/ || ct == 0x68766343 /*hvcC*/) {
                     int nls = 4;
                     int got = basis_avcc_extradata_to_annexb(ent + co + 8, csz - 8,
@@ -192,7 +216,7 @@ static void parse_stsd(mp4_track_t* t, const uint8_t* p, int len) {
                 }
                 co += csz;
             }
-        } else if (etype == 0x6d703461 /*mp4a*/) {
+        } else if (etype == 0x6d703461 /*mp4a*/ && esize >= 8 + 28) {
             t->is_video = 0;
             t->codec = BASIS_CODEC_AAC;
             /* audio sample entry header 28 bytes, then esds */
@@ -202,7 +226,7 @@ static void parse_stsd(mp4_track_t* t, const uint8_t* p, int len) {
             while (co + 8 <= esize) {
                 int csz = (int)rd32(ent + co);
                 uint32_t ct = rd32(ent + co + 4);
-                if (csz < 8 || co + csz > esize) break;
+                if (csz < 8 || csz > esize - co) break;
                 if (ct == 0x65736473 /*esds*/) {
                     /* find DecoderSpecificInfo (tag 0x05) inside esds */
                     const uint8_t* ep = ent + co + 12; int el = csz - 12;
@@ -261,6 +285,21 @@ static void parse_stsz(mp4_ctab_t* c, const uint8_t* p, int len) {
     c->sample_count = n;
 }
 
+static void parse_elst(mp4_track_t* t, const uint8_t* p, int len) {
+    if (t->elst_count || len < 8) return;
+    int ver = p[0];
+    uint32_t n = rd32(p + 4);
+    int stride = ver == 1 ? 20 : 12;
+    if (!n || (int64_t)8 + (int64_t)n * stride > len) return;
+    uint32_t keep = n < 8 ? n : 8;  /* only the leading edits shape the walk */
+    for (uint32_t i = 0; i < keep; ++i) {
+        const uint8_t* e = p + 8 + (size_t)i * stride;
+        if (ver == 1) { t->elst[i].duration = rd64(e); t->elst[i].media_time = (int64_t)rd64(e + 8); }
+        else          { t->elst[i].duration = rd32(e); t->elst[i].media_time = (int32_t)rd32(e + 4); }
+    }
+    t->elst_count = keep;
+}
+
 static void parse_chunk_offsets(mp4_ctab_t* c, const uint8_t* p, int len, int is64) {
     if (len < 8) return;
     uint32_t n = rd32(p + 4);
@@ -296,19 +335,31 @@ static void parse_box_tree(mp4_t* m, mp4_track_t* t, const uint8_t* p, int len)
     while (off + 8 <= len) {
         int sz = (int)rd32(p + off);
         uint32_t ty = rd32(p + off + 4);
-        if (sz < 8 || off + sz > len) break;
+        if (sz < 8 || sz > len - off) break;
         const uint8_t* body = p + off + 8;
         int blen = sz - 8;
         switch (ty) {
             case 0x7472616b: parse_trak(m, body, blen); break;          /* trak */
             case 0x6d646961: /* mdia */
             case 0x6d696e66: /* minf */
+            case 0x65647473: /* edts */
             case 0x7374626c: parse_box_tree(m, t, body, blen); break;    /* stbl */
+            case 0x6d766864: /* mvhd: movie timescale (elst duration units) + duration */
+                if (blen >= 4) {
+                    int ver = body[0];
+                    int tsoff = ver == 1 ? 4 + 8 + 8 : 4 + 4 + 4;
+                    if (tsoff + 4 <= blen) m->movie_timescale = (int)rd32(body + tsoff);
+                    if (ver == 1) { if (tsoff + 4 + 8 <= blen) m->movie_duration = (int64_t)rd64(body + tsoff + 4); }
+                    else          { uint32_t d = tsoff + 4 + 4 <= blen ? rd32(body + tsoff + 4) : 0;
+                                    if (d != 0xFFFFFFFFu) m->movie_duration = d; } /* all-ones = unknown */
+                }
+                break;
+            case 0x656c7374: if (t) parse_elst(t, body, blen); break;    /* elst */
             case 0x6d646864: /* mdhd: version(1) flags(3) ... timescale */
-                if (t) { int ver = body[0]; t->track_id = t->track_id; int tsoff = ver == 1 ? 4 + 8 + 8 : 4 + 4 + 4; if (tsoff + 4 <= blen) t->timescale = (int)rd32(body + tsoff); }
+                if (t && blen >= 4) { int ver = body[0]; int tsoff = ver == 1 ? 4 + 8 + 8 : 4 + 4 + 4; if (tsoff + 4 <= blen) t->timescale = (int)rd32(body + tsoff); }
                 break;
             case 0x746b6864: /* tkhd: track id */
-                if (t) { int ver = body[0]; int idoff = ver == 1 ? 4 + 8 + 8 : 4 + 4 + 4; if (idoff + 4 <= blen) t->track_id = (int)rd32(body + idoff); }
+                if (t && blen >= 4) { int ver = body[0]; int idoff = ver == 1 ? 4 + 8 + 8 : 4 + 4 + 4; if (idoff + 4 <= blen) t->track_id = (int)rd32(body + idoff); }
                 break;
             case 0x73747364: if (t) parse_stsd(t, body, blen); break;    /* stsd */
             /* classic sample tables (progressive MP4); zero-entry versions in
@@ -316,10 +367,16 @@ static void parse_box_tree(mp4_t* m, mp4_track_t* t, const uint8_t* p, int len)
              * each kind wins — a duplicate in a malformed stbl would otherwise
              * overwrite (and leak) the earlier allocation. */
             case 0x73747473: if (t && !t->ctab.stts) t->ctab.stts = parse_table(body, blen, 2, 2, &t->ctab.stts_count); break;  /* stts */
-            case 0x63747473: if (t && !t->ctab.ctts) t->ctab.ctts = parse_table(body, blen, 2, 2, &t->ctab.ctts_count); break;  /* ctts */
+            case 0x63747473: /* ctts: version 0 offsets are unsigned, version 1 signed */
+                if (t && !t->ctab.ctts) {
+                    t->ctab.ctts = parse_table(body, blen, 2, 2, &t->ctab.ctts_count);
+                    t->ctab.ctts_version = blen >= 1 ? body[0] : 0;
+                }
+                break;
             case 0x73747363: if (t && !t->ctab.stsc) t->ctab.stsc = parse_table(body, blen, 3, 2, &t->ctab.stsc_count); break;  /* stsc */
             case 0x73747373: if (t && !t->ctab.stss) t->ctab.stss = parse_table(body, blen, 1, 1, &t->ctab.stss_count); break;  /* stss */
             case 0x7374737a: if (t && !t->ctab.sample_count) parse_stsz(&t->ctab, body, blen); break;                           /* stsz */
+            case 0x73747a32: if (t) t->ctab.has_stz2 = 1; break;         /* stz2: compact sizes, unsupported */
             case 0x7374636f: if (t && !t->ctab.chunk_offsets) parse_chunk_offsets(&t->ctab, body, blen, 0); break;              /* stco */
             case 0x636f3634: if (t && !t->ctab.chunk_offsets) parse_chunk_offsets(&t->ctab, body, blen, 1); break;              /* co64 */
             default: break;
@@ -363,6 +420,39 @@ static int classic_ready(mp4_t* m) {
     return 0;
 }
 
+/* Longest track's stts total — the fallback when mvhd carries no duration. */
+static int64_t classic_total_duration_us(mp4_t* m) {
+    int64_t best = 0;
+    for (int i = 0; i < m->ntracks; ++i) {
+        const mp4_ctab_t* c = &m->tracks[i].ctab;
+        if (!classic_track_ready(c)) continue;
+        int64_t ticks = 0;
+        for (uint32_t k = 0; k < c->stts_count; ++k)
+            ticks += (int64_t)c->stts[k * 2] * c->stts[k * 2 + 1];
+        int64_t us = ticks_to_us(ticks, m->tracks[i].timescale);
+        if (us > best) best = us;
+    }
+    return best;
+}
+
+/* Resolve a track's edit list against the movie timescale: initial empty edits
+ * (media_time -1) delay the whole track; the first normal edit's media_time is
+ * the media-time origin (encoder priming / initial trim). Later edit segments
+ * would need a segment-aware walk and are ignored. Samples ahead of the origin
+ * keep their (negative) presentation time rather than being dropped — video
+ * there can still be reference data the decoder needs. */
+static void classic_apply_elst(mp4_t* m, mp4_track_t* t) {
+    mp4_ctab_t* c = &t->ctab;
+    for (uint32_t i = 0; i < t->elst_count; ++i) {
+        if (t->elst[i].media_time < 0) {
+            c->pts_delay_us += ticks_to_us((int64_t)t->elst[i].duration, m->movie_timescale > 0 ? m->movie_timescale : 1000);
+            continue;
+        }
+        c->media_start = t->elst[i].media_time;
+        break;
+    }
+}
+
 static void classic_init_cursor(mp4_ctab_t* c) {
     if (!classic_track_ready(c)) { c->sample_count = 0; return; }
     c->next = 0;
@@ -402,31 +492,153 @@ static void classic_advance(mp4_ctab_t* c) {
     }
 }
 
-/* Walks the classic tables against one mdat, merging tracks in file-offset
- * order — the muxer's chunk interleave — since the byte source only moves
- * forward. Samples whose offsets lie beyond this mdat wait for a later one.
- * mdat_end is the absolute end of the payload, or INT64_MAX for a size-0 box. */
+/* A sample read from the file but not yet handed to the sink: file order can
+ * run ahead of delivery order when the muxer interleaves chunks coarsely.
+ * Video is stored already converted to Annex B with its keyframe verdict. */
+typedef struct mp4_pend {
+    struct mp4_pend* next;
+    int64_t pts_us;
+    int64_t dts_us;
+    int     key;
+    int     size;
+    uint8_t data[];
+} mp4_pend_t;
+
+#define MP4_MAX_PENDING (32LL * 1024 * 1024)  /* parked-bytes bound; past it deliver anyway */
+
+/* Decode time of the cursor's next sample, mapped like emission. */
+static int64_t classic_sample_dts_us(const mp4_track_t* t) {
+    const mp4_ctab_t* c = &t->ctab;
+    return ticks_to_us(c->dts - c->media_start, t->timescale) + c->pts_delay_us;
+}
+
+/* Next undelivered decode time for a track: the parked front, else the table
+ * cursor's sample while it still points inside this mdat. */
+static int64_t classic_next_due(const mp4_track_t* t, const mp4_pend_t* head, int64_t mdat_end) {
+    if (head) return head->dts_us;
+    const mp4_ctab_t* c = &t->ctab;
+    if (c->next >= c->sample_count || (int64_t)c->offset >= mdat_end) return INT64_MAX;
+    return classic_sample_dts_us(t);
+}
+
+static void emit_pend(mp4_t* m, const mp4_track_t* t, const mp4_pend_t* s) {
+    if (t->is_video) m->sink->on_video_au(m->sink->user, s->data, s->size, s->pts_us, s->dts_us, s->key);
+    else m->sink->on_audio_frame(m->sink->user, s->data, s->size, s->pts_us);
+}
+
+/* Repositions a track cursor to the sample at target_us — for video, the
+ * preceding sync sample so decode restarts on a keyframe. Replays the cursor
+ * from the table start: the tables are in memory, so a full replay is cheap
+ * relative to the network refetch the seek triggers anyway. */
+static void classic_seek_cursor(mp4_track_t* t, int64_t target_us, int want_key) {
+    mp4_ctab_t* c = &t->ctab;
+    classic_init_cursor(c);
+    if (!c->sample_count) return;
+    for (;;) {
+        if (c->next + 1 >= c->sample_count) break;
+        int64_t next_dts = c->dts + (int64_t)c->stts[c->stts_i * 2 + 1];
+        int64_t next_us = ticks_to_us(next_dts - c->media_start, t->timescale) + c->pts_delay_us;
+        if (next_us > target_us) break;
+        classic_advance(c);
+    }
+    if (want_key && c->stss) {
+        uint32_t key1 = 1; /* stss is sorted 1-based; find the floor of next+1 */
+        for (uint32_t k = 0; k < c->stss_count; ++k) {
+            if (c->stss[k] <= c->next + 1) key1 = c->stss[k];
+            else break;
+        }
+        uint32_t key0 = key1 ? key1 - 1 : 0;
+        classic_init_cursor(c);
+        while (c->next < key0) classic_advance(c);
+    }
+}
+
+/* Walks the classic tables against one mdat. The byte source only moves
+ * forward, so samples are read in file-offset order — the muxer's chunk
+ * interleave — but delivered in decode-time order across tracks: with a
+ * coarse interleave (a chunk of video ahead of the matching audio) the
+ * delivery-paced chunk in front would otherwise hold the other track's
+ * earlier samples past their turn and starve it. Samples whose file order
+ * runs ahead of their delivery turn are parked in per-track queues, bounded
+ * by MP4_MAX_PENDING — past the bound (or once nothing more can be read from
+ * this mdat) the earliest parked sample delivers regardless. Samples whose
+ * offsets lie beyond this mdat wait for a later one. mdat_end is the absolute
+ * end of the payload, or INT64_MAX for a size-0 box. */
 static int consume_progressive(mp4_t* m, int64_t mdat_end) {
     uint8_t* buf = NULL;
     size_t cap = 0;
     int rc = 0;
+    mp4_pend_t* head[2] = { NULL, NULL };
+    mp4_pend_t* tail[2] = { NULL, NULL };
+    int64_t queued = 0;   /* payload bytes parked across both queues */
 
     for (;;) {
         if (!m->sink->is_running(m->sink->user)) { rc = -1; break; }
 
-        mp4_track_t* t = NULL;
+        /* absolute seek: reposition mid-walk when the engine posts a target */
+        int64_t seek_us;
+        if (m->reseek && m->sink->take_seek && m->sink->take_seek(m->sink->user, &seek_us)) {
+            uint64_t new_off = UINT64_MAX;
+            for (int i = 0; i < m->ntracks; ++i) {
+                mp4_track_t* t = &m->tracks[i];
+                if (!classic_track_ready(&t->ctab)) continue;
+                classic_seek_cursor(t, seek_us, t->is_video);
+                if (t->ctab.next < t->ctab.sample_count && t->ctab.offset < new_off)
+                    new_off = t->ctab.offset;
+            }
+            if (new_off != UINT64_MAX && (int64_t)new_off < mdat_end &&
+                m->reseek(m->reseek_ctx, (int64_t)new_off) == 0) {
+                m->pos = (int64_t)new_off;
+                for (int i = 0; i < 2; ++i) { /* parked samples predate the jump */
+                    while (head[i]) { mp4_pend_t* s = head[i]; head[i] = s->next; free(s); }
+                    tail[i] = NULL;
+                }
+                queued = 0;
+            }
+            /* On a failed refetch the cursors stay moved: samples now behind the
+             * stream head drop via the existing unreachable-bytes check and the
+             * walk degrades to forward-only rather than derailing. */
+            continue;
+        }
+
+        /* the next sample in file order, while any remains in this mdat */
+        mp4_track_t* rt = NULL;
         for (int i = 0; i < m->ntracks; ++i) {
             mp4_ctab_t* c = &m->tracks[i].ctab;
             if (c->next >= c->sample_count) continue;
             if ((int64_t)c->offset >= mdat_end) continue;
-            if (!t || c->offset < t->ctab.offset) t = &m->tracks[i];
+            if (!rt || c->offset < rt->ctab.offset) rt = &m->tracks[i];
+        }
+
+        /* deliver the earliest parked sample once no other track can still
+         * produce an earlier one — or when forced (bound hit, or nothing left
+         * to read in this mdat) */
+        int e = -1;
+        for (int i = 0; i < m->ntracks; ++i)
+            if (head[i] && (e < 0 || head[i]->dts_us < head[e]->dts_us)) e = i;
+        if (e >= 0) {
+            int64_t barrier = INT64_MAX;
+            for (int i = 0; i < m->ntracks; ++i) {
+                if (i == e) continue;
+                int64_t due = classic_next_due(&m->tracks[i], head[i], mdat_end);
+                if (due < barrier) barrier = due;
+            }
+            if (head[e]->dts_us <= barrier || queued > MP4_MAX_PENDING || !rt) {
+                mp4_pend_t* s = head[e];
+                head[e] = s->next;
+                if (!head[e]) tail[e] = NULL;
+                queued -= s->size;
+                emit_pend(m, &m->tracks[e], s);
+                free(s);
+                continue;
+            }
         }
-        if (!t) break;
+        if (!rt) break;
 
-        mp4_ctab_t* c = &t->ctab;
+        mp4_ctab_t* c = &rt->ctab;
         uint32_t ssize = classic_size(c, c->next);
-        if (ssize == 0 || (int64_t)c->offset < m->pos ||
-            (mdat_end != INT64_MAX && (int64_t)(c->offset + ssize) > mdat_end)) {
+        if (ssize == 0 || ssize > (uint32_t)MP4_MAX_BOX || (int64_t)c->offset < m->pos ||
+            (mdat_end != INT64_MAX && (int64_t)c->offset > mdat_end - (int64_t)ssize)) {
             /* behind the stream head or overrunning the box: the table points at
              * bytes we can't reach — drop the sample and keep walking */
             classic_advance(c);
@@ -441,11 +653,16 @@ static int consume_progressive(mp4_t* m, int64_t mdat_end) {
         }
         if (read_exact(m, buf, (int)ssize) != (int)ssize) { rc = -1; break; }
 
-        int tsc = t->timescale > 0 ? t->timescale : 90000;
-        int32_t cto = c->ctts ? (int32_t)c->ctts[c->ctts_i * 2 + 1] : 0;
-        int64_t pts_us = (c->dts + cto) * 1000000 / tsc;
+        int64_t cto = 0;
+        if (c->ctts) {
+            uint32_t raw = c->ctts[c->ctts_i * 2 + 1];
+            cto = c->ctts_version ? (int64_t)(int32_t)raw : (int64_t)raw;
+        }
+        int64_t pts_us = ticks_to_us(c->dts + cto - c->media_start, rt->timescale) + c->pts_delay_us;
+        int64_t dts_us = classic_sample_dts_us(rt);
 
-        if (t->is_video) {
+        mp4_pend_t* s = NULL;
+        if (rt->is_video) {
             int key = 1;
             if (c->stss) {
                 /* stss is sorted 1-based sample numbers; catch the cursor up past
@@ -454,26 +671,39 @@ static int consume_progressive(mp4_t* m, int64_t mdat_end) {
                 key = c->stss_i < c->stss_count && c->stss[c->stss_i] == c->next + 1;
                 if (key) c->stss_i++;
             }
-            int nls = t->nal_len_size ? t->nal_len_size : 4;
-            /* Annex B swaps each NAL's nls-byte length prefix for a 4-byte start
-             * code; a NAL is at least nls + 1 bytes, so this bounds the growth. */
-            int outcap = (int)ssize + (4 - nls) * ((int)ssize / (nls + 1)) + 64;
-            uint8_t* out = (uint8_t*)malloc((size_t)outcap);
-            if (out) {
-                int n = basis_avcc_to_annexb(buf, (int)ssize, nls, out, outcap);
+            int nls = rt->nal_len_size ? rt->nal_len_size : 4;
+            int outcap = basis_avcc_annexb_cap((int)ssize, nls);
+            s = (mp4_pend_t*)malloc(sizeof(*s) + (size_t)outcap);
+            if (s) {
+                int n = basis_avcc_to_annexb(buf, (int)ssize, nls, s->data, outcap);
                 if (n > 0) {
                     if (c->stss == NULL)
-                        key = t->codec == BASIS_CODEC_H265 ? basis_h265_is_keyframe(out, n) : basis_h264_is_keyframe(out, n);
-                    m->sink->on_video_au(m->sink->user, out, n, pts_us, key);
-                }
-                free(out);
+                        key = rt->codec == BASIS_CODEC_H265 ? basis_h265_is_keyframe(s->data, n) : basis_h264_is_keyframe(s->data, n);
+                    s->size = n;
+                    s->key = key;
+                } else { free(s); s = NULL; }
             }
         } else {
-            m->sink->on_audio_frame(m->sink->user, buf, (int)ssize, pts_us);
+            s = (mp4_pend_t*)malloc(sizeof(*s) + ssize);
+            if (s) { memcpy(s->data, buf, ssize); s->size = (int)ssize; s->key = 0; }
+        }
+        if (s) {
+            int ti = (int)(rt - m->tracks);
+            s->pts_us = pts_us;
+            s->dts_us = dts_us;
+            s->next = NULL;
+            if (tail[ti]) tail[ti]->next = s; else head[ti] = s;
+            tail[ti] = s;
+            queued += s->size;
         }
         classic_advance(c);
     }
 
+    /* the loop drains the queues before exiting cleanly; anything still parked
+     * here means the engine is stopping — release without delivering */
+    for (int i = 0; i < 2; ++i)
+        while (head[i]) { mp4_pend_t* s = head[i]; head[i] = s->next; free(s); }
+
     free(buf);
     if (rc == 0 && mdat_end != INT64_MAX && m->pos < mdat_end)
         return skip_bytes(m, mdat_end - m->pos);
@@ -501,35 +731,43 @@ static int frag_reserve(mp4_frag_t* f, int n) {
  * decode time; each trun gives a data-offset (relative to the moof) and samples. */
 static void parse_traf(mp4_t* m, const uint8_t* p, int len) {
     int off = 0;
-    int track_id = 0, default_dur = 0, default_size = 0;
+    int track_id = 0;
+    uint32_t default_dur = 0, default_size = 0;
     int64_t base_dts = 0;
     while (off + 8 <= len) {
         int sz = (int)rd32(p + off);
         uint32_t ty = rd32(p + off + 4);
-        if (sz < 8 || off + sz > len) break;
+        if (sz < 8 || sz > len - off) break;
         const uint8_t* b = p + off + 8;
-        if (ty == 0x74666864) { /* tfhd */
+        int blen = sz - 8;
+        if (ty == 0x74666864 && blen >= 8) { /* tfhd */
             uint32_t flags = rd32(b) & 0xFFFFFF;
-            int q = 4;
-            track_id = (int)rd32(b + q); q += 4;
+            track_id = (int)rd32(b + 4);
+            int q = 8;
             if (flags & 0x000001) q += 8;  /* base-data-offset */
             if (flags & 0x000002) q += 4;  /* sample-description-index */
-            if (flags & 0x000008) { default_dur = (int)rd32(b + q); q += 4; }
-            if (flags & 0x000010) { default_size = (int)rd32(b + q); q += 4; }
-        } else if (ty == 0x74666474) { /* tfdt */
+            if (flags & 0x000008) { if (q + 4 > blen) { off += sz; continue; } default_dur = rd32(b + q); q += 4; }
+            if (flags & 0x000010) { if (q + 4 > blen) { off += sz; continue; } default_size = rd32(b + q); q += 4; }
+        } else if (ty == 0x74666474 && blen >= 8) { /* tfdt */
             int ver = b[0];
-            base_dts = ver == 1 ? (int64_t)rd64(b + 4) : (int64_t)rd32(b + 4);
+            if (ver != 1) base_dts = (int64_t)rd32(b + 4);
+            else if (blen >= 12) base_dts = (int64_t)rd64(b + 4);
         } else if (ty == 0x7472756e && m->nfrags < MP4_MAX_FRAGS) { /* trun */
+            if (blen < 8) { off += sz; continue; }
             mp4_frag_t* f = &m->frags[m->nfrags];
             uint32_t flags = rd32(b) & 0xFFFFFF;
-            int count = (int)rd32(b + 4);
+            uint32_t count = rd32(b + 4);
             int q = 8;
             int data_offset = 0;
-            if (flags & 0x000001) { data_offset = (int)rd32(b + q); q += 4; } /* data-offset */
-            if (flags & 0x000004) q += 4; /* first-sample-flags */
-            if (!frag_reserve(f, count)) { off += sz; continue; }
-            for (int i = 0; i < count; ++i) {
-                uint32_t dur = (uint32_t)default_dur, size = (uint32_t)default_size;
+            if (flags & 0x000001) { if (q + 4 > blen) { off += sz; continue; } data_offset = (int)rd32(b + q); q += 4; } /* data-offset */
+            if (flags & 0x000004) { if (q + 4 > blen) { off += sz; continue; } q += 4; } /* first-sample-flags */
+            /* the declared per-sample table must fit inside this box */
+            int per = 4 * (!!(flags & 0x000100) + !!(flags & 0x000200) + !!(flags & 0x000400) + !!(flags & 0x000800));
+            if (count == 0 || count > MP4_MAX_FRAG_SAMPLES ||
+                (int64_t)count * per > (int64_t)blen - q) { off += sz; continue; }
+            if (!frag_reserve(f, (int)count)) { off += sz; continue; }
+            for (uint32_t i = 0; i < count; ++i) {
+                uint32_t dur = default_dur, size = default_size;
                 int32_t cto = 0;
                 if (flags & 0x000100) { dur = rd32(b + q); q += 4; }
                 if (flags & 0x000200) { size = rd32(b + q); q += 4; }
@@ -541,7 +779,7 @@ static void parse_traf(mp4_t* m, const uint8_t* p, int len) {
             f->base_dts = base_dts;
             f->data_offset = data_offset;
             f->default_dur = default_dur;
-            f->count = count;
+            f->count = (int)count;
             m->nfrags++;
         }
         off += sz;
@@ -554,7 +792,7 @@ static void parse_moof(mp4_t* m, const uint8_t* p, int len) {
     while (off + 8 <= len) {
         int sz = (int)rd32(p + off);
         uint32_t ty = rd32(p + off + 4);
-        if (sz < 8 || off + sz > len) break;
+        if (sz < 8 || sz > len - off) break;
         if (ty == 0x74726166) parse_traf(m, p + off + 8, sz - 8); /* traf */
         off += sz;
     }
@@ -569,8 +807,10 @@ static void parse_moof(mp4_t* m, const uint8_t* p, int len) {
  * fragment of video before any of that fragment's audio — and with delivery
  * pacing on (VOD, HLS) the paced video burst makes the trailing audio arrive a
  * full fragment late, starving the audio-gated presentation clock. Merging by
- * decode time interleaves the tracks at frame granularity, like the TS demuxer.
- * Order within a run (decode order) is preserved. */
+ * decode time interleaves the tracks at frame granularity, like the TS demuxer,
+ * and each sample's decode time rides along to the sink so the pacing gate
+ * holds it no later than its decode turn. Order within a run (decode order)
+ * is preserved. */
 static void consume_mdat(mp4_t* m, const uint8_t* data, int len) {
     if (m->nfrags <= 0) return;
     int base_off = m->frags[0].data_offset;
@@ -578,13 +818,13 @@ static void consume_mdat(mp4_t* m, const uint8_t* data, int len) {
         if (m->frags[k].data_offset < base_off) base_off = m->frags[k].data_offset;
 
     mp4_track_t* trk[MP4_MAX_FRAGS];
-    int     pos[MP4_MAX_FRAGS];
+    int64_t pos[MP4_MAX_FRAGS];
     int     idx[MP4_MAX_FRAGS];
     int64_t dts[MP4_MAX_FRAGS];
     for (int k = 0; k < m->nfrags; ++k) {
         const mp4_frag_t* f = &m->frags[k];
         trk[k] = track_by_id(m, f->track_id);
-        pos[k] = f->data_offset - base_off;
+        pos[k] = (int64_t)f->data_offset - base_off;
         idx[k] = (trk[k] && pos[k] >= 0) ? 0 : f->count; /* unknown track / bad offset: skip run */
         dts[k] = f->base_dts;
     }
@@ -594,8 +834,7 @@ static void consume_mdat(mp4_t* m, const uint8_t* data, int len) {
         int64_t best_us = 0;
         for (int j = 0; j < m->nfrags; ++j) {
             if (idx[j] >= m->frags[j].count) continue;
-            int jts = trk[j]->timescale > 0 ? trk[j]->timescale : 90000;
-            int64_t us = dts[j] * 1000000 / jts;
+            int64_t us = ticks_to_us(dts[j], trk[j]->timescale);
             if (k < 0 || us < best_us) { k = j; best_us = us; }
         }
         if (k < 0) break;
@@ -603,27 +842,26 @@ static void consume_mdat(mp4_t* m, const uint8_t* data, int len) {
         const mp4_frag_t* f = &m->frags[k];
         mp4_track_t* t = trk[k];
         int i = idx[k];
-        int ssize = (int)f->sizes[i];
-        if (ssize <= 0 || pos[k] + ssize > len) { idx[k] = f->count; continue; } /* run truncated */
-        int ts = t->timescale > 0 ? t->timescale : 90000;
-        int64_t pts_us = (dts[k] + f->ctos[i]) * 1000000 / ts;
+        uint32_t ssize = f->sizes[i];
+        if (ssize == 0 || ssize > (uint32_t)len || pos[k] > (int64_t)len - (int64_t)ssize) {
+            idx[k] = f->count; continue; /* run truncated */
+        }
+        int64_t pts_us = ticks_to_us(dts[k] + f->ctos[i], t->timescale);
 
         if (t->is_video) {
             int nls = t->nal_len_size ? t->nal_len_size : 4;
-            /* Annex B swaps each NAL's nls-byte length prefix for a 4-byte start
-             * code; a NAL is at least nls + 1 bytes, so this bounds the growth. */
-            int cap = ssize + (4 - nls) * (ssize / (nls + 1)) + 64;
+            int cap = basis_avcc_annexb_cap((int)ssize, nls);
             uint8_t* out = (uint8_t*)malloc((size_t)cap);
             if (out) {
-                int n = basis_avcc_to_annexb(data + pos[k], ssize, nls, out, cap);
+                int n = basis_avcc_to_annexb(data + pos[k], (int)ssize, nls, out, cap);
                 if (n > 0) {
                     int key = t->codec == BASIS_CODEC_H265 ? basis_h265_is_keyframe(out, n) : basis_h264_is_keyframe(out, n);
-                    m->sink->on_video_au(m->sink->user, out, n, pts_us, key);
+                    m->sink->on_video_au(m->sink->user, out, n, pts_us, best_us, key);
                 }
                 free(out);
             }
         } else {
-            m->sink->on_audio_frame(m->sink->user, data + pos[k], ssize, pts_us);
+            m->sink->on_audio_frame(m->sink->user, data + pos[k], (int)ssize, pts_us);
         }
 
         pos[k] += ssize;
@@ -632,9 +870,11 @@ static void consume_mdat(mp4_t* m, const uint8_t* data, int len) {
     }
 }
 
-int basis_mp4_run(basis_media_sink_t* sink, basis_read_fn read, void* ctx) {
+int basis_mp4_run(basis_media_sink_t* sink, basis_read_fn read, void* ctx,
+                  basis_reseek_fn reseek, void* reseek_ctx) {
     mp4_t m; memset(&m, 0, sizeof(m));
     m.sink = sink; m.read = read; m.ctx = ctx;
+    m.reseek = reseek; m.reseek_ctx = reseek_ctx;
 
     while (sink->is_running(sink->user)) {
         uint32_t type; int64_t body;
@@ -672,11 +912,32 @@ int basis_mp4_run(basis_media_sink_t* sink, basis_read_fn read, void* ctx) {
         switch (type) {
             case 0x6d6f6f76: /* moov */
                 parse_box_tree(&m, NULL, buf, (int)body);
-                for (int i = 0; i < m.ntracks; ++i) classic_init_cursor(&m.tracks[i].ctab);
+                for (int i = 0; i < m.ntracks; ++i) {
+                    classic_apply_elst(&m, &m.tracks[i]);
+                    classic_init_cursor(&m.tracks[i].ctab);
+                }
                 announce_tracks(&m);
+                /* A track whose sizes live in stz2 has no walkable tables; playing
+                 * the remaining track would silently drop this one, so fail loudly. */
+                for (int i = 0; i < m.ntracks; ++i)
+                    if (m.tracks[i].ctab.has_stz2 && !classic_track_ready(&m.tracks[i].ctab)) {
+                        sink->on_error(sink->user,
+                            "MP4 uses a compact (stz2) sample-size table, which isn't supported; remux (ffmpeg -c copy) to rewrite the sample tables");
+                        break;
+                    }
                 if (m.mdat_skipped && classic_ready(&m))
                     sink->on_error(sink->user,
                         "progressive MP4 stores its index (moov) after the media data, which can't play over a one-way stream; remux with faststart (ffmpeg -movflags +faststart)");
+                /* Progressive files have a complete timeline in hand — report it,
+                 * but only when the byte source can honour seeks (a non-zero
+                 * duration is the managed layer's seekability signal). fMP4
+                 * durations come from the layer that knows them (HLS VOD). */
+                if (classic_ready(&m) && m.reseek && sink->on_duration) {
+                    int64_t dur_us = m.movie_duration > 0
+                        ? ticks_to_us(m.movie_duration, m.movie_timescale > 0 ? m.movie_timescale : 1000)
+                        : classic_total_duration_us(&m);
+                    if (dur_us > 0) sink->on_duration(sink->user, dur_us);
+                }
                 break;
             case 0x6d6f6f66: /* moof */
                 parse_moof(&m, buf, (int)body);
diff --git a/Basis/Packages/com.basis.mediaplayer/Native~/protocol/basis_mp4.h b/Basis/Packages/com.basis.mediaplayer/Native~/protocol/basis_mp4.h
index 4608e5ef1..516437920 100644
--- a/Basis/Packages/com.basis.mediaplayer/Native~/protocol/basis_mp4.h
+++ b/Basis/Packages/com.basis.mediaplayer/Native~/protocol/basis_mp4.h
@@ -1,6 +1,7 @@
-/* Fragmented-MP4 demuxer (ftyp/moov/moof/mdat) feeding H.264/H.265 + AAC into a
- * basis_media_sink. Pulls bytes through the supplied read callback. Targets the
- * live fMP4 profile (init segment + moof/mdat fragments). */
+/* MP4 demuxer feeding H.264/H.265 + AAC into a basis_media_sink. Handles both
+ * fragmented MP4 (fMP4/CMAF: init segment + moof/mdat fragments) and classic
+ * progressive files (moov sample tables + mdat, faststart layout). Pulls bytes
+ * through the supplied read callback. */
 #ifndef BASIS_MP4_H
 #define BASIS_MP4_H
 
@@ -10,7 +11,10 @@
 extern "C" {
 #endif
 
-int basis_mp4_run(basis_media_sink_t* sink, basis_read_fn read, void* ctx);
+/* reseek/reseek_ctx (optional, NULL when the source can't reposition) let the
+ * progressive path honour sink->take_seek requests with a ranged refetch. */
+int basis_mp4_run(basis_media_sink_t* sink, basis_read_fn read, void* ctx,
+                  basis_reseek_fn reseek, void* reseek_ctx);
 
 #ifdef __cplusplus
 }
diff --git a/Basis/Packages/com.basis.mediaplayer/Native~/protocol/basis_rtmp.c b/Basis/Packages/com.basis.mediaplayer/Native~/protocol/basis_rtmp.c
index 12e9800db..fbe530f1a 100644
--- a/Basis/Packages/com.basis.mediaplayer/Native~/protocol/basis_rtmp.c
+++ b/Basis/Packages/com.basis.mediaplayer/Native~/protocol/basis_rtmp.c
@@ -201,12 +201,13 @@ static void handle_video(rtmp_t* r, basis_media_sink_t* sink, chunk_state_t* c)
     } else if (avc_pkt == 1) { /* NALUs (avcc) -> annex B */
         if (!r->video_announced) sink->on_video_format(sink->user, r->video_codec, NULL, 0, 0, 0), r->video_announced = 1;
         int nls = r->video_nls ? r->video_nls : 4;
-        uint8_t* out = (uint8_t*)malloc((size_t)dlen + 64);
+        int cap = basis_avcc_annexb_cap(dlen, nls);
+        uint8_t* out = (uint8_t*)malloc((size_t)cap);
         if (out) {
-            int n = basis_avcc_to_annexb(data, dlen, nls, out, dlen + 64);
+            int n = basis_avcc_to_annexb(data, dlen, nls, out, cap);
             if (n > 0) {
                 int key = (p[0] >> 4) == 1; /* FLV frametype 1 = keyframe */
-                sink->on_video_au(sink->user, out, n, pts_us, key);
+                sink->on_video_au(sink->user, out, n, pts_us, (int64_t)c->ts * 1000, key);
             }
             free(out);
         }
diff --git a/Basis/Packages/com.basis.mediaplayer/Native~/protocol/basis_rtsp.c b/Basis/Packages/com.basis.mediaplayer/Native~/protocol/basis_rtsp.c
index 874035e0a..60c981168 100644
--- a/Basis/Packages/com.basis.mediaplayer/Native~/protocol/basis_rtsp.c
+++ b/Basis/Packages/com.basis.mediaplayer/Native~/protocol/basis_rtsp.c
@@ -284,7 +284,7 @@ static void deliver_au(depkt_t* d) {
     int key = d->video->codec == BASIS_CODEC_H265 ? basis_h265_is_keyframe(d->au, d->au_len)
                                                   : basis_h264_is_keyframe(d->au, d->au_len);
     int64_t pts = rtp_ts_to_us(d->au_ts, d->video->clock);
-    d->sink->on_video_au(d->sink->user, d->au, d->au_len, pts, key);
+    d->sink->on_video_au(d->sink->user, d->au, d->au_len, pts, pts, key);
     d->au_len = 0;
 }
 
diff --git a/Basis/Packages/com.basis.mediaplayer/Native~/protocol/basis_ts.c b/Basis/Packages/com.basis.mediaplayer/Native~/protocol/basis_ts.c
index e8ef2a1c9..448ef2eff 100644
--- a/Basis/Packages/com.basis.mediaplayer/Native~/protocol/basis_ts.c
+++ b/Basis/Packages/com.basis.mediaplayer/Native~/protocol/basis_ts.c
@@ -101,7 +101,7 @@ static void flush_video(ts_t* t) {
 
     int key = (t->video_codec == BASIS_CODEC_H265) ? basis_h265_is_keyframe(au, au_len)
                                                    : basis_h264_is_keyframe(au, au_len);
-    t->sink->on_video_au(t->sink->user, au, au_len, pts_us, key);
+    t->sink->on_video_au(t->sink->user, au, au_len, pts_us, pts_us, key);
 
     e->len = 0;
     e->started = 0;
diff --git a/Basis/Packages/com.basis.mediaplayer/Native~/windows/basis_win_decode.cpp b/Basis/Packages/com.basis.mediaplayer/Native~/windows/basis_win_decode.cpp
index 1f3eeb09b..53e0ccf8f 100644
--- a/Basis/Packages/com.basis.mediaplayer/Native~/windows/basis_win_decode.cpp
+++ b/Basis/Packages/com.basis.mediaplayer/Native~/windows/basis_win_decode.cpp
@@ -211,6 +211,11 @@ struct basis_decoder {
     LONGLONG lastRenderQpc = 0;
     int64_t mediaStartUs = 0;
     int64_t lastPresentedPts = INT64_MIN;
+    /* Stable presentation position for get_position_us: unlike lastPresentedPts
+     * it survives the resync sentinel resets, and unlike lastPtsUs (decode-side)
+     * it freezes with presentation — a paused/stopped player reads as holding
+     * still even while the demuxer keeps feeding the ring. */
+    volatile LONG64 presentedPosUs = -1;
 
     /* audio-master sync: pace video to audio Unity has actually consumed. */
     int64_t videoBasePts = INT64_MIN;        /* PTS of the first video frame (sync origin) */
@@ -1175,6 +1180,7 @@ extern "C" int basis_decoder_render_update(basis_decoder_t* d) {
             d->ctxUnity->CopyResource(d->outTexD11, d->ringOnUnity[best]);
             if (d->ringMutexUnity[best]) d->ringMutexUnity[best]->ReleaseSync(0);
             d->lastPresentedPts = bestPts;
+            InterlockedExchange64(&d->presentedPosUs, bestPts);
             InterlockedIncrement(&d->dbg_copy);
             if (d->ttffMs < 0) {
                 LARGE_INTEGER tnow; QueryPerformanceCounter(&tnow);
@@ -1223,6 +1229,7 @@ extern "C" int basis_decoder_render_update(basis_decoder_t* d) {
                          * never handed on (or sampled) mid-write. */
                         d->outSharedD12Mutex->ReleaseSync(0);
                         d->lastPresentedPts = bestPts;
+                        InterlockedExchange64(&d->presentedPosUs, bestPts);
                         InterlockedIncrement(&d->dbg_copy);
                         if (d->ttffMs < 0) {
                             LARGE_INTEGER tnow; QueryPerformanceCounter(&tnow);
@@ -1270,7 +1277,13 @@ extern "C" int basis_decoder_get_video_size(basis_decoder_t* d, int* w, int* h)
     if (w) *w = d->sharedW; if (h) *h = d->sharedH; return 0;
 }
 extern "C" int basis_decoder_get_frame_origin(basis_decoder_t* d) { return d ? (int)d->frameTopLeft : 0; }
-extern "C" int64_t basis_decoder_get_position_us(basis_decoder_t* d) { return d ? d->lastPtsUs : -1; }
+extern "C" int64_t basis_decoder_get_position_us(basis_decoder_t* d) {
+    if (!d) return -1;
+    /* Presentation position once a frame has shown; decode-side before that
+     * (start-up, audio-only) so early consumers still see the clock move. */
+    int64_t presented = InterlockedCompareExchange64((volatile LONG64*)&d->presentedPosUs, 0, 0);
+    return presented >= 0 ? presented : d->lastPtsUs;
+}
 extern "C" int basis_decoder_get_audio_format(basis_decoder_t* d, int* r, int* c) {
     if (!d || !d->aconfigured) return -1;
     if (r) *r = d->asr ? d->asr : 48000;
diff --git a/Basis/Packages/com.basis.mediaplayer/Native~/windows/basis_win_http.cpp b/Basis/Packages/com.basis.mediaplayer/Native~/windows/basis_win_http.cpp
index d2259555f..f1c06bfdb 100644
--- a/Basis/Packages/com.basis.mediaplayer/Native~/windows/basis_win_http.cpp
+++ b/Basis/Packages/com.basis.mediaplayer/Native~/windows/basis_win_http.cpp
@@ -3,6 +3,7 @@
 
 #include <windows.h>
 #include <winhttp.h>
+#include <stdio.h>
 #include <string.h>
 #include <stdlib.h>
 
@@ -14,6 +15,9 @@ typedef struct {
     HINTERNET request;
     int response_complete;
     int seekable;            /* finite Content-Length + Accept-Ranges: bytes (VOD) */
+    int range_ok;            /* server answered the bytes=0- probe with a 206 */
+    wchar_t* path;           /* request path, kept for ranged re-requests */
+    DWORD open_flags;        /* WINHTTP_FLAG_SECURE when https */
 } win_http_t;
 
 static wchar_t* to_w(const char* s) {
@@ -49,11 +53,13 @@ extern "C" void* basis_win_http_open(const char* url) {
     if (!h->connect) { WinHttpCloseHandle(h->session); free(wurl); free(h); return NULL; }
 
     DWORD flags = (uc.nScheme == INTERNET_SCHEME_HTTPS) ? WINHTTP_FLAG_SECURE : 0;
+    h->open_flags = flags;
+    h->path = _wcsdup(path);
     h->request = WinHttpOpenRequest(h->connect, L"GET", path, NULL,
                                     WINHTTP_NO_REFERER, WINHTTP_DEFAULT_ACCEPT_TYPES, flags);
     if (!h->request) {
         WinHttpCloseHandle(h->connect); WinHttpCloseHandle(h->session);
-        free(wurl); free(h); return NULL;
+        free(h->path); free(wurl); free(h); return NULL;
     }
 
     /* SSRF: never let a public URL redirect down to plaintext (the classic
@@ -62,11 +68,15 @@ extern "C" void* basis_win_http_open(const char* url) {
     DWORD redirectPolicy = WINHTTP_OPTION_REDIRECT_POLICY_DISALLOW_HTTPS_TO_HTTP;
     WinHttpSetOption(h->request, WINHTTP_OPTION_REDIRECT_POLICY, &redirectPolicy, sizeof(redirectPolicy));
 
-    if (!WinHttpSendRequest(h->request, WINHTTP_NO_ADDITIONAL_HEADERS, 0,
+    /* The bytes=0- probe: identical body, but a server that really implements
+     * ranges answers 206. Only that proves a later ranged re-request will be
+     * honoured — Accept-Ranges alone is advertisement (Python's SimpleHTTP
+     * handler, for one, advertises it and then serves 200 + the whole file). */
+    if (!WinHttpSendRequest(h->request, L"Range: bytes=0-", (DWORD)-1L,
                             WINHTTP_NO_REQUEST_DATA, 0, 0, 0) ||
         !WinHttpReceiveResponse(h->request, NULL)) {
         WinHttpCloseHandle(h->request); WinHttpCloseHandle(h->connect); WinHttpCloseHandle(h->session);
-        free(wurl); free(h); return NULL;
+        free(h->path); free(wurl); free(h); return NULL;
     }
 
     /* check status code */
@@ -76,8 +86,9 @@ extern "C" void* basis_win_http_open(const char* url) {
     free(wurl);
     if (code < 200 || code >= 400) {
         WinHttpCloseHandle(h->request); WinHttpCloseHandle(h->connect); WinHttpCloseHandle(h->session);
-        free(h); return NULL;
+        free(h->path); free(h); return NULL;
     }
+    h->range_ok = (code == 206);
 
     /* Seekability (for live-vs-VOD auto-detection): a known Content-Length plus
      * Accept-Ranges: bytes means a finite, range-fetchable body — on-demand content.
@@ -101,6 +112,11 @@ extern "C" int basis_win_http_is_seekable(void* ctx) {
     return h ? h->seekable : 0;
 }
 
+extern "C" int basis_win_http_can_reseek(void* ctx) {
+    win_http_t* h = (win_http_t*)ctx;
+    return h ? (h->seekable && h->range_ok) : 0;
+}
+
 extern "C" int basis_win_http_read(void* ctx, uint8_t* buf, int len) {
     win_http_t* h = (win_http_t*)ctx;
     if (!h || h->response_complete || len <= 0) return 0;
@@ -122,11 +138,55 @@ extern "C" void basis_win_http_abort(void* ctx) {
     if (req) WinHttpCloseHandle(req);
 }
 
+/* Replaces the current response with a ranged GET on the same connection so the
+ * stream continues from `offset`. Only valid on a seekable body. The caller must
+ * guarantee no concurrent basis_win_http_read is in flight (park or abort the
+ * reading thread first — a prior basis_win_http_abort is fine, this re-opens).
+ * Returns 0 on success; on failure the source is left request-less and reads
+ * report EOF. */
+extern "C" int basis_win_http_reseek(void* ctx, long long offset) {
+    win_http_t* h = (win_http_t*)ctx;
+    if (!h || !h->seekable || !h->range_ok || !h->path || offset < 0) return -1;
+
+    HINTERNET old_req = h->request;
+    h->request = NULL;
+    if (old_req) WinHttpCloseHandle(old_req);
+
+    HINTERNET req = WinHttpOpenRequest(h->connect, L"GET", h->path, NULL,
+                                       WINHTTP_NO_REFERER, WINHTTP_DEFAULT_ACCEPT_TYPES, h->open_flags);
+    if (!req) return -1;
+    DWORD redirectPolicy = WINHTTP_OPTION_REDIRECT_POLICY_DISALLOW_HTTPS_TO_HTTP;
+    WinHttpSetOption(req, WINHTTP_OPTION_REDIRECT_POLICY, &redirectPolicy, sizeof(redirectPolicy));
+
+    wchar_t range[64];
+    swprintf(range, 64, L"Range: bytes=%lld-", offset);
+    if (!WinHttpSendRequest(req, range, (DWORD)-1L, WINHTTP_NO_REQUEST_DATA, 0, 0, 0) ||
+        !WinHttpReceiveResponse(req, NULL)) {
+        WinHttpCloseHandle(req);
+        return -1;
+    }
+
+    /* 206 = ranged body starting at offset. A 200 means the server ignored the
+     * Range and restarted at byte 0 — the bytes would be silently misaligned. */
+    DWORD code = 0, sz = sizeof(code);
+    WinHttpQueryHeaders(req, WINHTTP_QUERY_STATUS_CODE | WINHTTP_QUERY_FLAG_NUMBER,
+                        WINHTTP_HEADER_NAME_BY_INDEX, &code, &sz, WINHTTP_NO_HEADER_INDEX);
+    if (code != 206 && !(code == 200 && offset == 0)) {
+        WinHttpCloseHandle(req);
+        return -1;
+    }
+
+    h->request = req;
+    h->response_complete = 0;
+    return 0;
+}
+
 extern "C" void basis_win_http_close(void* ctx) {
     win_http_t* h = (win_http_t*)ctx;
     if (!h) return;
     if (h->request) WinHttpCloseHandle(h->request);
     if (h->connect) WinHttpCloseHandle(h->connect);
     if (h->session) WinHttpCloseHandle(h->session);
+    free(h->path);
     free(h);
 }
diff --git a/Basis/Packages/com.basis.mediaplayer/Native~/windows/basis_win_http.h b/Basis/Packages/com.basis.mediaplayer/Native~/windows/basis_win_http.h
index 6500ec4ea..813990bde 100644
--- a/Basis/Packages/com.basis.mediaplayer/Native~/windows/basis_win_http.h
+++ b/Basis/Packages/com.basis.mediaplayer/Native~/windows/basis_win_http.h
@@ -24,6 +24,20 @@ void  basis_win_http_abort(void* ctx);
  * 0 otherwise. Reflects the headers captured when the source was opened. */
 int   basis_win_http_is_seekable(void* ctx);
 
+/* 1 when a ranged re-request will actually be honoured: the initial GET carries a
+ * bytes=0- probe, and only a 206 answer proves the server implements ranges —
+ * Accept-Ranges alone is advertisement some servers don't back up. Stricter than
+ * is_seekable (which only drives live-vs-VOD pacing). */
+int   basis_win_http_can_reseek(void* ctx);
+
+/* Continues the stream from an absolute byte offset by issuing a ranged GET on the
+ * same connection (requires a 206 response; a server that ignores Range fails the
+ * call rather than silently restarting at 0). Only valid on a seekable body, with
+ * no basis_win_http_read concurrently in flight — park or abort the reading thread
+ * first (a prior basis_win_http_abort is fine; this opens a fresh request).
+ * Returns 0 on success; on failure reads report EOF. */
+int   basis_win_http_reseek(void* ctx, long long offset);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/Basis/Packages/com.basis.mediaplayer/Plugins/Android/arm64-v8a/libbasis_media_native.so b/Basis/Packages/com.basis.mediaplayer/Plugins/Android/arm64-v8a/libbasis_media_native.so
index 77e2297b3..4dc0bf84f 100644
Binary files a/Basis/Packages/com.basis.mediaplayer/Plugins/Android/arm64-v8a/libbasis_media_native.so and b/Basis/Packages/com.basis.mediaplayer/Plugins/Android/arm64-v8a/libbasis_media_native.so differ
diff --git a/Basis/Packages/com.basis.mediaplayer/Plugins/Windows/x86_64/basis_media_native.dll b/Basis/Packages/com.basis.mediaplayer/Plugins/Windows/x86_64/basis_media_native.dll
index a84256453..7a0fcb96b 100644
Binary files a/Basis/Packages/com.basis.mediaplayer/Plugins/Windows/x86_64/basis_media_native.dll and b/Basis/Packages/com.basis.mediaplayer/Plugins/Windows/x86_64/basis_media_native.dll differ
diff --git a/Basis/Packages/com.basis.mediaplayer/README.md b/Basis/Packages/com.basis.mediaplayer/README.md
index 84cd6d7bc..29558d1ab 100644
--- a/Basis/Packages/com.basis.mediaplayer/README.md
+++ b/Basis/Packages/com.basis.mediaplayer/README.md
@@ -19,7 +19,7 @@ VP9, no `UnityEngine.Video.MediaPlayer`.
 | `rist://`  | RIST live ingest (UDP, loss recovery + optional AES) | `rist://stream.example:5000?secret=KEY&aes-type=128` |
 | `https://…​.mp4` | fragmented MP4 over HTTPS | `https://stream.vrcdn.live/live/vrcdn.live.mp4` |
 | `https://…​.ts`  | MPEG-TS over HTTPS (Quest) | `https://stream.vrcdn.live/live/vrcdn.live.ts` |
-| `https://…​.m3u8` | HLS / Low-Latency HLS (Windows) | `https://stream.example/live/index.m3u8` |
+| `https://…​.m3u8` | HLS / Low-Latency HLS | `https://stream.example/live/index.m3u8` |
 
 The protocol/demux core (RTSP/RTP, RTMP/FLV, MPEG-TS, fMP4) is portable C; the OS
 backends only decode + present.
@@ -35,8 +35,8 @@ stream that the existing MPEG-TS / fMP4 demuxers consume. When the origin advert
 `PART-HOLD-BACK` latency (~5 s). **The ~5 s target needs an LL-HLS origin** — against
 a plain HLS origin you get its segment-bound latency, not 5 s.
 
-Runs on **Windows** (WinHTTP fetch), **clear streams**, **single rendition**.
-Android/Quest support is planned.
+Runs on **Windows** (WinHTTP fetch) and **Android/Quest** (`HttpsURLConnection`
+fetch via JNI), **clear streams**, **single rendition**.
 
 ### RIST
 
diff --git a/Basis/Packages/com.basis.mediaplayer/Runtime/BasisMediaPlayer.cs b/Basis/Packages/com.basis.mediaplayer/Runtime/BasisMediaPlayer.cs
index f22a7249f..638303cfb 100644
--- a/Basis/Packages/com.basis.mediaplayer/Runtime/BasisMediaPlayer.cs
+++ b/Basis/Packages/com.basis.mediaplayer/Runtime/BasisMediaPlayer.cs
@@ -231,6 +231,17 @@ public IBasisFrameSource Source
             try { source?.Dispose(); } catch (Exception ex) { BasisDebug.LogError($"BasisMediaPlayer source dispose failed: {ex.Message}", BasisDebug.LogTag.Video); }
             source = value;
             seekableSource = value as IBasisSeekableFrameSource;
+            // A direct assignment is a source replacement like any load: stand
+            // down in-flight resolver continuations and the LoadUrl seed, and
+            // stop reporting the previous media's metadata as current (a CPU
+            // source carries none).
+            LoadGeneration++;
+            metadataSeedGeneration = -1;
+            if (metadata != null)
+            {
+                metadata = null;
+                OnMetadataChanged?.Invoke(null);
+            }
             ResetSourceState();
             AttachSource();
             if (AutoPlayOnSourceAssigned && source != null) Play();
@@ -296,9 +307,19 @@ public BasisMediaPlayerStatus Status
         }
     }
 
-    public TimeSpan Duration => seekableSource != null && seekableSource.IsPrepared
-        ? seekableSource.Duration
-        : TimeSpan.Zero;
+    public TimeSpan Duration
+    {
+        get
+        {
+            if (seekableSource != null && seekableSource.IsPrepared) return seekableSource.Duration;
+            if (nativeEngine != null)
+            {
+                long us = nativeEngine.DurationUs;
+                if (us > 0) return TimeSpan.FromTicks(us * 10L);
+            }
+            return TimeSpan.Zero;
+        }
+    }
 
     public TimeSpan Position
     {
@@ -327,12 +348,17 @@ public TimeSpan Position
 
     // Display metadata for the current media — title/filename at minimum,
     // richer fields when an integration supplied them. Null until the first
-    // load; after that always set. See BasisMediaMetadata for the layering.
-    public BasisMediaMetadata Metadata => metadata;
-
-    // Bumped on every LoadUrl. An async resolver (the yt-dlp integration) captures this
+    // load (and after a direct CPU Source assignment, which carries none);
+    // otherwise always set. Returns a snapshot — mutating it doesn't reach the
+    // player and raises no events; push changes through ApplyMetadata instead.
+    // See BasisMediaMetadata for the layering.
+    public BasisMediaMetadata Metadata => metadata?.Clone();
+
+    // Bumped on every source replacement — LoadUrl, LoadLocalPath, LoadSource and
+    // direct Source assignment. An async resolver (the yt-dlp integration) captures this
     // before resolving and skips its LoadSource if it changed meanwhile, so a slow resolve
-    // of an earlier URL can't overwrite a newer load. Read-only to callers.
+    // of an earlier URL can't overwrite a newer load, whichever entry point the newer
+    // load came through. Read-only to callers.
     public int LoadGeneration { get; private set; }
 
     public System.Collections.Generic.IReadOnlyList<BasisBitrateTrack> BitrateTracks =>
@@ -392,7 +418,16 @@ private int ResolvedBufferMilliseconds()
     private long lastEnqueuedPtsUs;
     private BasisMediaSource activeMediaSource;
     private BasisMediaMetadata metadata;
-    private bool metadataSeededByLoadUrl;
+    // Generation whose LoadUrl seeded `metadata` and is still awaiting its
+    // LoadSource continuation; -1 when none. Keying the seed to the generation
+    // (rather than a bool) stops a seed abandoned by a resolver-less or failed
+    // load from attaching to the next unrelated one.
+    private int metadataSeedGeneration = -1;
+    // Metadata origin of the active source (the page URL a resolver started
+    // from), kept player-side so a reload of the same instance keeps its origin
+    // without the player writing state back into the caller's BasisMediaSource.
+    private string activeSourceOrigin;
+    private string activeSourceUri;
     private float sleepTimerRemainingSeconds;
     private bool sleepTimerArmed;
 
@@ -454,11 +489,15 @@ public void LoadUrl(string url)
         // what's loading even while a resolver is still working; enrichment
         // (resolver title etc.) merges in at LoadSource / ApplyMetadata.
         metadata = BasisMediaMetadata.FromUrl(url);
-        metadataSeededByLoadUrl = true;
-        OnMetadataChanged?.Invoke(metadata);
+        metadataSeedGeneration = LoadGeneration;
+        OnMetadataChanged?.Invoke(metadata.Clone());
         if (BasisMediaUrlRouter.TryResolveAndLoad(this, url)) return;
         if (!BasisMediaUrlRouter.IsDirectlyPlayable(url))
         {
+            // This load ends here: retire the seed so it can't attach to the
+            // next unrelated load. The seeded metadata itself stays visible —
+            // it still describes what was requested.
+            metadataSeedGeneration = -1;
             // A missing optional resolver is expected graceful degradation, not a fault — warn.
             // Surfaced to LastErrorMessage too so the Media Players panel can explain why nothing played.
             LastErrorMessage = "This looks like a page URL (e.g. YouTube/Twitch). Playing it needs a media URL resolver package, and none is installed.";
@@ -481,6 +520,9 @@ public void LoadLocalPath(string path)
             BasisDebug.LogWarning("BasisMediaPlayer.LoadLocalPath called with empty path.", BasisDebug.LogTag.Video);
             return;
         }
+        // Not a LoadUrl continuation — an outstanding seed belongs to some
+        // abandoned earlier load and must not become this load's origin.
+        metadataSeedGeneration = -1;
         var media = BasisMediaSource.FromLocalPath(path);
         LoadSource(media);
     }
@@ -489,14 +531,14 @@ public void LoadLocalPath(string path)
     // OnMetadataChanged — for enrichment that arrives after a load started
     // (async resolvers, playlist display names, consumer-stamped titles).
     // Applies to the CURRENT load: async callers should capture LoadGeneration
-    // before awaiting and skip the call if it changed, the same guard resolvers
-    // use for LoadSource.
+    // once the load they enrich has started (a caller's own LoadSource advances
+    // it, so capture after that returns) and skip the call if it changed.
     public void ApplyMetadata(BasisMediaMetadata partial)
     {
         if (partial == null) return;
         if (metadata == null) metadata = new BasisMediaMetadata();
         metadata.MergeFrom(partial);
-        OnMetadataChanged?.Invoke(metadata);
+        OnMetadataChanged?.Invoke(metadata.Clone());
     }
 
     public void Reload()
@@ -529,30 +571,35 @@ public void LoadSource(BasisMediaSource media)
         // Metadata keys on the ORIGIN url — the page URL a resolver started from
         // (media.Metadata.SourceUrl), else the seed a LoadUrl in flight already
         // built (a resolver's stream Uri would title as e.g. "videoplayback"),
-        // else this source's own Uri (direct LoadSource callers). Keep the
-        // existing metadata only for the load it belongs to — the seeded LoadUrl
-        // continuation or a reload of the SAME source instance (Reload(), the
-        // native auto-reconnect); a different instance rebuilds even on a
-        // matching origin so the previous load's enrichment and consumer-stamped
-        // fields don't leak into a fresh load. Source-carried enrichment then
-        // layers on top.
-        bool seeded = metadataSeededByLoadUrl;
-        metadataSeededByLoadUrl = false;
+        // else the retained origin when the SAME unmodified instance reloads
+        // (Reload(), the native auto-reconnect), else this source's own Uri
+        // (direct LoadSource callers). Keep the existing metadata only for the
+        // load it belongs to — the seeded continuation or the same-instance
+        // reload; a different instance rebuilds even on a matching origin so
+        // the previous load's enrichment and consumer-stamped fields don't leak
+        // into a fresh load. Source-carried enrichment then layers on top.
+        bool seeded = metadataSeedGeneration == LoadGeneration;
+        metadataSeedGeneration = -1;
+        // Every source replacement is a new load operation: a resolver still in
+        // flight for an earlier URL sees the generation move and stands down.
+        LoadGeneration++;
+        bool sameSource = ReferenceEquals(previousMediaSource, media) &&
+                          string.Equals(activeSourceUri, media.Uri, StringComparison.Ordinal);
         string metadataUrl = media.Metadata != null && !string.IsNullOrEmpty(media.Metadata.SourceUrl)
             ? media.Metadata.SourceUrl
-            : (seeded && metadata != null ? metadata.SourceUrl : media.Uri);
-        bool sameSourceInstance = ReferenceEquals(previousMediaSource, media);
+            : (seeded && metadata != null ? metadata.SourceUrl
+               : (sameSource && !string.IsNullOrEmpty(activeSourceOrigin) ? activeSourceOrigin : media.Uri));
         if (metadata == null ||
             !string.Equals(metadata.SourceUrl, metadataUrl, StringComparison.Ordinal) ||
-            (!seeded && !sameSourceInstance))
+            (!seeded && !sameSource))
             metadata = BasisMediaMetadata.FromUrl(metadataUrl);
         metadata.MergeFrom(media.Metadata);
-        // Persist the origin on the source itself so a later reload of the SAME
-        // instance (Reload(), the native auto-reconnect) keeps it after the
-        // one-shot LoadUrl seed has been spent.
-        if (media.Metadata == null) media.Metadata = new BasisMediaMetadata { SourceUrl = metadataUrl };
-        else if (string.IsNullOrEmpty(media.Metadata.SourceUrl)) media.Metadata.SourceUrl = metadataUrl;
-        OnMetadataChanged?.Invoke(metadata);
+        // The origin is retained player-side (not written back into the
+        // caller's source, whose descriptor stays the caller's to mutate) and
+        // is only trusted again while the instance AND its Uri are unchanged.
+        activeSourceOrigin = metadataUrl;
+        activeSourceUri = media.Uri;
+        OnMetadataChanged?.Invoke(metadata.Clone());
 
         /* not needed anymore!
         // Under Wine/Proton, Media Foundation may be missing and initializing the
@@ -830,10 +877,25 @@ public void TogglePause()
         else Pause();
     }
 
-    // Jumps to the given position. Only meaningful for seekable sources; live
-    // streaming sources throw NotSupportedException.
+    // Jumps to the given position. Only meaningful for sources with a seekable
+    // timeline (Duration > TimeSpan.Zero); live sources throw
+    // NotSupportedException. On the native path the seek is asynchronous and
+    // lands at or shortly before the target (preceding keyframe / segment
+    // boundary); OnSeekCompleted reports the requested target.
     public void Seek(TimeSpan position)
     {
+        if (position < TimeSpan.Zero) position = TimeSpan.Zero;
+        if (nativeEngine != null)
+        {
+            if (!nativeEngine.SeekUs(position.Ticks / 10L))
+            {
+                throw new NotSupportedException(
+                    "BasisMediaPlayer.Seek: the current native source has no seekable timeline (live, or an unindexed container).");
+            }
+            audioComponent?.ResetSyncAnchor();
+            OnSeekCompleted?.Invoke(position);
+            return;
+        }
         if (seekableSource == null)
         {
             throw new NotSupportedException(
@@ -1316,11 +1378,21 @@ private void DrainPendingEvents()
             runtimeIsPrepared = true;
             OnReady?.Invoke();
             // Apply any deferred BasisMediaSource start-position now that the
-            // source can actually accept a seek.
-            if (activeMediaSource != null && activeMediaSource.StartPosition > TimeSpan.Zero && seekableSource != null)
+            // source can actually accept a seek. On the native path the
+            // timeline may legitimately be absent (live) — skip silently
+            // rather than raising, since StartPosition is best-effort there
+            // (a late joiner syncing into a live stream).
+            if (activeMediaSource != null && activeMediaSource.StartPosition > TimeSpan.Zero)
             {
-                try { seekableSource.Seek(activeMediaSource.StartPosition); }
-                catch (Exception ex) { RaiseError(ex); }
+                if (seekableSource != null)
+                {
+                    try { seekableSource.Seek(activeMediaSource.StartPosition); }
+                    catch (Exception ex) { RaiseError(ex); }
+                }
+                else if (nativeEngine != null && nativeEngine.SeekUs(activeMediaSource.StartPosition.Ticks / 10L))
+                {
+                    audioComponent?.ResetSyncAnchor();
+                }
             }
         }
 
diff --git a/Basis/Packages/com.basis.mediaplayer/Runtime/BasisMediaPlayerNetworking.cs b/Basis/Packages/com.basis.mediaplayer/Runtime/BasisMediaPlayerNetworking.cs
index ad53e1e1c..e68943406 100644
--- a/Basis/Packages/com.basis.mediaplayer/Runtime/BasisMediaPlayerNetworking.cs
+++ b/Basis/Packages/com.basis.mediaplayer/Runtime/BasisMediaPlayerNetworking.cs
@@ -27,6 +27,7 @@ private enum MessageId : byte
         Seek = 5,
         RequestState = 6,
         Settings = 7,
+        Position = 8,
     }
 
     [Flags]
@@ -52,6 +53,9 @@ private enum SettingsFlags : byte
     [Tooltip("Remote clients seek to catch up when their position drifts more than this many seconds from the owner's last-broadcast position. Set to 0 to disable drift correction.")]
     [Min(0f)] public float DriftSeekThresholdSeconds = 2f;
 
+    [Tooltip("While playing seekable media, the owner broadcasts its position every this many seconds so passive clients re-converge between state events. 0 disables the heartbeat.")]
+    [Min(0f)] public float PositionHeartbeatSeconds = 5f;
+
     [Tooltip("Verbose log lines for join/leave sync, drift corrections, rejected control attempts.")]
     public bool VerboseLogging = false;
 
@@ -84,6 +88,15 @@ private enum SettingsFlags : byte
     private ushort loadNonce;
     private ushort lastAppliedLoadNonce;
     private bool syncedUrlFromSetUrl;
+    private float heartbeatTimer;
+
+    // Owner state stashed while a remote page URL resolves locally (async):
+    // applied on the resolved source's OnReady, so a late joiner lands at the
+    // owner's position instead of always starting at zero.
+    private bool pendingRemoteApply;
+    private SyncedPlaybackState pendingRemoteState;
+    private long pendingRemotePositionTicks;
+    private float pendingRemoteStashedAt;
 
     // Main-thread scratch — Unity callbacks are serial so these don't need locking.
     private readonly ushort[] singleRecipient = new ushort[1];
@@ -149,6 +162,24 @@ private void OnDisable()
         UnhookPlayerEvents();
     }
 
+    // Owner position heartbeat: a small latest-wins ping (Sequenced, like the
+    // framework's other position streams) so passive clients re-converge and a
+    // client that joined mid-resolve lands close. Only while playing seekable
+    // media — live sources have no timeline to correct against.
+    private void Update()
+    {
+        if (PositionHeartbeatSeconds <= 0f || mediaPlayer == null) return;
+        if (!HasNetworkID || !IsOwnedLocallyOnClient) return;
+        if (!mediaPlayer.IsPlaying || mediaPlayer.IsPaused) return;
+        if (mediaPlayer.Duration <= TimeSpan.Zero) return;
+        heartbeatTimer += Time.deltaTime;
+        if (heartbeatTimer < PositionHeartbeatSeconds) return;
+        heartbeatTimer = 0f;
+        seekScratch[0] = (byte)MessageId.Position;
+        WriteLong(seekScratch, 1, mediaPlayer.Position.Ticks);
+        SendCustomNetworkEvent(seekScratch, DeliveryMethod.Sequenced);
+    }
+
     public override void OnNetworkReady()
     {
         if (sendOnNetworkReady)
@@ -483,6 +514,29 @@ public override void OnNetworkMessage(ushort senderId, byte[] buffer, DeliveryMe
 
                 ApplyRemoteSettings(buffer, 1);
                 return;
+
+            case MessageId.Position:
+                if (IsOwnedLocallyOnClient)
+                {
+                    return;
+                }
+
+                if (buffer.Length < SeekPayloadSize)
+                {
+                    return;
+                }
+
+                // Drift-only: state changes ride FullState and the transport
+                // commands; the heartbeat never starts or pauses playback.
+                if (!mediaPlayer.IsPlaying || mediaPlayer.IsPaused)
+                {
+                    return;
+                }
+
+                applyingRemoteCommand = true;
+                try { MaybeCorrectDrift(ReadLong(buffer, 1)); }
+                finally { applyingRemoteCommand = false; }
+                return;
         }
     }
 
@@ -572,6 +626,7 @@ private void ApplyRemoteFullState(string url, SyncedPlaybackState state, long po
         bool loadChanged = !string.IsNullOrEmpty(url) &&
             (url != currentSyncedUrl || remoteLoadNonce != lastAppliedLoadNonce);
         applyingRemoteCommand = true;
+        pendingRemoteApply = false; /* superseded by whatever this state says */
         try
         {
             if (loadChanged)
@@ -583,11 +638,15 @@ private void ApplyRemoteFullState(string url, SyncedPlaybackState state, long po
                 // are per-client and expiring, so they can't be shared. Route it through
                 // LoadUrl so this client resolves the page URL itself. Resolution is async,
                 // so the resolved source auto-plays via the player's default
-                // AutoPlayOnSourceAssigned. The exact position/pause state isn't applied to
-                // resolved sources (the native engine exposes no absolute/forward seek), so
-                // clients stay aligned by starting together rather than catching up later.
+                // AutoPlayOnSourceAssigned; the owner's position/pause snapshot is stashed
+                // and applied on the resolved source's OnReady (aged by the resolve time),
+                // then the heartbeat refines it.
                 if (!BasisMediaUrlRouter.IsDirectlyPlayable(url))
                 {
+                    pendingRemoteState = state;
+                    pendingRemotePositionTicks = positionTicks;
+                    pendingRemoteStashedAt = Time.realtimeSinceStartup;
+                    pendingRemoteApply = true;
                     mediaPlayer.LoadUrl(url);
                     return;
                 }
@@ -656,6 +715,40 @@ private void ApplyRemoteFullState(string url, SyncedPlaybackState state, long po
         }
     }
 
+    private void ApplyPendingRemoteState()
+    {
+        applyingRemoteCommand = true;
+        try
+        {
+            if (pendingRemoteState == SyncedPlaybackState.Stopped)
+            {
+                if (mediaPlayer.IsPlaying) mediaPlayer.Stop();
+                return;
+            }
+
+            if (pendingRemoteState == SyncedPlaybackState.Paused && !mediaPlayer.IsPaused)
+            {
+                mediaPlayer.Pause();
+            }
+
+            if (pendingRemotePositionTicks > 0)
+            {
+                // The owner's snapshot aged while this client resolved; advance
+                // it by the elapsed time when the owner was playing. The
+                // heartbeat corrects the residual.
+                long ticks = pendingRemotePositionTicks;
+                if (pendingRemoteState == SyncedPlaybackState.Playing)
+                    ticks += (long)((Time.realtimeSinceStartup - pendingRemoteStashedAt) * TimeSpan.TicksPerSecond);
+                try { mediaPlayer.Seek(TimeSpan.FromTicks(ticks)); }
+                catch (NotSupportedException) { /* resolved to a live/unindexed source */ }
+            }
+        }
+        finally
+        {
+            applyingRemoteCommand = false;
+        }
+    }
+
     private void MaybeCorrectDrift(long positionTicks)
     {
         if (DriftSeekThresholdSeconds <= 0f)
@@ -722,6 +815,14 @@ private void UnhookPlayerEvents()
 
     private void HandleLocalReady()
     {
+        // A remote page URL finished resolving locally: apply the owner state
+        // that arrived with it. Runs on non-owner clients only — owners drive.
+        if (pendingRemoteApply && !IsOwnedLocallyOnClient)
+        {
+            pendingRemoteApply = false;
+            ApplyPendingRemoteState();
+        }
+
         if (applyingRemoteCommand)
         {
             return;
diff --git a/Basis/Packages/com.basis.mediaplayer/Runtime/Core/BasisMediaMetadata.cs b/Basis/Packages/com.basis.mediaplayer/Runtime/Core/BasisMediaMetadata.cs
new file mode 100644
index 000000000..56acea990
--- /dev/null
+++ b/Basis/Packages/com.basis.mediaplayer/Runtime/Core/BasisMediaMetadata.cs
@@ -0,0 +1,99 @@
+using System;
+
+// Descriptive metadata for the loaded media — the display-facing answer to
+// "what's playing". Two layers:
+//
+//   1. URL-derived defaults, built by the player at every load (FromUrl): the
+//      source URL, a filename when the URL path names one, and a Title fallback
+//      chain (filename without extension -> last path segment -> host). Works
+//      on every platform with no resolver package installed.
+//   2. Enrichment pushed by whoever knows more: a resolver sets the real
+//      Title/Uploader/ThumbnailUrl/Duration on BasisMediaSource.Metadata before
+//      LoadSource, or anyone calls BasisMediaPlayer.ApplyMetadata after.
+//
+// Consumers read BasisMediaPlayer.Metadata and subscribe to OnMetadataChanged.
+public sealed class BasisMediaMetadata
+{
+    // The URL as handed to the player — the input/page URL for resolved media,
+    // not the per-client stream endpoint. Matches what networking syncs, so
+    // every client derives identical defaults.
+    public string SourceUrl;
+
+    // Decoded final path segment of the source URL when it names a file
+    // ("video%20name.mp4" -> "video name.mp4"); null for extensionless sources
+    // (live transport paths, page URLs).
+    public string FileName;
+
+    // Display name. Never null once a load has started: enrichment title, else
+    // FileName without its extension, else the last URL path segment, else the
+    // host.
+    public string Title;
+
+    // Enrichment-only fields — null unless an integration supplied them.
+    public string Uploader;
+    public string ThumbnailUrl;
+    public TimeSpan? Duration;
+
+    // Which layer supplied the richest data: "url" for the built-in derivation;
+    // integrations stamp their own tag (e.g. "ytdlp").
+    public string Provider;
+
+    // Longest extension still treated as a filename suffix (".m3u8" = 4); keeps
+    // a dotted final segment like "v2.1-launch-party" reading as a title.
+    private const int MaxExtensionLength = 5;
+
+    // Layer 1: derive defaults from the URL alone. Never returns null.
+    public static BasisMediaMetadata FromUrl(string url)
+    {
+        var meta = new BasisMediaMetadata { SourceUrl = url, Provider = "url" };
+        string last = null, host = null;
+        if (Uri.TryCreate(url, UriKind.Absolute, out Uri parsed))
+        {
+            host = parsed.Host;
+            string path = parsed.AbsolutePath;
+            int slash = path.LastIndexOf('/');
+            last = slash >= 0 ? path.Substring(slash + 1) : path;
+            try { last = Uri.UnescapeDataString(last); }
+            catch (UriFormatException) { /* keep the escaped form */ }
+        }
+        if (!string.IsNullOrEmpty(last))
+        {
+            int dot = last.LastIndexOf('.');
+            if (dot > 0 && dot < last.Length - 1 && last.Length - dot - 1 <= MaxExtensionLength)
+            {
+                meta.FileName = last;
+                meta.Title = last.Substring(0, dot);
+            }
+            else
+            {
+                meta.Title = last;
+            }
+        }
+        if (string.IsNullOrEmpty(meta.Title))
+        {
+            // url can be null/unparseable here (a bare BasisMediaSource handed
+            // straight to LoadSource); keep the never-null Title guarantee.
+            meta.Title = !string.IsNullOrEmpty(host) ? host : (url ?? string.Empty);
+        }
+        return meta;
+    }
+
+    // Field-level snapshot. The player hands these out so external code can't
+    // silently mutate its live metadata (which would bypass OnMetadataChanged
+    // and the reload-origin comparisons); ApplyMetadata is the mutation path.
+    public BasisMediaMetadata Clone() => (BasisMediaMetadata)MemberwiseClone();
+
+    // Copies other's non-null/non-empty fields over this instance, leaving the
+    // rest in place — layers enrichment over the URL-derived defaults.
+    public void MergeFrom(BasisMediaMetadata other)
+    {
+        if (other == null) return;
+        if (!string.IsNullOrEmpty(other.SourceUrl)) SourceUrl = other.SourceUrl;
+        if (!string.IsNullOrEmpty(other.FileName)) FileName = other.FileName;
+        if (!string.IsNullOrEmpty(other.Title)) Title = other.Title;
+        if (!string.IsNullOrEmpty(other.Uploader)) Uploader = other.Uploader;
+        if (!string.IsNullOrEmpty(other.ThumbnailUrl)) ThumbnailUrl = other.ThumbnailUrl;
+        if (other.Duration.HasValue) Duration = other.Duration;
+        if (!string.IsNullOrEmpty(other.Provider)) Provider = other.Provider;
+    }
+}
diff --git a/Basis/Packages/com.basis.mediaplayer/Runtime/Core/BasisMediaMetadata.cs.meta b/Basis/Packages/com.basis.mediaplayer/Runtime/Core/BasisMediaMetadata.cs.meta
new file mode 100644
index 000000000..18c431c20
--- /dev/null
+++ b/Basis/Packages/com.basis.mediaplayer/Runtime/Core/BasisMediaMetadata.cs.meta
@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: a0cfc165baa24373b8c92ad189f20a3e
diff --git a/Basis/Packages/com.basis.mediaplayer/Runtime/Examples/BasisMediaPlayerPlaylist.cs b/Basis/Packages/com.basis.mediaplayer/Runtime/Examples/BasisMediaPlayerPlaylist.cs
new file mode 100644
index 000000000..2b6cf0d8f
--- /dev/null
+++ b/Basis/Packages/com.basis.mediaplayer/Runtime/Examples/BasisMediaPlayerPlaylist.cs
@@ -0,0 +1,161 @@
+using System;
+using System.Collections.Generic;
+using UnityEngine;
+
+// One playlist entry: a URL (page or direct — it loads through the player's
+// normal routing) and an optional display name, shown until a richer title
+// arrives at load time.
+[Serializable]
+public sealed class BasisMediaPlaylistEntry
+{
+    public string Url;
+    public string DisplayName;
+}
+
+// How the playlist advances when the current entry finishes (OnEnded).
+public enum BasisMediaPlaylistAdvance
+{
+    None = 0,        // never auto-advance; PlayAt/Next/Previous only
+    Sequential = 1,  // advance to the next entry, stop after the last
+    LoopAll = 2,     // advance and wrap back to the first entry
+}
+
+// Ordered play queue driving a BasisMediaPlayer. Purely orchestration: each
+// entry loads through the player's normal path (resolver steering, security
+// gates), so metadata and networking behave exactly as for a manual load.
+//
+// Networked players: entry changes route through the sibling
+// BasisMediaPlayerNetworking (SetUrl), so the existing URL sync carries every
+// change to remote clients — the playlist itself is not networked and only the
+// controlling client needs it populated. Auto-advance runs only on the owning
+// client (every client sees OnEnded; one authority picks the next entry).
+// Live entries never end, so they never auto-advance.
+[DisallowMultipleComponent]
+public class BasisMediaPlayerPlaylist : MonoBehaviour
+{
+    [Tooltip("Player this playlist drives. Defaults to a BasisMediaPlayer on the same GameObject.")]
+    public BasisMediaPlayer Player;
+
+    [Tooltip("Entries in play order. Page URLs resolve per-client exactly like a manual load.")]
+    public List<BasisMediaPlaylistEntry> Entries = new List<BasisMediaPlaylistEntry>();
+
+    [Tooltip("Advance policy when the current entry ends.")]
+    public BasisMediaPlaylistAdvance Advance = BasisMediaPlaylistAdvance.Sequential;
+
+    [Tooltip("If true, the first entry loads on Start (locally, like BasisMediaPlayerStreaming's ConfigureOnStart; networking settles who wins). When a playlist drives the player, disable BasisMediaPlayerStreaming's ConfigureOnStart or both will load a source on start.")]
+    public bool PlayOnStart = true;
+
+    // Index of the entry this playlist last loaded; -1 = nothing loaded from
+    // the playlist yet. Not reset by direct loads made outside the playlist.
+    public int CurrentIndex = -1;
+
+    // Raised after the playlist starts loading an entry (index into Entries).
+    public event Action<int> OnEntryChanged;
+
+    private BasisMediaPlayerNetworking networking;
+
+    private void Awake()
+    {
+        if (Player == null) TryGetComponent(out Player);
+        if (Player != null) Player.TryGetComponent(out networking);
+    }
+
+    private void OnEnable()
+    {
+        if (Player != null) Player.OnEnded += HandleEnded;
+    }
+
+    private void OnDisable()
+    {
+        if (Player != null) Player.OnEnded -= HandleEnded;
+    }
+
+    private void Start()
+    {
+        if (!PlayOnStart || CurrentIndex >= 0) return;
+        if (Entries == null || Entries.Count == 0) return;
+        // Local load, not SetUrl: every client starting the same entry is the
+        // same shape as BasisMediaPlayerStreaming's ConfigureOnStart, and the
+        // networking late-join/full-state flow settles who wins.
+        LoadEntry(0, viaNetworking: false);
+    }
+
+    public void PlayAt(int index) => LoadEntry(index, viaNetworking: true);
+
+    private void LoadEntry(int index, bool viaNetworking)
+    {
+        if (Player == null)
+        {
+            BasisDebug.LogWarning("BasisMediaPlayerPlaylist has no BasisMediaPlayer to drive.", BasisDebug.LogTag.Video);
+            return;
+        }
+        if (Entries == null || index < 0 || index >= Entries.Count) return;
+        // A client that can't take control couldn't load the entry anyway;
+        // bail before touching CurrentIndex so the local cursor stays honest.
+        if (viaNetworking && networking != null && !networking.CanLocallyControl) return;
+        BasisMediaPlaylistEntry entry = Entries[index];
+        if (entry == null || string.IsNullOrWhiteSpace(entry.Url)) return;
+
+        CurrentIndex = index;
+        if (viaNetworking && networking != null)
+        {
+            // Acquires control (ownership permitting); remote clients follow the URL sync.
+            _ = networking.SetUrl(entry.Url);
+        }
+        else
+        {
+            Player.LoadUrl(entry.Url);
+        }
+        // Layer the authored name over the URL-derived defaults LoadUrl just
+        // seeded; a resolver's richer title still lands on top later.
+        if (!string.IsNullOrEmpty(entry.DisplayName))
+        {
+            Player.ApplyMetadata(new BasisMediaMetadata { Title = entry.DisplayName });
+        }
+        OnEntryChanged?.Invoke(index);
+    }
+
+    // Manual navigation wraps at both ends regardless of the Advance policy.
+    public void Next()
+    {
+        int count = Entries != null ? Entries.Count : 0;
+        if (count == 0) return;
+        PlayAt(CurrentIndex < 0 ? 0 : (CurrentIndex + 1) % count);
+    }
+
+    public void Previous()
+    {
+        int count = Entries != null ? Entries.Count : 0;
+        if (count == 0) return;
+        PlayAt(CurrentIndex <= 0 ? count - 1 : CurrentIndex - 1);
+    }
+
+    private void HandleEnded()
+    {
+        if (Advance == BasisMediaPlaylistAdvance.None) return;
+        if (CurrentIndex < 0) return; // the current media didn't come from this playlist
+        // Every client sees OnEnded; only the owning client advances, and its
+        // SetUrl carries the change to everyone else.
+        if (networking != null && networking.HasNetworkID && !networking.IsOwnedLocallyOnClient) return;
+        int count = Entries != null ? Entries.Count : 0;
+        if (count == 0) return;
+        // Scan past blank/invalid entries rather than stalling on one: LoadEntry
+        // ignores them without moving CurrentIndex, so retrying the same index
+        // every OnEnded would wedge the playlist.
+        for (int step = 1; step <= count; step++)
+        {
+            int next = CurrentIndex + step;
+            if (next >= count)
+            {
+                if (Advance != BasisMediaPlaylistAdvance.LoopAll) return;
+                next -= count;
+            }
+            BasisMediaPlaylistEntry entry = Entries[next];
+            if (entry != null && !string.IsNullOrWhiteSpace(entry.Url))
+            {
+                PlayAt(next);
+                return;
+            }
+        }
+    }
+}
diff --git a/Basis/Packages/com.basis.mediaplayer/Runtime/Examples/BasisMediaPlayerPlaylist.cs.meta b/Basis/Packages/com.basis.mediaplayer/Runtime/Examples/BasisMediaPlayerPlaylist.cs.meta
new file mode 100644
index 000000000..289a9b42e
--- /dev/null
+++ b/Basis/Packages/com.basis.mediaplayer/Runtime/Examples/BasisMediaPlayerPlaylist.cs.meta
@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: 5181337f8a1e4204b2dfbf95852d0794
diff --git a/Basis/Packages/com.basis.mediaplayer/Runtime/Native/BasisNativeMedia.cs b/Basis/Packages/com.basis.mediaplayer/Runtime/Native/BasisNativeMedia.cs
index 96622e822..dab05b2e9 100644
--- a/Basis/Packages/com.basis.mediaplayer/Runtime/Native/BasisNativeMedia.cs
+++ b/Basis/Packages/com.basis.mediaplayer/Runtime/Native/BasisNativeMedia.cs
@@ -63,6 +63,12 @@ private static extern IntPtr basis_media_open_dual(
     [DllImport(Lib, CallingConvention = CallingConvention.StdCall)]
     private static extern long basis_media_get_position_us(IntPtr engine);
 
+    [DllImport(Lib, CallingConvention = CallingConvention.StdCall)]
+    private static extern long basis_media_get_duration_us(IntPtr engine);
+
+    [DllImport(Lib, CallingConvention = CallingConvention.StdCall)]
+    private static extern int basis_media_seek_us(IntPtr engine, long targetUs);
+
     [DllImport(Lib, CallingConvention = CallingConvention.StdCall)]
     private static extern int basis_media_get_last_error(IntPtr engine, byte[] buf, int bufSize);
 
@@ -191,6 +197,24 @@ public static int GetFrameOrigin(IntPtr e)
 
     public static long GetPositionUs(IntPtr e) => e == IntPtr.Zero ? -1 : basis_media_get_position_us(e);
 
+    // 0 = unknown/live (also the "no seekable timeline" signal). Old native
+    // libraries without the export read as 0 — same as a live source.
+    public static long GetDurationUs(IntPtr e)
+    {
+        if (e == IntPtr.Zero) return 0;
+        try { return basis_media_get_duration_us(e); }
+        catch (EntryPointNotFoundException) { return 0; }
+    }
+
+    // Asynchronous: the demuxer repositions at its next sample boundary and
+    // playback resumes from the preceding keyframe / segment boundary.
+    public static bool SeekUs(IntPtr e, long targetUs)
+    {
+        if (e == IntPtr.Zero) return false;
+        try { return basis_media_seek_us(e, targetUs) == 0; }
+        catch (EntryPointNotFoundException) { return false; }
+    }
+
     public static string GetLastError(IntPtr e)
     {
         if (e == IntPtr.Zero) return null;
diff --git a/Basis/Packages/com.basis.mediaplayer/Runtime/Native/BasisNativeVideoSource.cs b/Basis/Packages/com.basis.mediaplayer/Runtime/Native/BasisNativeVideoSource.cs
index 11e62d203..62a2e308d 100644
--- a/Basis/Packages/com.basis.mediaplayer/Runtime/Native/BasisNativeVideoSource.cs
+++ b/Basis/Packages/com.basis.mediaplayer/Runtime/Native/BasisNativeVideoSource.cs
@@ -75,6 +75,15 @@ public sealed class BasisNativeVideoSource : IBasisPcmSource, IDisposable
     // PTS (microseconds) of the most recently published frame; -1 until known.
     public long PositionUs => BasisNativeMedia.GetPositionUs(handle);
 
+    // Total media duration (microseconds) once the container index has been
+    // parsed; 0 for live/unknown — 0 also means the source can't seek.
+    public long DurationUs => BasisNativeMedia.GetDurationUs(handle);
+
+    // Requests an asynchronous absolute seek; lands at or shortly before the
+    // target (preceding keyframe / segment boundary). False when the source
+    // has no seekable timeline.
+    public bool SeekUs(long targetUs) => BasisNativeMedia.SeekUs(handle, targetUs);
+
     // One-line native counter string (blit/copy/lag/buf/nodue/acq/audio). For the
     // debug window / diagnostics.
     public string DebugInfo => handle != IntPtr.Zero ? BasisNativeMedia.GetDebug(handle) : null;
diff --git a/Basis/Packages/com.basis.mediaplayer/Runtime/UI/BasisMediaPlayerPanelProvider.cs b/Basis/Packages/com.basis.mediaplayer/Runtime/UI/BasisMediaPlayerPanelProvider.cs
index 8c68a0a7b..d807314aa 100644
--- a/Basis/Packages/com.basis.mediaplayer/Runtime/UI/BasisMediaPlayerPanelProvider.cs
+++ b/Basis/Packages/com.basis.mediaplayer/Runtime/UI/BasisMediaPlayerPanelProvider.cs
@@ -30,6 +30,17 @@ public class BasisMediaPlayerPanelProvider : BasisMenuActionProvider<BasisMainMe
         private PanelElementDescriptor _debugGroup;
         private PanelToggle _debugToggle;
         private PanelTextField _urlField;
+        private PanelSlider _seekSlider;
+        private float _seekPendingAt = -1f;   /* unscaled time of the last handle move; <0 = none */
+        private float _seekPendingPct;
+        private bool _drivingSeekSlider;      /* our write, not the user's drag */
+        private double _seekAwaitPosS;        /* issued seek target, held until position lands */
+        private float _seekAwaitUntil = -1f;
+        private const float SeekDebounceSeconds = 0.35f;
+        private int _lastPosSec = -1;
+        private int _lastDurSec = -1;
+        private string _metaTitle;
+        private string _metaUploader;
         private PanelSlider _volumeSlider;
         private PanelToggle _captionsToggle;
         private PanelSlider _captionTextOpacitySlider;
@@ -158,6 +169,13 @@ private void OnPanelClosed()
             _debugGroup = null;
             _debugToggle = null;
             _urlField = null;
+            _seekSlider = null;
+            _seekPendingAt = -1f;
+            _seekAwaitUntil = -1f;
+            _lastPosSec = -1;
+            _lastDurSec = -1;
+            _metaTitle = null;
+            _metaUploader = null;
             _volumeSlider = null;
             _captionsToggle = null;
             _captionTextOpacitySlider = null;
@@ -229,6 +247,27 @@ private void BuildControlGroup(RectTransform parent)
                 else _activePlayer.Stop();
             };
 
+            // Timeline scrubber — visible only for media with a seekable
+            // timeline (Duration > 0). The slider has no drag events, so the
+            // seek is issued once the handle rests (debounced in RefreshSeekBar,
+            // which also keeps its hands off the knob while a drag is pending).
+            // Playback drives it through SliderComponent.value — the same path
+            // dragging uses — with _drivingSeekSlider distinguishing our writes
+            // from the user's.
+            _seekSlider = PanelSlider.CreateNew(content);
+            _seekSlider.SetSliderSettings(PanelSlider.SliderSettings.Advanced(
+                "Position", 0f, 100f, false, 0, ValueDisplayMode.Percentage));
+            // uGUI's own event, not the panel Action (which only fires on
+            // release): every drag move must re-arm the debounce, or the
+            // per-tick playhead writes would snap the handle away mid-drag.
+            _seekSlider.SliderComponent.onValueChanged.AddListener(v =>
+            {
+                if (_activePlayer == null || _drivingSeekSlider) return;
+                _seekPendingPct = v;
+                _seekPendingAt = Time.unscaledTime;
+            });
+            _seekSlider.gameObject.SetActive(false);
+
             _bitrateDropdown = PanelDropdown.CreateNewEntry(content);
             _bitrateDropdown.Descriptor.SetTitle("Bitrate");
             _bitrateDropdown.OnValueChanged = _ =>
@@ -369,6 +408,8 @@ private void SubscribeToActivePlayer()
             if (_activePlayer == null) return;
             _activePlayer.OnBitrateTrackChanged += HandleActiveBitrateChanged;
             _activePlayer.OnAudioTrackChanged += HandleActiveAudioTrackChanged;
+            _activePlayer.OnMetadataChanged += HandleActiveMetadataChanged;
+            HandleActiveMetadataChanged(_activePlayer.Metadata);
         }
 
         private void UnsubscribeFromActivePlayer()
@@ -376,13 +417,23 @@ private void UnsubscribeFromActivePlayer()
             if (_activePlayer == null) return;
             _activePlayer.OnBitrateTrackChanged -= HandleActiveBitrateChanged;
             _activePlayer.OnAudioTrackChanged -= HandleActiveAudioTrackChanged;
+            _activePlayer.OnMetadataChanged -= HandleActiveMetadataChanged;
         }
 
         private void HandleActiveBitrateChanged(BasisBitrateTrack _) => RebuildBitrateDropdown();
         private void HandleActiveAudioTrackChanged(BasisAudioTrack _) => RebuildAudioTrackDropdown();
 
+        private void HandleActiveMetadataChanged(BasisMediaMetadata meta)
+        {
+            _metaTitle = meta?.Title;
+            _metaUploader = meta?.Uploader;
+            _lastStatusMarkup = null;   /* force the next status repaint */
+        }
+
         private void ApplyActivePlayerToControls()
         {
+            _seekPendingAt = -1f;   /* a drag on the previous player dies with it */
+            _seekAwaitUntil = -1f;
             bool canControl = HasControlPermission();
             _controlGroup?.SetActive(canControl);
             _userGroup?.SetActive(true);
@@ -613,9 +664,92 @@ private void SetPanelTickSubscription(bool subscribe)
         private void OnPanelTick()
         {
             RefreshStatus();
+            RefreshSeekBar();
             if (_debugMode) RefreshDebugInfo();
         }
 
+        // Keeps the scrubber in step with playback, hides it for timeline-less
+        // media, and fires a debounced seek once the user's drag comes to rest.
+        private void RefreshSeekBar()
+        {
+            if (_seekSlider == null || _activePlayer == null) return;
+
+            double durS = _activePlayer.Duration.TotalSeconds;
+            bool seekable = durS > 0.5 && HasControlPermission();
+            if (_seekSlider.gameObject.activeSelf != seekable)
+            {
+                _seekSlider.gameObject.SetActive(seekable);
+                _controlGroup?.ForceRebuild();
+            }
+            if (!seekable)
+            {
+                _seekPendingAt = -1f;
+                return;
+            }
+
+            if (_seekPendingAt >= 0f)
+            {
+                if (Time.unscaledTime - _seekPendingAt < SeekDebounceSeconds) return; /* still dragging */
+                _seekPendingAt = -1f;
+                double targetS = Mathf.Clamp(_seekPendingPct, 0f, 100f) / 100.0 * durS;
+                var target = System.TimeSpan.FromSeconds(targetS);
+                if (_activeNetworking != null) _ = _activeNetworking.Seek(target);
+                else
+                {
+                    try { _activePlayer.Seek(target); }
+                    catch (System.NotSupportedException) { }
+                }
+                // The native seek is asynchronous: hold the handle at the target
+                // until the reported position lands nearby (or give up after a
+                // refetch-worth of time), instead of tweening back to the old
+                // playhead and forward again.
+                _seekAwaitPosS = targetS;
+                _seekAwaitUntil = Time.unscaledTime + 6f;
+                return;
+            }
+
+            double posS = _activePlayer.Position.TotalSeconds;
+            if (_seekAwaitUntil > 0f)
+            {
+                bool landed = System.Math.Abs(posS - _seekAwaitPosS) < 4.0; /* keyframe granularity */
+                if (!landed && Time.unscaledTime < _seekAwaitUntil)
+                {
+                    posS = _seekAwaitPosS;
+                }
+                else
+                {
+                    _seekAwaitUntil = -1f;
+                }
+            }
+            float pct = Mathf.Clamp((float)(posS / durS * 100.0), 0f, 100f);
+            if (_seekSlider.SliderComponent != null &&
+                Mathf.Abs(_seekSlider.SliderComponent.value - pct) > 0.25f)
+            {
+                // Drive through the same uGUI path a drag takes, so the handle
+                // and fill visuals always follow; the flag keeps our writes
+                // from arming the seek debounce. Quarter-percent gate: no tween
+                // and label churn from sub-pixel moves every frame.
+                _drivingSeekSlider = true;
+                _seekSlider.SliderComponent.value = pct;
+                _drivingSeekSlider = false;
+            }
+        }
+
+        // TMP's <noparse> is not nestable: an embedded </noparse> in player- or
+        // remote-supplied text (titles ride the networking layer; error strings
+        // echo URLs) terminates the block and the remainder parses as rich text
+        // again — markup injection into the Status line. Breaking every '<' with
+        // a zero-width space renders identically and keeps any tag inert.
+        private static string SanitizeForMarkup(string s) =>
+            string.IsNullOrEmpty(s) ? s : s.Replace("<", "<\u200B");
+
+        private static string FormatTime(int totalSeconds)
+        {
+            if (totalSeconds < 0) totalSeconds = 0;
+            int h = totalSeconds / 3600, m = (totalSeconds % 3600) / 60, s = totalSeconds % 60;
+            return h > 0 ? $"{h}:{m:00}:{s:00}" : $"{m}:{s:00}";
+        }
+
         // Builds the always-visible status line for the selected player: a colored
         // state word, a resolution detail, and the error/issue text when present.
         // Markup is code-assembled (trusted) but any player-supplied text (error
@@ -627,23 +761,42 @@ private void RefreshStatus()
             BasisMediaPlayerStatus status = _activePlayer.Status;
             string err = _activePlayer.LastErrorMessage;
             Vector2Int size = _activePlayer.VideoSize;
+            int posSec = (int)_activePlayer.Position.TotalSeconds;
+            int durSec = (int)_activePlayer.Duration.TotalSeconds;
+            if (durSec <= 0) posSec = -1;   /* no timeline: keep the gate quiet */
 
             // Cheap gate: rebuild the markup only when something observable changed, so
-            // a steady-state video doesn't allocate a string every frame. LastErrorMessage
-            // returns a stable reference between changes, so ReferenceEquals is enough.
-            if (status == _lastStatus && size == _lastStatusSize && ReferenceEquals(err, _lastStatusErr)) return;
+            // a steady-state video doesn't allocate a string every frame (the time line
+            // ticks it once per second while a timeline is showing). LastErrorMessage
+            // returns a stable reference between changes, so ReferenceEquals is enough;
+            // metadata changes clear _lastStatusMarkup instead.
+            if (status == _lastStatus && size == _lastStatusSize && ReferenceEquals(err, _lastStatusErr) &&
+                posSec == _lastPosSec && durSec == _lastDurSec && _lastStatusMarkup != null) return;
             _lastStatus = status;
             _lastStatusSize = size;
             _lastStatusErr = err;
+            _lastPosSec = posSec;
+            _lastDurSec = durSec;
 
             _statusBuilder.Clear();
             _statusBuilder.Append("<color=").Append(StatusColorHex(status)).Append("><b>")
                 .Append(StatusLabel(status)).Append("</b></color>");
+            if (durSec > 0)
+                _statusBuilder.Append("  <color=#9AA0A6>").Append(FormatTime(posSec))
+                    .Append(" / ").Append(FormatTime(durSec)).Append("</color>");
+
+            // What's playing, per the player's metadata (URL-derived defaults,
+            // resolver/playlist enrichment when present). Player-supplied text
+            // is sanitized AND wrapped in <noparse>, like the error strings below.
+            if (!string.IsNullOrEmpty(_metaTitle))
+                _statusBuilder.Append("\n<b><noparse>").Append(SanitizeForMarkup(_metaTitle)).Append("</noparse></b>");
+            if (!string.IsNullOrEmpty(_metaUploader))
+                _statusBuilder.Append("\n<color=#9AA0A6><noparse>").Append(SanitizeForMarkup(_metaUploader)).Append("</noparse></color>");
 
             if (status == BasisMediaPlayerStatus.Error)
             {
                 if (!string.IsNullOrEmpty(err))
-                    _statusBuilder.Append("\n<color=#E5534B><noparse>").Append(err).Append("</noparse></color>");
+                    _statusBuilder.Append("\n<color=#E5534B><noparse>").Append(SanitizeForMarkup(err)).Append("</noparse></color>");
             }
             else
             {
@@ -654,7 +807,7 @@ private void RefreshStatus()
                 // video still plays, so the state word stays accurate and this is
                 // surfaced as a separate amber note.
                 if (!string.IsNullOrEmpty(err))
-                    _statusBuilder.Append("\n<color=#E6C15A>Issue: <noparse>").Append(err).Append("</noparse></color>");
+                    _statusBuilder.Append("\n<color=#E6C15A>Issue: <noparse>").Append(SanitizeForMarkup(err)).Append("</noparse></color>");
             }
 
             string markup = _statusBuilder.ToString();