[Streaming][P0] Pipeline DAV2 startup for sub-2-second first sound

[knzeng-e]

Goal

Reduce click-to-first-sound for free and already-authorized protected tracks to a production-grade budget without weakening content-key boundaries.

Scope

• Instrument gateway selection, key authorization, DAV2 header fetch, first range, decrypt, append, metadata ready, and first audio.
• Add bounded gateway timeouts and hedged requests for the header/first chunk.
• Cache the winning gateway per CID and session.
• Evaluate a 128–256 KB first chunk followed by larger steady-state chunks.
• Pipeline range fetch, decryption, and SourceBuffer append with two- or three-chunk read-ahead.
• Move chunk decryption to a Web Worker.
• Prefetch the header and first authorized chunk on intent signals such as hover, viewport entry, or room creation.
• Remove duplicate frontend/backend access checks from the critical path: the key service should return the authoritative access decision and temporary key/grant for playback.
• Preserve a fail-closed full-download fallback only for unsupported MSE/browser combinations.
• Build a browser/device validation matrix for Chrome, Safari, Firefox, iOS, and Android.

Performance budgets

• Free track click-to-first-sound p75 < 1.5 s.
• Authorized protected track p75 < 2 s when no fresh signature is required.
• Warm next-track transition p75 < 700 ms.
• MSE-to-full-decrypt fallback rate < 1% on supported browsers.

Acceptance criteria

• Startup phase metrics are exported to frontend telemetry.
• Gateway stalls cannot block playback indefinitely.
• Downloads and decryptions overlap instead of running as a strictly sequential loop.
• Playback remains host-access based for rooms.
• Security and codec assumptions are documented.

Follow-up

Design DAV3 only after DAV2 metrics show the remaining bottleneck. A likely DAV3 direction is normalized fragmented MP4/AAC plus optional WebM/Opus variants with independently encrypted media segments.