fix(orchestrator): release a station's redirect targets in media-src

Deutschlandfunk stayed silent: its signed URL answers 302 to
f111.rndfnk.com, an origin the signed media-src never listed, so the
browser blocked the redirected load and reported only the station's own
URL in securitypolicyviolation.

The hub now resolves each https stream's redirect chain server side when
a settings save adds or changes it and stores the extra origins as the
stream's via list. media-src lists them next to the signed origins. A CDN
host of three or more labels widens to its siblings (*.rndfnk.com); an
IP, a two-label host and a name under a country code's generic second
level stay exact.

Hardening:

- Only the signed URL itself may lie at a non-global address; every
  redirect hop dials a global address only, checked on the address
  actually dialed (NAT64 and IPv4-compatible IPv6 count by the embedded
  IPv4 address).
- A resolve answers within three socket timeouts even for a server that
  drips its headers; a late probe goes on in a daemon thread and a url
  still in flight is not probed twice.
- A failed resolution stores via null and retries on a save ten minutes
  later; the radio page says so instead of blaming the CSP.
- A save whose settings changed while it was resolved fails instead of
  overwriting them (compare and set under the settings lock).
- A new stream URL at an already signed origin takes the passkey too.
- Settings written before via existed load as via [] and never dial.

Residuals:

- The passkey proof is spent before the resolve, so a save racing
  another one fails and the operator signs again.
- A save that hits a due retry blocks up to twelve seconds and may
  reload the page.
- A page loaded before the upgrade throws on the missing via until it
  reloads.
- A private multi-tenant suffix such as github.io still widens.
- getaddrinfo has no timeout; it runs inside the daemon thread.

Operator step after install: remove Deutschlandfunk in Radio, Sender
bearbeiten, save, add it again and save with the passkey.

🎯 Fix: 92 %
💥 Break: 4 %
💸 Cost: 100 %
⏱️ Time: –
🛡️ Security: 100 %
🏆 Score: 88
🚦 Gate: ✅ 90/5, cost and time <= 100, security 100 %

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

orchestrator/templates/ambience.js

@@ -8,6 +8,8 @@ const Ambience = (() => {
   const GLASS = 0.8;
   const CARD = 0.92;
   const LIGHT_FROM = 4;
+  // Trip-wire: one blocked redirect also fails the media element and rejects play(), in no fixed order; the highest rank is the cause, the rest are its symptoms.
+  const TROUBLE_RANKS = {refused: 0, media: 1, csp: 2};
   const SKY = [
     [-90, "#03050b", "#070a14"],
     [-18, "#04060e", "#0a0f1f"],
@@ -209,7 +211,17 @@ const Ambience = (() => {
     return streams.find((stream) => stream.on && covers(stream, slot)) || null;
   }
 
-  return {GLASS, CARD, SKY, THEMES, julian, sidereal, horizontal, sun, moon, hex, mix, css, luminance, contrast, skyAt, stage, starlight, modeAt, modeOf, stars, slotOf, activeStream};
+  function stationOrigins(stream) {
+    return [new URL(stream.url).origin, ...(stream.via || [])];
+  }
+
+  function retold(told, url, kind, cause) {
+    const key = `${url}|${kind}`;
+    const rank = TROUBLE_RANKS[cause];
+    return !told || told.key !== key || rank > told.rank ? {key, rank} : null;
+  }
+
+  return {GLASS, CARD, SKY, THEMES, julian, sidereal, horizontal, sun, moon, hex, mix, css, luminance, contrast, skyAt, stage, starlight, modeAt, modeOf, stars, slotOf, activeStream, stationOrigins, retold};
 })();
 if (typeof module === "object" && module.exports) {
   module.exports = Ambience;

orchestrator/templates/page-dom.js

@@ -89,6 +89,7 @@
     box.addEventListener("click", () => box.remove());
     document.getElementById("toasts").append(box);
     window.setTimeout(() => box.remove(), good ? 9000 : 20000);
+    return box;
   }
 
   function runLines(data) {

orchestrator/templates/page-radio.js

@@ -3,6 +3,7 @@
     NotSupportedError: ["error", "nicht abspielbar", "Nicht abspielbar: der Browser versteht Format oder Adresse nicht, oder der Sender leitet auf eine Adresse um, von der die Seite keinen Ton laden darf."],
   };
   const MEDIA_ERRORS = {1: "Laden abgebrochen", 2: "Netzwerkfehler", 3: "Ton nicht dekodierbar", 4: "Format oder Adresse nicht abspielbar"};
+  const RESOLVE_STEP = "Radio → Sender bearbeiten: ändere die Adresse des Senders, oder entferne ihn, speichere, lege ihn neu an und speichere wieder; dann löst der Server die Weiterleitung neu auf und gibt ihr Ziel frei.";
 
   function radioVolume() {
     if (radio.element) {
@@ -34,14 +35,34 @@
     drawStations();
   }
 
-  function radioTrouble(kind, label, note) {
-    radioStatus(kind, label, note);
-    const key = `${radio.url}|${kind}|${label}`;
-    if (radio.told !== key) {
-      radio.told = key;
-      const stream = settings.streams[radio.index];
-      toast(`Radio ${kind === "blocked" ? "blockiert" : "stumm"}: ${stream ? stream.name : radio.url}`, [note], false);
+  function radioTrouble(kind, label, note, cause) {
+    const told = radio.told;
+    const fresh = Ambience.retold(told, radio.url, kind, cause);
+    if (!fresh) {
+      radioStatus(...told.status);
+      return;
     }
+    radioStatus(kind, label, note);
+    if (told) {
+      told.box.remove();
+    }
+    const stream = settings.streams[radio.index];
+    const box = toast(`Radio ${kind === "blocked" ? "blockiert" : "stumm"}: ${stream ? stream.name : radio.url}`, [note], false);
+    radio.told = {...fresh, status: [kind, label, note], box};
+  }
+
+  function redirectNote(stream) {
+    if (stream && stream.via === null) {
+      return "Der Server hat die Weiterleitung dieses Senders noch nicht aufgelöst; ein Speichern nach zehn Minuten versucht es erneut.";
+    }
+    const released = stream ? stream.via : [];
+    const unloaded = released.filter((origin) => !pageMedia.has(origin));
+    if (unloaded.length) {
+      return `Der Sender leitet auf ${unloaded.join(", ")} um; die geladene Seite darf von dort noch keinen Ton laden: Seite neu laden.`;
+    }
+    return released.length
+      ? `Der Sender leitet auf eine Adresse außerhalb der freigegebenen ${released.join(", ")} um. ${RESOLVE_STEP}`
+      : `Der Sender leitet auf eine Adresse um, die noch nicht freigegeben ist; der Browser nennt das Ziel einer Weiterleitung nicht. ${RESOLVE_STEP}`;
   }
 
   function stopStream() {
@@ -70,16 +91,17 @@
 
   function syncRadio() {
     const index = dueStation();
-    const url = index < 0 ? "" : settings.streams[index].url;
+    const stream = index < 0 ? null : settings.streams[index];
+    const url = stream ? stream.url : "";
     if (url === radio.url && !radio.waiting) {
       drawStations();
       return;
     }
-    const origin = url ? new URL(url).origin : "";
+    const missing = stream ? Ambience.stationOrigins(stream).filter((origin) => !pageMedia.has(origin)) : [];
     radio.index = index;
-    if (origin && !pageMedia.has(origin)) {
-      radioStatus("reload", "lädt neu", "Neue Adresse: die Seite lädt neu, damit der Browser von dort Ton laden darf.");
-      if (state.media.includes(origin)) {
+    if (missing.length) {
+      radioStatus("reload", "lädt neu", `Neue Adresse ${missing.join(", ")}: die Seite lädt neu, damit der Browser von dort Ton laden darf.`);
+      if (missing.every((origin) => state.media.includes(origin))) {
         window.location.reload();
       }
       return;
@@ -98,7 +120,7 @@
       radio.element.src = url;
       radio.element.play().then(() => {
         radio.playing = true;
-        radio.told = "";
+        radio.told = null;
         radioStatus("playing", "spielt", `spielt seit ${clock.format(new Date())}`);
         tuneMusic(FADE / 1000);
         fadeRadio(1, () => null);
@@ -108,10 +130,7 @@
         }
         radio.waiting = true;
         const [kind, label, note] = PLAY_REFUSED[error.name] || ["error", "Fehler", `${error.name}: ${error.message}`];
-        // Trip-wire: the media error event fires before this rejection and already named the cause; a second toast would hide it.
-        if (!(kind === "error" && radio.state === "error")) {
-          radioTrouble(kind, label, note);
-        }
+        radioTrouble(kind, label, note, "refused");
       });
     });
   }
@@ -141,11 +160,12 @@
       radio.waiting = true;
       tuneMusic(FADE / 1000);
       const reason = failure ? MEDIA_ERRORS[failure.code] || `Fehler ${failure.code}` : "unbekannter Fehler";
-      radioTrouble("error", "Fehler", `Der Sender spielt nicht: ${reason}${failure && failure.message ? ` (${failure.message})` : ""}.`);
+      radioTrouble("error", "Fehler", `Der Sender spielt nicht: ${reason}${failure && failure.message ? ` (${failure.message})` : ""}.`, "media");
     });
     document.addEventListener("securitypolicyviolation", (event) => {
+      // Trip-wire: for a redirected load, blockedURI is the station's own URL, never the redirect target.
       if (event.effectiveDirective === "media-src" && radio.url && !event.blockedURI.startsWith(window.location.origin)) {
-        radioTrouble("error", "gesperrt", `Der Sender leitet auf ${event.blockedURI} um; die Seite spielt nur von den Adressen, die du mit deinem Passkey gespeichert hast.`);
+        radioTrouble("error", "gesperrt", redirectNote(settings.streams[radio.index]), "csp");
       }
     });
     return element;

orchestrator/templates/page-settings.js

@@ -1,3 +1,5 @@
+  let redirectsTold = "";
+
   function adoptSettings(next) {
     settings = next;
     settingsSig = JSON.stringify(next);
@@ -23,10 +25,16 @@
       toast("Einstellungen nicht gespeichert", [`${result.status} ${result.text}`.trim()], false);
       return false;
     }
-    const fresh = result.data.streams.map((stream) => new URL(stream.url).origin).filter((origin) => !pageMedia.has(origin));
-    adoptSettings(result.data);
+    const {settings: saved, problems} = result.data;
+    const unresolved = problems.join("\n");
+    if (unresolved && unresolved !== redirectsTold) {
+      toast("Weiterleitung nicht aufgelöst", [...problems, "Diese Sender laden vorerst nur von ihrer eigenen Adresse; ein Speichern nach zehn Minuten versucht es erneut."], false);
+    }
+    redirectsTold = unresolved;
+    const fresh = [...new Set(saved.streams.flatMap((stream) => Ambience.stationOrigins(stream)))].filter((origin) => !pageMedia.has(origin));
+    adoptSettings(saved);
     if (fresh.length) {
-      toast("Neuer Sender", ["Die Seite lädt neu, damit der Browser ihn abspielen darf. Blockiert der Browser danach das Abspielen, startet ein Klick den Sender."], true);
+      toast("Neuer Sender", ["Die Seite lädt neu, damit der Browser ihn abspielen darf. Blockiert der Browser danach das Abspielen, startet ein Klick den Sender.", `Neu für diese Seite: ${fresh.join(", ")}`], true);
       window.setTimeout(() => window.location.reload(), 1500);
     }
     return true;
@@ -47,6 +55,7 @@
       to: to.value === "00:00" && stream.to === "24:00" ? "24:00" : to.value,
       days: days.flatMap((box, index) => (box.checked ? [index] : [])),
       on: on.checked,
+      via: stream.via,
     })};
     entry.row = h("div", {class: "stream-row"},
       h("div", {class: "grid"}, h("label", {}, "Name", name), h("label", {}, "Stream-URL", url), h("label", {}, "von", from), h("label", {}, "bis", to)),
@@ -129,8 +138,8 @@
         h("div", {class: "days"}, h("label", {class: "check"}, speechOn, "Funk vorlesen"), sample),
         h("div", {class: "days", role: "group", "aria-label": "Klassen"}, spoken.map((entry) => h("label", {class: "check"}, entry.box, entry.label))),
         stations.length ? h("div", {class: "days", role: "group", "aria-label": "Stationen"}, stations.map((entry) => h("label", {class: "check"}, entry.box, entry.label))) : null),
-      h("section", {}, h("h3", {}, "Radio"), h("p", {class: "muted"}, "Internetradio zu festen Zeiten mit 3 s Ein- und Ausblenden; die Musik pausiert solange. Ein neuer Sender läuft rund um die Uhr, bis du seine Zeiten änderst; unter Stream → Radio startest und stoppst du ihn von Hand. Die Seite darf nur von diesen Adressen Ton laden; eine neue Adresse signiert dein Passkey."),
-        list, h("div", {}, btn("+ Sender", "btn small soft", () => streamRow({name: "", url: "", from: "00:00", to: "24:00", days: [0, 1, 2, 3, 4, 5, 6], on: true}, rows, list)))),
+      h("section", {}, h("h3", {}, "Radio"), h("p", {class: "muted"}, "Internetradio zu festen Zeiten mit 3 s Ein- und Ausblenden; die Musik pausiert solange. Ein neuer Sender läuft rund um die Uhr, bis du seine Zeiten änderst; unter Stream → Radio startest und stoppst du ihn von Hand. Die Seite darf nur von diesen Adressen Ton laden; eine neue Adresse signiert dein Passkey. Leitet ein signierter Sender um, löst der Server die Weiterleitung beim Speichern eines neuen Senders oder einer geänderten Adresse auf und gibt ihr Ziel frei; der Hinweis nach dem Speichern nennt es."),
+        list, h("div", {}, btn("+ Sender", "btn small soft", () => streamRow({name: "", url: "", from: "00:00", to: "24:00", days: [0, 1, 2, 3, 4, 5, 6], on: true, via: []}, rows, list)))),
       passkeySection(),
       h("div", {class: "sheet-foot"}, h("span", {class: "spacer"}), btn("Abbrechen", "btn ghost", closeSheet), h("button", {type: "submit", class: "btn primary"}, "Speichern")));
     form.addEventListener("submit", async (event) => {

orchestrator/templates/page-state.js

@@ -39,7 +39,7 @@
   const pageMedia = new Set(state.media);
   const sky = {canvas: document.getElementById("sky"), stars: Ambience.stars(320, 7), mode: "", frame: 0};
   const music = {gain: null, filter: null, drone: [], timer: 0, tension: 0, ducked: 0};
-  const radio = {element: null, url: "", level: 0, timer: 0, playing: false, waiting: false, index: -1, pick: null, sig: "", state: "", short: "", note: "", told: ""};
+  const radio = {element: null, url: "", level: 0, timer: 0, playing: false, waiting: false, index: -1, pick: null, sig: "", state: "", short: "", note: "", told: null};
   const speech = {pending: [], busy: false, warned: 0, current: null, source: null};
   const mic = {recorder: null, held: false, busy: false, timer: 0};
   const space = {