Feature: Mid-Stream Key Rotation for Widevine and PlayReady on Live Reloads

[cjpillsbury]

Context

Rotation and liveness are independent axes, and only one cell is a gap.

	no rotation	rotation
VOD	works	works — every key is in the playlist at load, so the eager manifest loop licenses each
Live	works (Mux's shape)	FairPlay works (its encrypted listener stays armed); Widevine / PlayReady do not

The hole is mid-stream rotation for Widevine and PlayReady on a live reload. exchangeLicenses captures the presentation once on entry — a single-positive-state reactor, deliberately, for source identity — so keys declared by later playlist reloads are never re-scanned, and the encrypted fallback is not armed for manifest-licensed content. Keys appearing after entry go unlicensed and decode stalls at the first rotation boundary.

Scope

Either:

• a reactive re-scan of declaredDrmKeys on presentation updates, deduped by manifest attribute identity and reusing the existing toInitData → openLicenseSession path; or
• licensing on encrypted encounter for manifest-licensed content too.

Decide alongside on-demand licensing. The same choice — license all up front vs license on encounter — determines both, so taking them separately risks two designs that disagree.

Acceptance criteria

• Keys first declared by a playlist reload are licensed before their segments need to decode.
• No regression to the covered cells: VOD rotation, FairPlay live rotation, and single-key live continue to work.
• The scope statement in drm-support.md, the behaviour JSDoc and the PR body stop naming this as unsupported.

Notes

• Deferred in feat(spf): add EME-based DRM support to the HLS engine #2291 with the constraint stated in exchange-licenses.ts's JSDoc, drm-support.md, and the PR body's Deliberate Scope section.
• Empirical: a minted Mux test-mode DRM live stream held its three EXT-X-KEY declarations byte-identical across a sliding window (MEDIA-SEQUENCE 5→24, ~2 min) — no rotation observed, so Mux-shaped live DRM is not affected.
• metadata.keys is already rotation-aware: it collects every distinct EXT-X-KEY deduped by attribute identity. The gap is that nothing re-reads it after entry.
• VOD rotation is itself unverified — no temporal-rotation asset exists in the test set, and generating a real-DRM one needs a licence server that serves rotating keys.

[github-actions]

Planning recommendation: add this to the roadmap alongside #2863, since both require one decision on eager versus encounter-time licensing. Link it to the native-SPF DRM tracker #1776 (with #1411 as the broader DRM epic, if maintainers retain that relationship). #2291 is the open implementing PR that explicitly deferred this scope. Recommend P2: a real playback stall, but limited to live streams that rotate Widevine/PlayReady keys. No milestone recommendation: GA is imminent and this remains a distinct deferred capability.