Harden ad-spoof pod accounting (cap + unknown-length gating) + GQL body-read timeout

[ryanbr]

Spoofing-code hardening mirroring upstream GosuDRM/TTV-AB — all in the shared notifyAdComplete lineage, where TTV-AB hit these in the field.

1. Pod accounting (TTV-AB v9.4.1 + v9.6.4 + v9.7.3)

Two related edge cases around X-TV-TWITCH-AD-POD-LENGTH, both producing internally-inconsistent ad-completion beacons (the cross-validation flag the payload is designed to avoid):

(a) Over-surface — cap. Twitch occasionally exposes more unique stitched-ad DATERANGEs in one poll than the pod declares. The pre-loop early-out only caught that across polls, so within one poll vaft kept spoofing past the pod (5/2 pod logs, beacons for more ads than the pod claims). A per-iteration break now stops at the declared length. (v9.4.1)

(b) Unknown length — gate. When Twitch omits the pod-length attribute, podLength falls back to the current poll's match count, making every size-vs-podLength comparison meaningless:

• the early-out bailed after the first ad → later ads in the pod left unspoofed;
• pod_complete could fire on multiple polls.

All three checks (pre-loop early-out, in-loop cap, pod_complete) are now gated on hasExplicitPodLength = !!podLenMatch. Unknown length → never early-out (spoof every surfaced ad), never fabricate pod_complete. (v9.6.4 + v9.7.3)

2. GQL relay abort timeout through body read (TTV-AB v9.6.1)

The main-thread fetch relay (worker's access tokens + spoof beacons) cleared its 5s AbortController timer at headers, leaving await response.text() unbounded on a mid-body hang. Worker-side relay timeout already bounded the impact (no stall — leaked promise), but the timer now clears after the body read so a mid-body abort rejects through the existing catch.

Scope / validation

• Pod-accounting changes are opt-in spoof-on territory (spoofing default-off since v68.3.0). The relay-timeout is always-on but bounded.
• vaft release pair here; mirrored to the testing pair (direct to master, v656). Spoofing is vaft-only → no video-swap-new change.
• Worker-blob safe (pod logic uses loop locals + the new hasExplicitPodLength); relay change is main-thread.
• npx acorn --ecma2022 clean on both; added lines byte-identical across the pair.
• No version bump (accumulates under ## Unreleased).

🤖 Generated with Claude Code