Pin AudioStreaming 1.4.5 and drop the discarded-player grace period

[KevinTCoughlin]

Summary

AudioStreaming 1.4.5 (14 Sep 2026, e28a74b7) carries dimitris-c/AudioStreaming#138 — the upstream fix the 2026-09-07 DECISIONS.md entry named as its condition for removal: "if it lands and a release carries it, pin the release … and this reduces back to a bare reassignment." Both halves now hold.

• Pin moves exact: "1.4.4" → "1.4.5" in Packages/PlaybackEngineAudioStreaming/Package.swift, with all eight Package.resolved copies updated.
• replacePlayer() reduces to a bare reassignment. The stop() + one-second withExtendedLifetime grace period and the discardedPlayerTeardownGrace constant are gone, so a media-services reset no longer holds a dead player's buffers for a second afterwards.
• DECISIONS.md gets a 2026-09-21 entry closing out 2026-09-07; THIRD_PARTY_LICENSES.md records the new version.

Verified at the tag, not from release notes. DispatchTimerSource.deinit at 1.4.5 computes needsResume under UnfairLock and resumes only a source it finds .suspended; activate()/suspend() do their check-and-change under the same lock. The lock matters as much as the conditional — Retrier builds its timer with underlyingQueue: nil, so the torn suspend count was reachable.

Nothing else in the graph moves. git diff 1.4.4..1.4.5 is two PRs plus tests and a README line. The dependency's manifest is untouched: still swift-tools-version:5.10, still .iOS(.v15)/.macOS(.v13)/.tvOS(.v16) with no watchOS, still exact: "0.1.2" on both sbooth xcframeworks. The platform reasoning in our manifest (tvOS in, watchOS out) and the no-new-binary-artifacts property CI asserts for Packages/Playback both survive.

What we accept by taking this tag. 1.4.5 also carries #136, optional mTLS client certificates, which touches NetworkSessionDelegate, NetworkingClient, and AudioPlayer.init — our streaming path. It is additive and the provider defaults to nil, so our AudioPlayer() call behaves identically; the alternative to taking it was a fork, which the 2026-08-07 entry (#124) already ruled out. Flagged so the next unexplained networking regression has a suspect.

Test plan

No toolchain was available where this was made (Linux; the repo builds on a Mac host or simulator only), so nothing here was compiled or linted locally — this needs CI, and a reviewer should treat the simulator test plan plus the Release and tvOS builds as the real check.

• No test covers replacePlayer() directly, for the reason the 2026-08-20 volume-ramp entry gives: AudioPlayer is a concrete dependency type with no protocol seam, and PlaybackEngineAudioStreaming has no test target that builds on the mac host.
• All eight Package.resolved files were hand-edited and validated as JSON. The pins are correct — version 1.4.5, revision e28a74b7b8632fc14312b7a79dcd82fa302779af as git rev-parse 1.4.5^{commit} reports it — but each file's originHash still reflects the old dependency declaration and will be rewritten by the first real resolve. That churn is expected and should be committed when it appears.
• The removed mitigation was never verified against an observed crash (the 2026-09-07 entry says so explicitly), and its removal inherits that: there is no signal that would tell us if this regressed. DiagnosticsService would surface an MXCrashDiagnostic with _dispatch_source_dispose, but only from a real device.

Checklist

• CHANGELOG.md updated under [Unreleased] (if user-facing) — not applicable: no user-visible behaviour change, and the mitigation this removes never had an entry.
• DECISIONS.md updated (if this makes or reverses an architectural call)
• Commits are signed off (git commit -s) per the DCO — not done; no commit on main carries a Signed-off-by trailer, so this follows the existing history. Say the word if you want it amended.

🤖 Generated with Claude Code

https://claude.ai/code/session_01NcPH1tQFMqGX6SZX49s4nf

---

Generated by Claude Code

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None