diff --git a/docs/backlog/24-access-streaming-v2.md b/docs/backlog/24-access-streaming-v2.md
index ac67f17..556fccd 100644
--- a/docs/backlog/24-access-streaming-v2.md
+++ b/docs/backlog/24-access-streaming-v2.md
@@ -124,11 +124,19 @@ P3 first vertical slice delivered (`agent/audio-v2-p3`):
 - DAV2 Range reads now use bounded gateway requests, hedge the header and first
   chunk against a second gateway when the first one stalls, and cache the
   winning gateway per CID for the browser session.
+- MSE playback now prepares the current chunk plus two future chunks while the
+  current clear chunk is appended. Appends stay strictly ordered, track changes
+  abort the bounded pipeline, and at most three container chunks are in the
+  preparation window (about 1.5 MiB at the current 512 KiB default).
+- The browser imports the AES content key once per playback instead of once per
+  chunk. Known chunk ranges must return the exact byte count; truncated or
+  mismatched `206` responses retry another gateway instead of being
+  misclassified as a content-authentication failure.
 - The resolver emits `dotify:dav2-startup` events for key authorization,
   gateway selection, header readiness, first range, first decrypt, first
   append, fallback, and error phases.
-- Remaining #88 work: worker-based decryption, chunk read-ahead/pipelining,
-  first-chunk sizing experiments, the browser/device validation matrix, and the
+- Remaining #88 work: worker-based decryption, first-chunk sizing experiments,
+  the browser/device validation matrix, startup telemetry export, and the
   backend read-through gateway decision.
 
 Product SDK replanning note (2026-07-14):
diff --git a/docs/backlog/README.md b/docs/backlog/README.md
index d3f3710..5bd92c7 100644
--- a/docs/backlog/README.md
+++ b/docs/backlog/README.md
@@ -87,7 +87,7 @@ Deferred (needs a backend channel, deliberately not faked): persisted room mood.
 
 | Backlog doc                 | Status                                                                                                                                                                | Goal                                                                                                                                                                                                                                                                                           |
 | --------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `24-access-streaming-v2.md` | P1/P2 delivered; P3 first vertical slice delivered with DAV2 refs, playback fallback, and startup metrics (design in `docs/design/dotify-v2-access-and-streaming.md`) | Remove the 42% preview; three-mode artist policy (free / paid / human-free via Proof of Personhood); sign-once session auth for key delivery; encrypted chunked streaming (`dotify.audio.v2`) for fast starts; Product SDK / Playground / Humanity feasibility as a later host-integration track |
+| `24-access-streaming-v2.md` | P1/P2 delivered; P3 DAV2 vertical slice and bounded read-ahead delivered; real-browser/gateway validation remains (design in `docs/design/dotify-v2-access-and-streaming.md`) | Remove the 42% preview; three-mode artist policy (free / paid / human-free via Proof of Personhood); sign-once session auth for key delivery; encrypted chunked streaming (`dotify.audio.v2`) for fast starts; Product SDK / Playground / Humanity feasibility as a later host-integration track |
 
 Ticket 24 supersedes the preview-based rows above: the 42% doctrine and the
 ticket 18 preview assets are consciously retired by access model v2.
diff --git a/docs/design/dotify-v2-access-and-streaming.md b/docs/design/dotify-v2-access-and-streaming.md
index 7c86652..19bb0ab 100644
--- a/docs/design/dotify-v2-access-and-streaming.md
+++ b/docs/design/dotify-v2-access-and-streaming.md
@@ -1,6 +1,6 @@
 # Dotify v2 - access, protected streaming, and Polkadot App alignment
 
-Status: living design and delivery plan. Last reviewed: 2026-07-10.
+Status: living design and delivery plan. Last reviewed: 2026-07-18.
 
 This document is the source of truth for the Dotify v2 access and streaming
 pivot. It should answer four questions:
@@ -32,9 +32,11 @@ Dotify v2 changes the production spine in three ways:
 The current implementation now includes the first `dotify.audio.v2` vertical
 slice: backend publish writes a chunked encrypted `DAV2` object, new registry
 refs use `dotify:enc:v2:ipfs://<CID>`, and the web player recognizes v2 refs
-with a Media Source Extensions path plus full-file fallback. Host playback now
-emits startup timing events; the remaining P3 work is browser/device validation
-against real gateways and media files.
+with a Media Source Extensions path plus authenticated full-file fallback. The
+MSE path uses bounded two-chunk read-ahead, ordered appends, one imported AES key
+per playback, and strict chunk-range response validation. Host playback emits
+startup timing events; the remaining P3 work is worker offload, field telemetry,
+and browser/device validation against real gateways and media files.
 
 ## 2. Current Delivery State
 
@@ -45,7 +47,7 @@ against real gateways and media files.
 | Free-track key delivery | Delivered | The backend verifies public access on-chain before releasing a key with no wallet or signature. |
 | Artist runtime bootstrap | Delivered | Polkadot Hub EVM registration is staged: `createRuntime()` creates a minimal shell, then `installRuntimeStep()` installs one pallet per transaction before final ownership transfer and directory registration. |
 | Room access doctrine | Delivered and preserved | Only the host needs access; listeners receive only the WebRTC stream. |
-| Chunked encrypted streaming, P3 | First vertical slice delivered | New backend uploads publish DAV2 refs; web playback supports v2 refs with v1 fallback. Startup metrics exist; browser/device validation remains. |
+| Chunked encrypted streaming, P3 | Startup pipeline delivered; field validation open | New backend uploads publish DAV2 refs; web playback supports v2 refs, bounded read-ahead, strict ordered append, and v1/full-file fallback. Startup metrics exist; browser/device validation remains. |
 | Real Proof of Personhood integration, P4 | Open | Current `human-free` remains structurally ready but not backed by the live platform source. |
 | Polkadot App / Triangle integration, P5 | Open | DotNS/Bulletin alignment exists conceptually; Product SDK, Host API signing, and Statement Store migration are future work. |
 
@@ -253,9 +255,26 @@ The target browser path:
 
 1. Fetch and parse the header.
 2. Fetch encrypted chunks using HTTP Range requests.
-3. Decrypt each chunk with Web Crypto.
-4. Append decrypted bytes to a Media Source Extensions `SourceBuffer`.
-5. Start playback after the first appendable segment.
+3. Import the temporary content key once, then decrypt each chunk with Web
+   Crypto.
+4. Prepare the current chunk plus two future chunks concurrently while keeping
+   at most three prepared chunks in memory.
+5. Append decrypted bytes to a Media Source Extensions `SourceBuffer` in strict
+   chunk order.
+6. Start playback after the first appendable segment.
+
+The range layer requires `206 Partial Content`. Known encrypted chunk ranges
+must return exactly the requested bytes, and an exposed `Content-Range` header
+must agree with the request. Header reads may be shorter only when the response
+reaches the end of a small object.
+
+MSE treats successive appends as one logical byte stream and retains incomplete
+parser input across appends. That makes DAV2's encryption boundaries compatible
+with incremental parsing, but it does not make every uploaded file a valid MSE
+stream. The bytes still have to conform to the registered format for their MIME
+type. `MediaSource.isTypeSupported()` is a necessary capability check, not proof
+that a particular file is correctly packaged; recoverable append failures keep
+the authenticated full-file path available.
 
 Fallback:
 
@@ -313,7 +332,41 @@ Browser validation remains required before marking P3 release-ready:
 - host switches v1 -> v2 and v2 -> v1 tracks;
 - listener joins before and after first audio;
 - mobile autoplay fallback still shows the explicit "start audio" action;
-- `replaceTrack()` behavior remains stable when the source changes.
+- source switches preserve listener audio through renegotiation, while
+  same-source sender replacement remains stable.
+
+### Current streaming coherence review (2026-07-18)
+
+The playback and room layers remain intentionally separate:
+
+- DAV2 Range/decrypt/MSE runs only on the authorized host or individual
+  listener. It never moves source bytes or content keys into the guest room
+  path.
+- A persistent host `<audio>` element feeds one captured `MediaStream`; room
+  guests receive that stream over WebRTC and attach it to an autoplay-aware
+  listener element.
+- Native media-element capture is preferred. The Web Audio fallback keeps a
+  stable `MediaStreamAudioDestinationNode` for browsers without
+  `captureStream()`, resumes its context after user/media activity, and keeps
+  host-local mute separate from the outbound room stream.
+- Same-source play, pause, and seek reuse the live sender. Source changes
+  deliberately renegotiate each listener after browser testing showed that
+  replacing tracks from a changing media-element capture can produce a
+  live-looking but silent sender. This costs more signaling than the ideal
+  `replaceTrack()` path, but preserves audible shared presence.
+- Listener media uses `autoplay` and `playsInline`, while blocked playback is
+  surfaced as an explicit user action. New tracks are not assumed to resume
+  merely because a `MediaStream` gained a track.
+
+This is coherent for the current small-room production spine, not the final
+scale architecture. Host-to-listener mesh fan-out, optional rather than
+mandatory TURN, missing ICE restart/quality telemetry, and per-source
+renegotiation belong to room reliability issue #89. They should be improved
+without moving key delivery to guests, making wallets a room-entry condition,
+or coupling DAV2 startup to a future SFU. The next optimization decision remains
+evidence-led: validate first sound and room continuity on real devices, then use
+the measurements to choose backend read-through, media normalization, TURN, or
+SFU work.
 
 ## 8. Polkadot App Stack Alignment
 
@@ -349,7 +402,7 @@ P5 should start with a capability matrix, not a rewrite.
 | --- | --- | --- | --- |
 | P1 | Delivered | Access model v2 in contracts, backend, and UI; remove preview playback. | Free tracks play with no wallet; unauthorized protected tracks show gates with no audio; artists can change future key-release policy without changing app flow. |
 | P2 | Delivered | Session auth for key service. | One signature opens a session; later protected listens do not prompt again; every key request still checks chain access. |
-| P3 | First vertical slice delivered | `dotify.audio.v2` chunked container, publish path, playback path, v1 fallback, startup metrics. | New protected uploads produce v2 refs; v1 assets still play; browser/device validation must confirm time-to-first-sound. |
+| P3 | Startup pipeline delivered; field validation open | `dotify.audio.v2` chunked container, publish path, bounded read-ahead playback, v1/full-file fallback, startup metrics. | New protected uploads produce v2 refs; v1 assets still play; browser/device validation must confirm time-to-first-sound and supported media packaging. |
 | P4 | Open | Real Proof of Personhood integration for `human-free`. | No admin mock in production; denied PoP checks fail closed; UI explains the exact missing proof. |
 | P5 | Open | Triangle/Host API/Product SDK alignment and Statement Store design. | Dotify runs as a Host-compatible Product without assuming direct wallet/RPC access; room social state has a migration design. |
 
@@ -373,6 +426,9 @@ P5 should start with a capability matrix, not a rewrite.
 - resolver chooses v2 playback for `dotify:enc:v2:ipfs://...` and v1 playback
   for `dotify:enc:ipfs://...`;
 - MSE path can append the first supported decrypted segment and start playback;
+- bounded preparation overlaps range/decrypt work while preserving append order
+  and aborting on track changes;
+- truncated or mismatched chunk ranges retry another gateway before decryption;
 - full-file fallback works when MSE or Range support is unavailable;
 - room e2e measures that host source loading no longer creates multi-second
   silence on ordinary protected tracks.
diff --git a/docs/explanation/content-protection.md b/docs/explanation/content-protection.md
index f3c527d..666253a 100644
--- a/docs/explanation/content-protection.md
+++ b/docs/explanation/content-protection.md
@@ -88,6 +88,10 @@ audioRef = "dotify:enc:v2:ipfs://<CID>"
 
 The same backend derivation is used when an authorized key request succeeds, so
 the delivered per-track key decrypts bytes encrypted by the upload route.
+During MSE playback, the browser imports that temporary key once and prepares a
+bounded two-chunk look-ahead while appending clear chunks in order. This changes
+startup latency, not authorization: room guests still receive only the host's
+ephemeral WebRTC stream and never receive the key or source bytes.
 The exact `DAV2` binary layout and browser playback contract are documented in
 [audio-v2-container.md](../reference/audio-v2-container.md).
 
diff --git a/docs/index.html b/docs/index.html
index 80e89c4..503bdfa 100644
--- a/docs/index.html
+++ b/docs/index.html
@@ -1528,9 +1528,9 @@ <h3>Core access, upload, room, and test paths</h3>
               <h3>Operate the spine and validate first sound</h3>
               <p>
                 Publication is reopened on the audited deployment. Hosted signaling and production
-                environment evidence, and public wallet/device validation are closed; the active gates
-                are DAV2 browser and gateway validation plus the backend read-through decision for
-                reliable first sound.
+                environment evidence, and public wallet/device validation are closed. DAV2 now has a
+                bounded gateway and read-ahead startup pipeline; the active gates are real-browser and
+                gateway validation plus the backend read-through decision for reliable first sound.
               </p>
             </li>
             <li>
diff --git a/docs/reference/audio-v2-container.md b/docs/reference/audio-v2-container.md
index 721fff1..2c4f2ce 100644
--- a/docs/reference/audio-v2-container.md
+++ b/docs/reference/audio-v2-container.md
@@ -76,7 +76,8 @@ The web client resolves refs in this order:
    one stalls, and the winning gateway is cached per CID for the browser
    session.
 3. If the browser supports `MediaSource.isTypeSupported(header.mediaMime)`,
-   decrypt chunks and append them to a `SourceBuffer`.
+   import the content key once, prepare the current chunk plus two future chunks,
+   and append clear chunks to a `SourceBuffer` in strict index order.
 4. If Range or MSE is unavailable before streaming starts, or a recoverable
    gateway/MSE append error happens while streaming, fetch the full encrypted
    object, decrypt it, and play from a Blob URL.
@@ -86,6 +87,37 @@ The web client resolves refs in this order:
 Legacy refs with `dotify:enc:ipfs://<CID>` remain supported through the v1
 full-file decrypt path.
 
+## Range and MSE Boundary
+
+DAV2 chunk reads require `206 Partial Content`. A known encrypted chunk must
+return exactly the requested byte count. When `Content-Range` is visible through
+CORS, its start, end, and returned length must also match. A visible mismatch
+makes the client try another configured gateway before decrypting; an absent
+header is accepted after the byte-count check because some gateways do not expose
+it through CORS. Header ranges may be shorter only when a small object ends before
+the requested upper bound.
+
+The read-ahead window is deliberately small: the current chunk and two future
+chunks may be prepared, while only one clear chunk is appended at a time. Track
+selection cancellation aborts the pipeline and its in-flight gateway requests.
+This lowers dead air without turning public gateways into an unbounded fan-out
+or giving room guests any source/key access.
+
+MSE concatenates appends into a logical byte stream and retains incomplete input
+between appends. The underlying clear bytes must still conform to the MSE byte
+stream format registered for `mediaMime`. Browser type support is not a guarantee
+that a particular original upload is packaged correctly, so real-browser format
+validation and authenticated full-file recovery remain part of the production
+contract. DAV3 should normalize media segments only if DAV2 field metrics prove
+that original-file packaging is the remaining bottleneck.
+
+The current [W3C MSE byte-stream registry](https://w3c.github.io/mse-byte-stream-format-registry/)
+maps audio streaming formats for `audio/mpeg`, `audio/aac`, `audio/mp4`, and
+`audio/webm`; support still varies by browser, codec, and exact packaging.
+Uploads such as WAV, FLAC, or Ogg remain valid DAV2 assets but should use the
+authenticated full-file playback path unless the running browser explicitly
+accepts their MIME type and the real file passes append validation.
+
 ## Startup Metrics
 
 The DAV2 resolver emits a browser event for the pre-source startup path:
diff --git a/web/src/features/catalog/audioV2Gateway.test.ts b/web/src/features/catalog/audioV2Gateway.test.ts
index de4146f..7caaa12 100644
--- a/web/src/features/catalog/audioV2Gateway.test.ts
+++ b/web/src/features/catalog/audioV2Gateway.test.ts
@@ -6,8 +6,11 @@ const PRIMARY = `https://primary.example/ipfs/${CID}`;
 const FALLBACK = `https://fallback.example/ipfs/${CID}`;
 const THIRD = `https://third.example/ipfs/${CID}`;
 
-function rangeResponse(bytes: number[] = [1, 2, 3]) {
-  return new Response(new Uint8Array(bytes), { status: 206 });
+function rangeResponse(length: number, value = 1, contentRange?: string) {
+  return new Response(new Uint8Array(length).fill(value), {
+    status: 206,
+    headers: contentRange ? { 'Content-Range': contentRange } : undefined
+  });
 }
 
 describe('audioV2 gateway range fetching', () => {
@@ -21,8 +24,8 @@ describe('audioV2 gateway range fetching', () => {
     const fetchMock = vi
       .fn<typeof fetch>()
       .mockResolvedValueOnce(new Response('range unsupported', { status: 200 }))
-      .mockResolvedValueOnce(rangeResponse([9]))
-      .mockResolvedValueOnce(rangeResponse([10]));
+      .mockResolvedValueOnce(rangeResponse(9, 9))
+      .mockResolvedValueOnce(rangeResponse(4, 10));
 
     const first = await fetchAudioV2RangeThroughGateways(CID, 0, 8, {
       fetchImpl: fetchMock,
@@ -30,7 +33,7 @@ describe('audioV2 gateway range fetching', () => {
       hedge: false
     });
 
-    expect(first.bytes).toEqual(new Uint8Array([9]));
+    expect(first.bytes).toEqual(new Uint8Array(9).fill(9));
     expect(first.gatewayUrl).toBe(FALLBACK);
     expect(getCachedAudioV2Gateway(CID)).toBe(FALLBACK);
 
@@ -40,7 +43,7 @@ describe('audioV2 gateway range fetching', () => {
       hedge: false
     });
 
-    expect(second.bytes).toEqual(new Uint8Array([10]));
+    expect(second.bytes).toEqual(new Uint8Array(4).fill(10));
     expect(fetchMock.mock.calls.map(([url]) => url)).toEqual([PRIMARY, FALLBACK, FALLBACK]);
   });
 
@@ -53,7 +56,7 @@ describe('audioV2 gateway range fetching', () => {
           init?.signal?.addEventListener('abort', () => reject(new DOMException('aborted', 'AbortError')), { once: true });
         });
       }
-      return Promise.resolve(rangeResponse([7]));
+      return Promise.resolve(rangeResponse(9, 7));
     });
 
     const result = await fetchAudioV2RangeThroughGateways(CID, 0, 8, {
@@ -64,7 +67,7 @@ describe('audioV2 gateway range fetching', () => {
       timeoutMs: 1_000
     });
 
-    expect(result.bytes).toEqual(new Uint8Array([7]));
+    expect(result.bytes).toEqual(new Uint8Array(9).fill(7));
     expect(result.gatewayUrl).toBe(FALLBACK);
     expect(result.hedged).toBe(true);
     expect(primarySignal?.aborted).toBe(true);
@@ -79,7 +82,7 @@ describe('audioV2 gateway range fetching', () => {
           init?.signal?.addEventListener('abort', () => reject(new DOMException('timed out', 'AbortError')), { once: true });
         });
       }
-      return Promise.resolve(rangeResponse([5]));
+      return Promise.resolve(rangeResponse(9, 5));
     });
 
     const resultPromise = fetchAudioV2RangeThroughGateways(CID, 0, 8, {
@@ -92,7 +95,7 @@ describe('audioV2 gateway range fetching', () => {
     await vi.advanceTimersByTimeAsync(250);
     const result = await resultPromise;
 
-    expect(result.bytes).toEqual(new Uint8Array([5]));
+    expect(result.bytes).toEqual(new Uint8Array(9).fill(5));
     expect(result.gatewayUrl).toBe(FALLBACK);
   });
 
@@ -117,4 +120,48 @@ describe('audioV2 gateway range fetching', () => {
     await expect(resultPromise).rejects.toMatchObject({ name: 'AbortError' });
     expect(fetchMock).toHaveBeenCalledTimes(1);
   });
+
+  it('retries another gateway when a chunk range is truncated', async () => {
+    const fetchMock = vi
+      .fn<typeof fetch>()
+      .mockResolvedValueOnce(rangeResponse(2))
+      .mockResolvedValueOnce(rangeResponse(3, 6, 'bytes 10-12/100'));
+
+    const result = await fetchAudioV2RangeThroughGateways(CID, 10, 12, {
+      fetchImpl: fetchMock,
+      getGatewayUrlsForCid: () => [PRIMARY, FALLBACK],
+      hedge: false
+    });
+
+    expect(result.bytes).toEqual(new Uint8Array(3).fill(6));
+    expect(result.gatewayUrl).toBe(FALLBACK);
+  });
+
+  it('retries another gateway when Content-Range does not match the request', async () => {
+    const fetchMock = vi
+      .fn<typeof fetch>()
+      .mockResolvedValueOnce(rangeResponse(3, 2, 'bytes 11-13/100'))
+      .mockResolvedValueOnce(rangeResponse(3, 8, 'bytes 10-12/100'));
+
+    const result = await fetchAudioV2RangeThroughGateways(CID, 10, 12, {
+      fetchImpl: fetchMock,
+      getGatewayUrlsForCid: () => [PRIMARY, FALLBACK],
+      hedge: false
+    });
+
+    expect(result.bytes).toEqual(new Uint8Array(3).fill(8));
+    expect(result.gatewayUrl).toBe(FALLBACK);
+  });
+
+  it('accepts a short header range when the response reaches the end of the object', async () => {
+    const fetchMock = vi.fn<typeof fetch>().mockResolvedValueOnce(rangeResponse(40, 4, 'bytes 0-39/40'));
+
+    const result = await fetchAudioV2RangeThroughGateways(CID, 0, 65_535, {
+      fetchImpl: fetchMock,
+      getGatewayUrlsForCid: () => [PRIMARY],
+      phase: 'header'
+    });
+
+    expect(result.bytes).toHaveLength(40);
+  });
 });
diff --git a/web/src/features/catalog/audioV2Gateway.ts b/web/src/features/catalog/audioV2Gateway.ts
index 1bb93a1..52d2042 100644
--- a/web/src/features/catalog/audioV2Gateway.ts
+++ b/web/src/features/catalog/audioV2Gateway.ts
@@ -75,10 +75,30 @@ function throwIfAborted(signal?: AbortSignal): void {
   if (signal?.aborted) throw createAbortError();
 }
 
+function validateRangeBytes(response: Response, bytes: Uint8Array, gatewayUrl: string, start: number, end: number, phase: AudioV2GatewayPhase): void {
+  const expectedLength = end - start + 1;
+  if (bytes.length === 0 || bytes.length > expectedLength || (phase !== 'header' && bytes.length !== expectedLength)) {
+    throw new Error(`Gateway ${gatewayUrl} returned ${bytes.length} bytes for range ${start}-${end}`);
+  }
+
+  const contentRange = response.headers.get('content-range');
+  if (!contentRange) return;
+  const match = /^bytes (\d+)-(\d+)\/(?:\d+|\*)$/i.exec(contentRange.trim());
+  if (!match) throw new Error(`Gateway ${gatewayUrl} returned an invalid Content-Range header`);
+
+  const responseStart = Number(match[1]);
+  const responseEnd = Number(match[2]);
+  if (responseStart !== start || responseEnd > end || responseEnd - responseStart + 1 !== bytes.length) {
+    throw new Error(`Gateway ${gatewayUrl} returned mismatched Content-Range ${contentRange}`);
+  }
+}
+
 function makeRangeAttempt(
   id: number,
   gatewayUrl: string,
-  rangeHeader: string,
+  start: number,
+  end: number,
+  phase: AudioV2GatewayPhase,
   timeoutMs: number,
   fetchImpl: typeof fetch,
   cachedGateway: string | undefined,
@@ -87,6 +107,7 @@ function makeRangeAttempt(
   const controller = new AbortController();
   const startedAt = nowMs();
   const abortFromParent = () => controller.abort();
+  const rangeHeader = `bytes=${start}-${end}`;
 
   if (signal?.aborted) {
     controller.abort();
@@ -104,10 +125,12 @@ function makeRangeAttempt(
       if (response.status !== 206) {
         throw new Error(`Gateway ${gatewayUrl} did not serve a range (${response.status})`);
       }
+      const bytes = new Uint8Array(await response.arrayBuffer());
+      validateRangeBytes(response, bytes, gatewayUrl, start, end, phase);
       return {
         ok: true as const,
         id,
-        bytes: new Uint8Array(await response.arrayBuffer()),
+        bytes,
         gatewayUrl,
         elapsedMs: Number((nowMs() - startedAt).toFixed(1)),
         fromCache: gatewayUrl === cachedGateway
@@ -156,7 +179,6 @@ export async function fetchAudioV2RangeThroughGateways(cid: string, start: numbe
     throw new Error(`Invalid DAV2 range ${start}-${end}`);
   }
 
-  const rangeHeader = `bytes=${start}-${end}`;
   const active = new Map<number, Attempt>();
   let nextGatewayIndex = 0;
   let nextAttemptId = 0;
@@ -166,7 +188,7 @@ export async function fetchAudioV2RangeThroughGateways(cid: string, start: numbe
   const launch = () => {
     const gatewayUrl = ordered[nextGatewayIndex];
     nextGatewayIndex += 1;
-    const attempt = makeRangeAttempt(nextAttemptId, gatewayUrl, rangeHeader, timeoutMs, fetchImpl, cachedGateway, options.signal);
+    const attempt = makeRangeAttempt(nextAttemptId, gatewayUrl, start, end, phase, timeoutMs, fetchImpl, cachedGateway, options.signal);
     nextAttemptId += 1;
     active.set(attempt.id, attempt);
   };
diff --git a/web/src/features/catalog/audioV2Pipeline.test.ts b/web/src/features/catalog/audioV2Pipeline.test.ts
new file mode 100644
index 0000000..b0558db
--- /dev/null
+++ b/web/src/features/catalog/audioV2Pipeline.test.ts
@@ -0,0 +1,135 @@
+import { describe, expect, it, vi } from 'vitest';
+import { DEFAULT_AUDIO_V2_READ_AHEAD_CHUNKS, pumpAudioV2ReadAhead } from './audioV2Pipeline';
+
+type Deferred<T> = {
+  promise: Promise<T>;
+  resolve: (value: T) => void;
+  reject: (error: unknown) => void;
+};
+
+function deferred<T>(): Deferred<T> {
+  let resolve!: (value: T) => void;
+  let reject!: (error: unknown) => void;
+  const promise = new Promise<T>((resolvePromise, rejectPromise) => {
+    resolve = resolvePromise;
+    reject = rejectPromise;
+  });
+  return { promise, resolve, reject };
+}
+
+function chunks(count: number) {
+  return Array.from({ length: count }, (_, index) => ({ index }));
+}
+
+async function flushPromises(): Promise<void> {
+  await Promise.resolve();
+  await Promise.resolve();
+}
+
+describe('DAV2 read-ahead pipeline', () => {
+  it('prepares the current chunk plus two future chunks and appends in order', async () => {
+    const preparations = chunks(4).map(() => deferred<string>());
+    const firstAppend = deferred<void>();
+    const firstAppendStarted = deferred<void>();
+    const fourthPreparationStarted = deferred<void>();
+    const prepareOrder: number[] = [];
+    const appendOrder: number[] = [];
+
+    const pipeline = pumpAudioV2ReadAhead({
+      chunks: chunks(4),
+      prepareChunk: async chunk => {
+        prepareOrder.push(chunk.index);
+        if (chunk.index === 3) fourthPreparationStarted.resolve();
+        return preparations[chunk.index].promise;
+      },
+      appendChunk: async (chunk, prepared) => {
+        appendOrder.push(chunk.index);
+        expect(prepared).toBe(`clear-${chunk.index}`);
+        if (chunk.index === 0) {
+          firstAppendStarted.resolve();
+          await firstAppend.promise;
+        }
+      }
+    });
+
+    await flushPromises();
+    expect(prepareOrder).toEqual([0, 1, 2]);
+
+    preparations[2].resolve('clear-2');
+    preparations[1].resolve('clear-1');
+    preparations[0].resolve('clear-0');
+    await firstAppendStarted.promise;
+
+    expect(appendOrder).toEqual([0]);
+    expect(prepareOrder).toEqual([0, 1, 2]);
+
+    firstAppend.resolve();
+    await fourthPreparationStarted.promise;
+    expect(prepareOrder).toEqual([0, 1, 2, 3]);
+
+    preparations[3].resolve('clear-3');
+    await pipeline;
+    expect(appendOrder).toEqual([0, 1, 2, 3]);
+    expect(DEFAULT_AUDIO_V2_READ_AHEAD_CHUNKS).toBe(2);
+  });
+
+  it('aborts pending preparation and stops appending when the parent is cancelled', async () => {
+    const controller = new AbortController();
+    const started: number[] = [];
+    const appendChunk = vi.fn();
+
+    const pipeline = pumpAudioV2ReadAhead({
+      chunks: chunks(4),
+      signal: controller.signal,
+      prepareChunk: async (chunk, signal) => {
+        started.push(chunk.index);
+        return new Promise<string>((_resolve, reject) => {
+          signal.addEventListener('abort', () => reject(new DOMException('cancelled', 'AbortError')), { once: true });
+        });
+      },
+      appendChunk
+    });
+
+    await flushPromises();
+    expect(started).toEqual([0, 1, 2]);
+    controller.abort();
+
+    await expect(pipeline).rejects.toMatchObject({ name: 'AbortError' });
+    expect(appendChunk).not.toHaveBeenCalled();
+  });
+
+  it('propagates an authentication failure and cancels future work', async () => {
+    class AuthenticationError extends Error {}
+    const authenticationError = new AuthenticationError('chunk authentication failed');
+    const observedSignals: AbortSignal[] = [];
+    const appendChunk = vi.fn();
+
+    const pipeline = pumpAudioV2ReadAhead({
+      chunks: chunks(3),
+      prepareChunk: async (chunk, signal) => {
+        observedSignals.push(signal);
+        if (chunk.index === 0) throw authenticationError;
+        return new Promise<string>(() => undefined);
+      },
+      appendChunk
+    });
+
+    await expect(pipeline).rejects.toBe(authenticationError);
+    expect(appendChunk).not.toHaveBeenCalled();
+    expect(observedSignals).toHaveLength(3);
+    expect(observedSignals.every(signal => signal.aborted)).toBe(true);
+  });
+
+  it('rejects non-monotonic chunks before starting work', async () => {
+    const prepareChunk = vi.fn();
+
+    await expect(
+      pumpAudioV2ReadAhead({
+        chunks: [{ index: 0 }, { index: 2 }],
+        prepareChunk,
+        appendChunk: vi.fn()
+      })
+    ).rejects.toThrow(/monotonic/);
+    expect(prepareChunk).not.toHaveBeenCalled();
+  });
+});
diff --git a/web/src/features/catalog/audioV2Pipeline.ts b/web/src/features/catalog/audioV2Pipeline.ts
new file mode 100644
index 0000000..25a3b09
--- /dev/null
+++ b/web/src/features/catalog/audioV2Pipeline.ts
@@ -0,0 +1,92 @@
+export const DEFAULT_AUDIO_V2_READ_AHEAD_CHUNKS = 2;
+
+const MAX_AUDIO_V2_READ_AHEAD_CHUNKS = 4;
+
+type IndexedChunk = {
+  index: number;
+};
+
+type PreparedOutcome<TPrepared> = { ok: true; value: TPrepared } | { ok: false; error: unknown };
+
+export type AudioV2ReadAheadPipelineOptions<TChunk extends IndexedChunk, TPrepared> = {
+  chunks: readonly TChunk[];
+  prepareChunk: (chunk: TChunk, signal: AbortSignal) => Promise<TPrepared>;
+  appendChunk: (chunk: TChunk, prepared: TPrepared, signal: AbortSignal) => Promise<void>;
+  signal?: AbortSignal;
+  readAheadChunks?: number;
+};
+
+function createAbortError(): Error {
+  if (typeof DOMException !== 'undefined') return new DOMException('DAV2 pipeline cancelled', 'AbortError');
+  const error = new Error('DAV2 pipeline cancelled');
+  error.name = 'AbortError';
+  return error;
+}
+
+function throwIfAborted(signal: AbortSignal): void {
+  if (signal.aborted) throw createAbortError();
+}
+
+function validatePipeline<TChunk extends IndexedChunk>(chunks: readonly TChunk[], readAheadChunks: number): void {
+  if (!Number.isSafeInteger(readAheadChunks) || readAheadChunks < 0 || readAheadChunks > MAX_AUDIO_V2_READ_AHEAD_CHUNKS) {
+    throw new Error(`DAV2 read-ahead must be between 0 and ${MAX_AUDIO_V2_READ_AHEAD_CHUNKS} chunks`);
+  }
+  for (let position = 0; position < chunks.length; position += 1) {
+    if (chunks[position].index !== position) throw new Error('DAV2 pipeline requires monotonic chunk indexes');
+  }
+}
+
+/**
+ * Prepares a small window of future chunks while appending the current chunk.
+ * Preparation may finish out of order, but SourceBuffer appends remain ordered.
+ */
+export async function pumpAudioV2ReadAhead<TChunk extends IndexedChunk, TPrepared>(options: AudioV2ReadAheadPipelineOptions<TChunk, TPrepared>): Promise<void> {
+  const readAheadChunks = options.readAheadChunks ?? DEFAULT_AUDIO_V2_READ_AHEAD_CHUNKS;
+  validatePipeline(options.chunks, readAheadChunks);
+
+  const controller = new AbortController();
+  const abortFromParent = () => controller.abort();
+  if (options.signal?.aborted) {
+    controller.abort();
+  } else {
+    options.signal?.addEventListener('abort', abortFromParent, { once: true });
+  }
+
+  const preparedByIndex = new Map<number, Promise<PreparedOutcome<TPrepared>>>();
+  let nextIndexToPrepare = 0;
+
+  const prepareThrough = (lastIndex: number) => {
+    while (nextIndexToPrepare <= lastIndex && nextIndexToPrepare < options.chunks.length) {
+      const chunk = options.chunks[nextIndexToPrepare];
+      const outcome = Promise.resolve()
+        .then(() => {
+          throwIfAborted(controller.signal);
+          return options.prepareChunk(chunk, controller.signal);
+        })
+        .then<PreparedOutcome<TPrepared>>(value => ({ ok: true, value }))
+        .catch<PreparedOutcome<TPrepared>>(error => ({ ok: false, error }));
+      preparedByIndex.set(chunk.index, outcome);
+      nextIndexToPrepare += 1;
+    }
+  };
+
+  try {
+    throwIfAborted(controller.signal);
+    for (let index = 0; index < options.chunks.length; index += 1) {
+      prepareThrough(index + readAheadChunks);
+      const outcome = await preparedByIndex.get(index);
+      preparedByIndex.delete(index);
+      if (!outcome) throw new Error(`DAV2 chunk ${index} was not prepared`);
+      if (!outcome.ok) throw outcome.error;
+
+      throwIfAborted(controller.signal);
+      await options.appendChunk(options.chunks[index], outcome.value, controller.signal);
+      throwIfAborted(controller.signal);
+    }
+  } catch (error) {
+    controller.abort();
+    throw error;
+  } finally {
+    options.signal?.removeEventListener('abort', abortFromParent);
+  }
+}
diff --git a/web/src/features/catalog/audioV2Recovery.test.ts b/web/src/features/catalog/audioV2Recovery.test.ts
new file mode 100644
index 0000000..33e8abe
--- /dev/null
+++ b/web/src/features/catalog/audioV2Recovery.test.ts
@@ -0,0 +1,51 @@
+import { describe, expect, it, vi } from 'vitest';
+import { AudioV2ChunkAuthenticationError, routeAudioV2MseFailure } from './audioV2Recovery';
+
+function handlers(error: unknown, contextActive = true) {
+  return {
+    error,
+    contextActive,
+    retire: vi.fn(),
+    recover: vi.fn(),
+    reportAuthenticationFailure: vi.fn()
+  };
+}
+
+describe('DAV2 MSE failure routing', () => {
+  it('fails closed on chunk authentication errors without invoking full-file recovery', () => {
+    const authenticationError = new AudioV2ChunkAuthenticationError(new Error('AES-GCM tag mismatch'));
+    const options = handlers(authenticationError);
+
+    routeAudioV2MseFailure(options);
+
+    expect(options.reportAuthenticationFailure).toHaveBeenCalledOnce();
+    expect(options.reportAuthenticationFailure).toHaveBeenCalledWith(authenticationError);
+    expect(options.retire).toHaveBeenCalledOnce();
+    expect(options.recover).not.toHaveBeenCalled();
+  });
+
+  it('routes recoverable gateway and parser errors to the authenticated full-file path', () => {
+    const gatewayError = new Error('DAV2 range request failed');
+    const options = handlers(gatewayError);
+
+    routeAudioV2MseFailure(options);
+
+    expect(options.recover).toHaveBeenCalledOnce();
+    expect(options.recover).toHaveBeenCalledWith(gatewayError);
+    expect(options.reportAuthenticationFailure).not.toHaveBeenCalled();
+    expect(options.retire).not.toHaveBeenCalled();
+  });
+
+  it.each([
+    ['an aborted request', new DOMException('cancelled', 'AbortError'), true],
+    ['an inactive playback context', new Error('stale playback'), false]
+  ])('retires playback without recovery for %s', (_label, error, contextActive) => {
+    const options = handlers(error, contextActive);
+
+    routeAudioV2MseFailure(options);
+
+    expect(options.retire).toHaveBeenCalledOnce();
+    expect(options.recover).not.toHaveBeenCalled();
+    expect(options.reportAuthenticationFailure).not.toHaveBeenCalled();
+  });
+});
diff --git a/web/src/features/catalog/audioV2Recovery.ts b/web/src/features/catalog/audioV2Recovery.ts
new file mode 100644
index 0000000..40ee1a8
--- /dev/null
+++ b/web/src/features/catalog/audioV2Recovery.ts
@@ -0,0 +1,34 @@
+export class AudioV2ChunkAuthenticationError extends Error {
+  constructor(readonly cause: unknown) {
+    super('DAV2 chunk authentication failed');
+    this.name = 'AudioV2ChunkAuthenticationError';
+  }
+}
+
+type AudioV2MseFailureHandlers = {
+  error: unknown;
+  contextActive: boolean;
+  retire: () => void;
+  recover: (error: unknown) => void;
+  reportAuthenticationFailure: (error: AudioV2ChunkAuthenticationError) => void;
+};
+
+function isAbortError(error: unknown): boolean {
+  return error instanceof Error && error.name === 'AbortError';
+}
+
+/** Keeps authentication failures out of the recoverable full-file path. */
+export function routeAudioV2MseFailure({ error, contextActive, retire, recover, reportAuthenticationFailure }: AudioV2MseFailureHandlers): void {
+  if (isAbortError(error) || !contextActive) {
+    retire();
+    return;
+  }
+
+  if (error instanceof AudioV2ChunkAuthenticationError) {
+    reportAuthenticationFailure(error);
+    retire();
+    return;
+  }
+
+  recover(error);
+}
diff --git a/web/src/hooks/useCatalog.ts b/web/src/hooks/useCatalog.ts
index 906a059..8e029e2 100644
--- a/web/src/hooks/useCatalog.ts
+++ b/web/src/hooks/useCatalog.ts
@@ -12,6 +12,7 @@ import {
   canStreamAudioV2WithMse,
   decryptAudioV2Chunk,
   decryptAudioV2Container,
+  importAudioV2ContentKey,
   initialAudioV2HeaderRangeEnd,
   parseAudioV2HeaderPrefix,
   type ParsedAudioV2
@@ -19,6 +20,8 @@ import {
 import { isPolicyManagedTrack } from '../features/access/accessPolicy';
 import { catalogLoadFailureStatus } from '../features/catalog/catalogStatus';
 import { fetchAudioV2RangeThroughGateways, type AudioV2GatewayPhase, type AudioV2RangeResult } from '../features/catalog/audioV2Gateway';
+import { pumpAudioV2ReadAhead } from '../features/catalog/audioV2Pipeline';
+import { AudioV2ChunkAuthenticationError, routeAudioV2MseFailure } from '../features/catalog/audioV2Recovery';
 import { runtimeAddressFromTrackId } from '../features/catalog/trackModel';
 import { decodeAccessMode, decodePersonhood } from '../features/runtime/accessEncoding';
 import {
@@ -58,13 +61,6 @@ import type { ConnectedWallet } from './useWallet';
 
 const zeroAddress = '0x0000000000000000000000000000000000000000' as const;
 
-class AudioV2ChunkAuthenticationError extends Error {
-  constructor(readonly cause: unknown) {
-    super('DAV2 chunk authentication failed');
-    this.name = 'AudioV2ChunkAuthenticationError';
-  }
-}
-
 type AudioV2StartupPhase =
   | 'key-authorized'
   | 'gateway-selected'
@@ -494,9 +490,15 @@ export function useCatalog(deps: UseCatalogDeps) {
     }
   }
 
-  async function fetchAudioV2Range(context: AudioV2StartupContext, start: number, end: number, phase: AudioV2GatewayPhase): Promise<AudioV2RangeResult> {
-    throwIfAborted(context.signal);
-    return fetchAudioV2RangeThroughGateways(context.cid, start, end, { phase, signal: context.signal });
+  async function fetchAudioV2Range(
+    context: AudioV2StartupContext,
+    start: number,
+    end: number,
+    phase: AudioV2GatewayPhase,
+    signal: AbortSignal = context.signal
+  ): Promise<AudioV2RangeResult> {
+    throwIfAborted(signal);
+    return fetchAudioV2RangeThroughGateways(context.cid, start, end, { phase, signal });
   }
 
   async function fetchAudioV2Header(context: AudioV2StartupContext): Promise<ParsedAudioV2> {
@@ -587,7 +589,12 @@ export function useCatalog(deps: UseCatalogDeps) {
       sourceBuffer.addEventListener('error', handleError, { once: true });
       sourceBuffer.addEventListener('abort', handleError, { once: true });
       signal?.addEventListener('abort', handleAbort, { once: true });
-      sourceBuffer.appendBuffer(bytes);
+      try {
+        sourceBuffer.appendBuffer(bytes);
+      } catch {
+        cleanup();
+        reject(new Error('Unable to append DAV2 audio chunk'));
+      }
     });
   }
 
@@ -598,53 +605,66 @@ export function useCatalog(deps: UseCatalogDeps) {
     parsed: ParsedAudioV2,
     key: Uint8Array
   ): Promise<void> {
-    for (const chunk of parsed.header.chunks) {
-      throwIfAborted(context.signal);
-      const chunkStart = parsed.bodyOffset + audioV2ChunkBodyOffset(parsed.header, chunk.index);
-      const chunkEnd = chunkStart + chunk.encryptedLength - 1;
-      const range = await fetchAudioV2Range(context, chunkStart, chunkEnd, chunk.index === 0 ? 'first-chunk' : 'chunk');
-      if (chunk.index === 0) {
-        publishAudioV2StartupMetric(context, {
-          phase: 'first-range-ready',
-          gatewayUrl: range.gatewayUrl,
-          rangeStart: chunkStart,
-          rangeEnd: chunkEnd,
-          chunkIndex: chunk.index,
-          hedged: range.hedged,
-          fromCache: range.fromCache
-        });
-      }
-      let clear: Uint8Array;
-      try {
-        clear = await decryptAudioV2Chunk(parsed.header, chunk.index, range.bytes, key);
-      } catch (error) {
-        throw new AudioV2ChunkAuthenticationError(error);
-      }
-      throwIfAborted(context.signal);
-      if (chunk.index === 0) {
-        publishAudioV2StartupMetric(context, {
-          phase: 'first-chunk-decrypted',
-          gatewayUrl: range.gatewayUrl,
-          rangeStart: chunkStart,
-          rangeEnd: chunkEnd,
-          chunkIndex: chunk.index,
-          hedged: range.hedged,
-          fromCache: range.fromCache
-        });
-      }
-      await appendSourceBuffer(sourceBuffer, clear, context.signal);
-      if (chunk.index === 0) {
-        publishAudioV2StartupMetric(context, {
-          phase: 'first-chunk-appended',
-          gatewayUrl: range.gatewayUrl,
-          rangeStart: chunkStart,
-          rangeEnd: chunkEnd,
-          chunkIndex: chunk.index,
-          hedged: range.hedged,
-          fromCache: range.fromCache
-        });
+    const cryptoKeyPromise = importAudioV2ContentKey(key).catch(error => {
+      throw new AudioV2ChunkAuthenticationError(error);
+    });
+
+    await pumpAudioV2ReadAhead({
+      chunks: parsed.header.chunks,
+      signal: context.signal,
+      prepareChunk: async (chunk, signal) => {
+        throwIfAborted(signal);
+        const chunkStart = parsed.bodyOffset + audioV2ChunkBodyOffset(parsed.header, chunk.index);
+        const chunkEnd = chunkStart + chunk.encryptedLength - 1;
+        const range = await fetchAudioV2Range(context, chunkStart, chunkEnd, chunk.index === 0 ? 'first-chunk' : 'chunk', signal);
+        if (chunk.index === 0) {
+          publishAudioV2StartupMetric(context, {
+            phase: 'first-range-ready',
+            gatewayUrl: range.gatewayUrl,
+            rangeStart: chunkStart,
+            rangeEnd: chunkEnd,
+            chunkIndex: chunk.index,
+            hedged: range.hedged,
+            fromCache: range.fromCache
+          });
+        }
+
+        const cryptoKey = await cryptoKeyPromise;
+        let clear: Uint8Array;
+        try {
+          clear = await decryptAudioV2Chunk(parsed.header, chunk.index, range.bytes, cryptoKey);
+        } catch (error) {
+          throw new AudioV2ChunkAuthenticationError(error);
+        }
+        throwIfAborted(signal);
+        if (chunk.index === 0) {
+          publishAudioV2StartupMetric(context, {
+            phase: 'first-chunk-decrypted',
+            gatewayUrl: range.gatewayUrl,
+            rangeStart: chunkStart,
+            rangeEnd: chunkEnd,
+            chunkIndex: chunk.index,
+            hedged: range.hedged,
+            fromCache: range.fromCache
+          });
+        }
+        return { clear, range, chunkStart, chunkEnd };
+      },
+      appendChunk: async (chunk, prepared, signal) => {
+        await appendSourceBuffer(sourceBuffer, prepared.clear, signal);
+        if (chunk.index === 0) {
+          publishAudioV2StartupMetric(context, {
+            phase: 'first-chunk-appended',
+            gatewayUrl: prepared.range.gatewayUrl,
+            rangeStart: prepared.chunkStart,
+            rangeEnd: prepared.chunkEnd,
+            chunkIndex: chunk.index,
+            hedged: prepared.range.hedged,
+            fromCache: prepared.range.fromCache
+          });
+        }
       }
-    }
+    });
     if (mediaSource.readyState === 'open') mediaSource.endOfStream();
   }
 
@@ -707,18 +727,21 @@ export function useCatalog(deps: UseCatalogDeps) {
         return pumpAudioV2ToMediaSource(mediaSource, sourceBuffer, context, parsed, key);
       })
       .catch(error => {
-        if (isAbortError(error) || !isAudioV2ContextActive(context)) {
-          retireAudioV2MseObjectUrl(context.audioRef, objectUrl);
-        } else if (!(error instanceof AudioV2ChunkAuthenticationError)) {
-          void recoverAudioV2MseFailure(context, key, objectUrl, error);
-        } else {
-          console.warn('DAV2 chunk authentication failed', error);
-          publishAudioV2StartupMetric(context, {
-            phase: 'error',
-            detail: errorMessage(error)
-          });
-          retireAudioV2MseObjectUrl(context.audioRef, objectUrl);
-        }
+        routeAudioV2MseFailure({
+          error,
+          contextActive: isAudioV2ContextActive(context),
+          retire: () => retireAudioV2MseObjectUrl(context.audioRef, objectUrl),
+          recover: recoverableError => {
+            void recoverAudioV2MseFailure(context, key, objectUrl, recoverableError);
+          },
+          reportAuthenticationFailure: authenticationError => {
+            console.warn('DAV2 chunk authentication failed', authenticationError);
+            publishAudioV2StartupMetric(context, {
+              phase: 'error',
+              detail: errorMessage(authenticationError)
+            });
+          }
+        });
         if (mediaSource.readyState === 'open') {
           try {
             mediaSource.endOfStream('decode');
diff --git a/web/src/hooks/useSession.ts b/web/src/hooks/useSession.ts
index 8167286..3e5de8e 100644
--- a/web/src/hooks/useSession.ts
+++ b/web/src/hooks/useSession.ts
@@ -631,8 +631,9 @@ export function useSession(deps: UseSessionDeps) {
       // changes, the browser can add the new source track to every existing
       // captured stream before this replacement finishes. Stopping the old
       // stream would then stop the newly selected source and leave listeners
-      // with a live-looking but silent sender. Once replaceTrack resolves, the
-      // previous stream is unreferenced and the browser can retire it.
+      // with a live-looking but silent sender. Once sender replacement or
+      // renegotiation completes, the previous stream is unreferenced and the
+      // browser can retire it.
     } catch (streamError) {
       setError(streamError instanceof Error ? streamError.message : 'Audio capture unavailable in this browser');
       setSessionStatus('Capture unavailable');
diff --git a/web/src/shared/utils/audioV2.test.ts b/web/src/shared/utils/audioV2.test.ts
index bbdd4ae..d96e19f 100644
--- a/web/src/shared/utils/audioV2.test.ts
+++ b/web/src/shared/utils/audioV2.test.ts
@@ -1,4 +1,4 @@
-import { describe, expect, it } from 'vitest';
+import { afterEach, describe, expect, it, vi } from 'vitest';
 import { AudioV2HeaderIncompleteError, decryptAudioV2Container, parseAudioV2Container, parseAudioV2HeaderPrefix } from './audioV2';
 
 const CONTENT_HASH = `0x${'ab'.repeat(32)}`;
@@ -67,14 +67,20 @@ async function makeContainer() {
 }
 
 describe('audioV2 browser helpers', () => {
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
   it('parses and decrypts a DAV2 container', async () => {
     const { container, plaintext } = await makeContainer();
+    const importKeySpy = vi.spyOn(crypto.subtle, 'importKey');
     const parsed = parseAudioV2HeaderPrefix(container.slice(0, 1024));
     expect(parsed.header.mediaMime).toBe('audio/mpeg');
 
     const decrypted = await decryptAudioV2Container(container, KEY);
     expect(decrypted.mediaMime).toBe('audio/mpeg');
     expect(decrypted.bytes).toEqual(plaintext);
+    expect(importKeySpy).toHaveBeenCalledTimes(1);
   });
 
   it('reports how many bytes are needed for an incomplete header', async () => {
diff --git a/web/src/shared/utils/audioV2.ts b/web/src/shared/utils/audioV2.ts
index b3530fd..8f23107 100644
--- a/web/src/shared/utils/audioV2.ts
+++ b/web/src/shared/utils/audioV2.ts
@@ -133,10 +133,15 @@ export function audioV2ChunkBodyOffset(header: AudioV2Header, index: number): nu
   return offset;
 }
 
-export async function decryptAudioV2Chunk(header: AudioV2Header, index: number, encryptedChunk: Uint8Array, key: Uint8Array): Promise<Uint8Array> {
+export async function importAudioV2ContentKey(key: Uint8Array): Promise<CryptoKey> {
+  if (key.length !== 32) throw new Error('DAV2 decryption requires a 32-byte key');
+  return crypto.subtle.importKey('raw', key, 'AES-GCM', false, ['decrypt']);
+}
+
+export async function decryptAudioV2Chunk(header: AudioV2Header, index: number, encryptedChunk: Uint8Array, key: Uint8Array | CryptoKey): Promise<Uint8Array> {
   const chunk = header.chunks[index];
   if (!chunk || encryptedChunk.length !== chunk.encryptedLength) throw new Error('Invalid DAV2 encrypted chunk');
-  const cryptoKey = await crypto.subtle.importKey('raw', key, 'AES-GCM', false, ['decrypt']);
+  const cryptoKey = key instanceof Uint8Array ? await importAudioV2ContentKey(key) : key;
   return new Uint8Array(
     await crypto.subtle.decrypt(
       {
@@ -152,11 +157,12 @@ export async function decryptAudioV2Chunk(header: AudioV2Header, index: number,
 
 export async function decryptAudioV2Container(container: Uint8Array, key: Uint8Array): Promise<{ bytes: Uint8Array; mediaMime: string }> {
   const parsed = parseAudioV2Container(container);
+  const cryptoKey = await importAudioV2ContentKey(key);
   const clearChunks: Uint8Array[] = [];
   let encryptedOffset = parsed.bodyOffset;
   for (const chunk of parsed.header.chunks) {
     const encrypted = container.slice(encryptedOffset, encryptedOffset + chunk.encryptedLength);
-    clearChunks.push(await decryptAudioV2Chunk(parsed.header, chunk.index, encrypted, key));
+    clearChunks.push(await decryptAudioV2Chunk(parsed.header, chunk.index, encrypted, cryptoKey));
     encryptedOffset += chunk.encryptedLength;
   }