Loudness matching, quiet listening and a peak limiter — an opt-in WebAudio graph that routes only after a gesture, and only a CORS-clean source
All three are off unless the host opts in. Press play, then drag the volume down: quiet listening's amount rises as the level drops. The rider's gain moves slowly by design — coming down off a loud passage is quick, going up is slow enough to be inaudible, and it never lifts more than +2.6 dB.
Not routed yet — press play (the element is routed only once the audio context is running, i.e. after a gesture).
crossoriginRouting an element into WebAudio is permanent, and a source that isn't CORS-clean outputs
silence — even a same-origin URL, if it redirects to storage on another origin. So unless
the src is blob:/data: or crossorigin is set, the player
refuses to route, reports status: 'cors', and the audio plays exactly as the
element alone would. Serve the media with Access-Control-Allow-Origin and pass crossorigin="anonymous" to light the features up.
Status: off — Not routed yet — press play (the element is routed only once the audio context is running, i.e. after a gesture).