feat: make media inspection progressive

docs/ARCHITECTURE.md

@@ -27,8 +27,10 @@ Browser storage boundary
 ```
 
 - `src/toolbox/` owns the one typed manifest and suite integration.
-- `src/media/` normalizes ffprobe JSON, duration/timecode, stream selection,
-  playback MIME decisions and safe names.
+- `src/media/` reads lightweight browser-native metadata, normalizes
+  authoritative ffprobe JSON, and owns duration/timecode, stream-selection,
+  playback-MIME and safe-name decisions. Browser metadata and probe data are
+  deliberately separate models.
 - `src/project/` owns the versioned, non-destructive project document and
   migrations. A source is represented by identity/metadata and must be
   reattached after load; the current application does not persist source bytes.
@@ -51,20 +53,35 @@ raw command field.
 
 ## FFmpeg lifecycle
 
-1. Inspect secure-context, worker, `crossOriginIsolated` and
+1. Import creates an object URL immediately. A detached native media element
+   reads duration/dimensions where supported; playback and file identity do not
+   initialize FFmpeg.
+2. Detailed inspection remains idle until the user requests it or an operation
+   requires codecs, complete streams, chapters, tags or dispositions.
+3. Inspect secure-context, worker, `crossOriginIsolated` and
    `SharedArrayBuffer` availability.
-2. Select MT only when all MT prerequisites are true (or ST when explicitly
+4. Select MT only when all MT prerequisites are true (or ST when explicitly
    selected). A failed MT load is terminated and retried once with ST.
-3. Load wrapper/core assets via base-relative, same-origin URLs.
-4. Query version/build configuration/formats/codecs/encoders/filters
+5. Load wrapper/core assets via base-relative, same-origin URLs.
+6. Query version/build configuration/formats/codecs/encoders/filters
    sequentially and publish immutable capability state.
-5. For one job, validate resource estimates and structured settings, allocate
+7. For one job, validate resource estimates and structured settings, allocate
    a generated directory, mount/write inputs, run a generated argument array,
    read only declared outputs, and re-probe applicable results.
-6. Return result bytes and an export report, then unmount/delete virtual files.
-7. Retain the idle engine for the next sequential job; terminate it on mode
+8. Return result bytes and an export report, then unmount/delete virtual files.
+9. Retain the idle engine for the next sequential job; terminate it on mode
    changes, unrecoverable errors or cancellation.
 
+A detailed-probe failure changes only the inspection state. The File, object
+URL, browser metadata and provisional timeline clip remain available, and the
+user can retry. An authoritative probe supersedes browser duration/dimensions
+and reconciles an untouched provisional full-source clip.
+
+The reviewed Emscripten runtime can stall when Firefox probes on a core that
+has retained prior application state. Before an explicit Firefox probe, the
+manager recreates the identical ST/MT core and reuses only that mode's already
+validated capability inventory. Chromium retains the normal warm-core path.
+
 The FFmpeg instance is a single process. `maxConcurrentFFmpegJobs` is one and
 no probe/export operations overlap on it. The application-facing scheduler is
 also bounded: it retains at most eight scheduled operations in memory,

docs/KNOWN_LIMITATIONS.md

@@ -45,6 +45,9 @@ FFmpeg output does not remove these product/browser/resource limits.
   presets from runtime formats/codecs/encoders/filters.
 - FFmpeg-readable output may be download-only because browser media elements
   support fewer container/codec combinations.
+- Browser-native basic information intentionally omits codecs, complete stream
+  lists, chapters, tags, subtitles, attachments and dispositions. Features
+  that need those details request an authoritative local FFprobe pass.
 - Browser support, codec policy and memory differ across Chromium, Firefox and
   Safari and across desktop/mobile versions.
 - The reviewed 0.12.10 core profile passes the non-empty Opus encode/re-probe
@@ -83,9 +86,11 @@ FFmpeg output does not remove these product/browser/resource limits.
   together; development-only smoke artifacts must not be distributed.
 - Chromium covers a broad real pinned-core ST operation matrix, a real MT
   H.264/AAC conversion, MT-to-ST fallback, nested static/Toolbox-context
-  loading and one two-size ST/MT performance baseline. Firefox, Safari, mobile,
-  exhaustive MT feature parity and repeated performance measurements remain
-  unrecorded. Live Portal container/header verification is a deployment gate.
+  loading and one two-size ST/MT performance baseline. Firefox covers the
+  opt-in large-file browser-metadata/playback-to-authoritative-probe
+  regression. Broad Firefox operation parity, Safari, mobile, exhaustive MT
+  feature parity and repeated performance measurements remain unrecorded. Live
+  Portal container/header verification is a deployment gate.
 
 See `docs/FORMAT_SUPPORT.md`, `docs/PERFORMANCE.md`,
 `docs/PORTAL_REQUIREMENTS.md` and `docs/RELEASE.md` for testable detail.

docs/PERFORMANCE.md

@@ -80,11 +80,15 @@ frames meet the threshold. The documented ffmpeg.wasm input ceiling is 2 GiB,
 but real limits can be substantially lower on mobile or memory-constrained
 browsers.
 
-Source inspection has a bounded, size-aware watchdog: 30 seconds for small
-files, a two-MiB-per-second scan budget for larger files, and a five-minute
-ceiling. Recognized local audio/video can begin browser playback from its
-temporary object URL while that worker inspection continues; completed probe
-metadata remains authoritative for editing and export.
+Import does not start FFmpeg. Recognized local audio/video can begin browser
+playback from its temporary object URL while a native media element reads
+lightweight duration/dimensions. Detailed FFprobe inspection starts only when
+requested or required for an export and has a bounded, size-aware watchdog:
+30 seconds for small files, a two-MiB-per-second budget for larger files, and a
+five-minute ceiling. A detailed-inspection timeout is nonfatal; browser
+playback and basic file information remain available. Completed probe metadata
+remains authoritative for stream mapping, remux safety, chapters, tags,
+subtitles/attachments and export validation.
 
 Lowering resolution, duration, frame rate, passes and output count reduces
 work. MT can be faster but consumes more memory/CPU and requires isolation; ST