feat: make media inspection progressive

docs/ARCHITECTURE.md

@@ -27,8 +27,10 @@ Browser storage boundary
 ```
 
 - `src/toolbox/` owns the one typed manifest and suite integration.
-- `src/media/` normalizes ffprobe JSON, duration/timecode, stream selection,
-  playback MIME decisions and safe names.
+- `src/media/` reads lightweight browser-native metadata, normalizes
+  authoritative ffprobe JSON, and owns duration/timecode, stream-selection,
+  playback-MIME and safe-name decisions. Browser metadata and probe data are
+  deliberately separate models.
 - `src/project/` owns the versioned, non-destructive project document and
   migrations. A source is represented by identity/metadata and must be
   reattached after load; the current application does not persist source bytes.
@@ -51,20 +53,35 @@ raw command field.
 
 ## FFmpeg lifecycle
 
-1. Inspect secure-context, worker, `crossOriginIsolated` and
+1. Import creates an object URL immediately. A detached native media element
+   reads duration/dimensions where supported; playback and file identity do not
+   initialize FFmpeg.
+2. Detailed inspection remains idle until the user requests it or an operation
+   requires codecs, complete streams, chapters, tags or dispositions.
+3. Inspect secure-context, worker, `crossOriginIsolated` and
    `SharedArrayBuffer` availability.
-2. Select MT only when all MT prerequisites are true (or ST when explicitly
+4. Select MT only when all MT prerequisites are true (or ST when explicitly
    selected). A failed MT load is terminated and retried once with ST.
-3. Load wrapper/core assets via base-relative, same-origin URLs.
-4. Query version/build configuration/formats/codecs/encoders/filters
+5. Load wrapper/core assets via base-relative, same-origin URLs.
+6. Query version/build configuration/formats/codecs/encoders/filters
    sequentially and publish immutable capability state.
-5. For one job, validate resource estimates and structured settings, allocate
+7. For one job, validate resource estimates and structured settings, allocate
    a generated directory, mount/write inputs, run a generated argument array,
    read only declared outputs, and re-probe applicable results.
-6. Return result bytes and an export report, then unmount/delete virtual files.
-7. Retain the idle engine for the next sequential job; terminate it on mode
+8. Return result bytes and an export report, then unmount/delete virtual files.
+9. Retain the idle engine for the next sequential job; terminate it on mode
    changes, unrecoverable errors or cancellation.
 
+A detailed-probe failure changes only the inspection state. The File, object
+URL, browser metadata and provisional timeline clip remain available, and the
+user can retry. An authoritative probe supersedes browser duration/dimensions
+and reconciles an untouched provisional full-source clip.
+
+The reviewed Emscripten runtime can stall when Firefox probes on a core that
+has retained prior application state. Before an explicit Firefox probe, the
+manager recreates the identical ST/MT core and reuses only that mode's already
+validated capability inventory. Chromium retains the normal warm-core path.
+
 The FFmpeg instance is a single process. `maxConcurrentFFmpegJobs` is one and
 no probe/export operations overlap on it. The application-facing scheduler is
 also bounded: it retains at most eight scheduled operations in memory,