fix(studio): a thumbnail reader forgets a start's failures after a minute - #6642

Summary

Follow-up to #6629, from Genesis's review. A pooled thumbnail reader's per-start retry budget never reset, so two transient failures at one start early in a session made a third one, much later, give up at once. That retired the reader and showed the clip as an error.

A start's failures are now forgotten when a read from that start ends cleanly: either its body finishes, or mediabunny stops it at its target. mediabunny never cancels the body; _runWorker aborts the signal it passed in. So the request listens on its own signal, which follows mediabunny's and is unlinked once the read ends, and counts an abort as clean only when mediabunny's signal is the one aborted: never a stall (8 s silence) or a dispose (cancelReads).

I ruled out two other designs:

• Clearing the count when bytes arrive. A server that ignores Range re-sends from byte 0 before it breaks at the same byte, so every attempt delivers bytes and the budget would never run out. The existing test gives up on a server that ignores Range and breaks at the same byte fails under that version.
• A one-minute window (this PR's first version). It only held while each attempt took under a minute. An attempt has no time limit before its answer, and a body that keeps sending never trips the 8 s stall, so a slow server that breaks past a minute re-downloaded from 0 forever (Genesis's review). A server that breaks before the target never ends a read cleanly, so its budget still runs out, however slowly it fails.

No visible change

Retry bookkeeping in mediaFetch.ts: 10 lines, no .tsx, .css or .html. A thumbnail looks the same; it just stops failing when a start that once failed twice comes back later.

What I measured

• mediaFetch.test.ts: 32 pass. Four of those tests are new:
  • a clean finish resets the budget;
  • mediabunny aborting its own signal mid-body (as _runWorker does at its target) resets the budget;
  • a read that broke before that abort keeps its count;
  • failures 20 minutes apart (fake clock) with no clean end still run out after two retries.
• The existing unlinks every request from mediabunny's signal however it ends caught a first version that listened on mediabunny's signal directly.
• fails without the fix: five mutations, each caught by a test:
  • no reset at all;
  • no reset on finish;
  • no reset on stop at target;
  • any abort counted as clean (a stall would reset its own budget);
  • reset on bytes (the Range test).
• The comment ratchet passes, and so do the pre-commit hooks (lint, format, fallow, typecheck).

What I did NOT exercise

• A real long session against a flaky server. This only exercises the retry arithmetic, against stubbed fetch.

🤖 Generated with Claude Code