refactor(thumbnail): [PKG-TOOL-THUMB-03] own extraction jobs and source cancellation

packages/artplayer-tool-thumbnail/ARCHITECTURE.md

@@ -1,19 +1,23 @@
 # Thumbnail tool maintenance map
 
-This package is being migrated under PKG-TOOL-THUMB-03. Input ownership and sheet
-export are separated; extraction/source cancellation is still being implemented.
-Strict TS and published declaration work belongs to PKG-TOOL-THUMB-04. Do not
-infer complete migration or release readiness from this checkpoint.
+The runtime responsibilities are separated under PKG-TOOL-THUMB-03. Strict TS and
+published declaration work belongs to PKG-TOOL-THUMB-04. Runtime restructuring
+does not imply complete migration or release readiness.
 
 | File | Responsibility |
 | --- | --- |
-| src/index.js | Public class, historical method names, file/video events, current extraction loop and destruction entry |
+| src/index.js | Public class, historical method names, construction and destruction entry |
+| src/lifecycle.js | Private state, source/input generations, cancellation and resource release |
+| src/source.js | File loading, native metadata/error listeners and source/thumbnail Blob URLs |
+| src/extraction.js | Owned metadata wait and serial frame job, callback/error completion and cancellation |
 | src/input.js | Option validation/clamps, file-input wrapper creation, listener registration/replacement and release |
 | src/sheet.js | Midpoint grid, canvas/footer geometry, temporary download anchor |
 | src/emitter.js | Existing on/once/emit/off semantics; provenance review remains in 04 |
 | src/utils.js | Existing clamp, filename, sleep and serial-promise helpers |
 
-The entry delegates to input/sheet modules; neither module imports the entry.
+The entry delegates to input/source/extraction/sheet; none imports the entry.
+Input/source use lifecycle state, extraction uses lifecycle/source, and sheet uses
+only filename calculation. There is no dependency back from helpers to the class.
 Input records live in a private WeakMap, so callers replacing `option` cannot
 lose ownership of generated inputs/listeners. Normal construction preserves the
 existing instance-field order and bound inputChange/ondrop methods. DEFAULTS,
@@ -30,9 +34,35 @@ The existing bound ondrop method is now registered correctly.
 Destroy is idempotent and attempts input, video, current URL and destroy-event
 cleanup even when one step throws; the first cleanup error escapes afterward.
 Setup/file-input/drop/load calls cannot recreate input/source resources after
-destruction. The emitter is not globally cleared. This does **not yet** cancel
-existing extraction timers or late Blob callbacks; pending work and replaced
-source URLs remain tracked risks for the rest of 03.
+destruction. The emitter is not globally cleared. Destruction closes the instance
+before cleanup, cancels its job and releases private URLs even if public URL fields
+were overwritten. Current public URLs are also revoked, preserving historical
+destroy behavior. The video is paused, its src removed, load resets its decoder
+state, and its node is removed. Registration checks for reentrant closure/replacement.
+
+## Extraction and event ordering
+
+Loading emits file before assigning video.src, then video synchronously as in
+workspace 4.4.0. A source generation prevents an older file callback or URL creation
+hook from overwriting a nested newer load. Successful replacement revokes old
+source URLs. Native errors report once for their source; stale listeners cannot
+fail the latest job. Existing sheet URLs stay available until the next sheet frame
+or destruction, matching the previous public behavior.
+
+start creates one owned job. Metadata waits use native events plus the existing
+one-second polling fallback. Waiting before the first file adopts that selection;
+replacing an existing source cancels its old job. Duplicate starts are rejected.
+Preflight stays synchronous when metadata is ready. Canvas precedes processing=true;
+updates observe true, done observes false and may start another job without old
+completion clearing the new state.
+
+Frames wait for readiness/seek, accept readiness/Blob callbacks once and restore
+oncanplay only while still owning it. Seek/draw/encoding failures, null Blob and
+throwing callbacks settle the promise and detach job resources. Source replacement
+or destruction rejects with AbortError without an error event. The public promise
+still rejects for awaiting consumers; an internal handler owns ignored cancellation.
+Late callbacks cannot create URLs, emit updates or schedule frames. There is no
+arbitrary new metadata deadline; waiting can be cancelled by destroy/replacement.
 
 Sheet extraction preserves fractional coordinates, historical `creat*` names,
 the 30-pixel footer and the filename algorithm. The temporary download anchor is
@@ -63,8 +93,10 @@ cleanup runs on all three engines, while extraction acceptance needs supported
 Safari/WebKit evidence in 05. The independent tool example is
 `docs/assets/example/tool.thumbnail.js`, not the external thumbnail plugin example.
 
-Continue 03 by introducing owned metadata/extraction jobs and source/thumbnail
-URL cleanup. Add candidate failure/cancellation regressions and preserve old
-tests; do not change default delay/height policy silently. Then migrate the final
-module boundaries to strict TS in 04 and verify installed declarations/old paths.
+`test/thumbnail-lifecycle.test.js` covers jobs, source cancellation, native errors,
+callback failures, reentrancy and private resources. Browser tests hold real PNG
+callbacks and replace a selected file during encoding; only the latest job may
+complete. Continue strict TS and installed declarations in 04; preserve old tests
+and the default delay/height boundary. The old sleep/serial helpers in utils.js are
+no longer used by extraction and can be removed during that migration.
 See [task plan](../../refactor/plan.md) and [risk ledger](../../refactor/risks.json).