Local conversion workflow and failure handling
1) Pick an operation (audio-convert or video-to-gif) and options; 2) budget checks run first: audio 50 MiB/5 min, video 30 MiB/15 s, GIF ≤ 5 s, with 100 MiB+ rejected early; 3) the real MIME is sniffed from header bytes and compared with both extension and declared type; 4) low device memory or unverified codecs produce readable failures with no upload; 5) only then is one worker created, progressing through real phase names validate → sniff → mount-input → load-codec → encode 1/N…N/N → decode-check → publish → release.
The cancel button uses AbortController with a checkpoint at every phase: the worker is terminated, virtual-FS entries cleared and all Blob URLs revoked, after which a second task can start. Leaving the workspace calls dispose() with the same cleanup.
headersForRoute() limits isolation: only /app/ returns COOP same-origin / COEP require-corp; landing, operation, guide and legal pages stay ad-compatible. The manifest headersProfile is isolated-app, written by package:artifact with real values.
This guide documents the injectable media model and state machine; choosing a real browser File returns a readable "browser transcoding unavailable" error because no real encoder is bundled. Real transcoding, ffprobe and browser decode remain unverified.