Recover stalled original-asset downloads within the existing deadline

The original-asset import has repeatedly stopped before conversion or tests when the archive transfer reached its existing two-minute deadline: landscape CI and UI CI, first attempts. Rerunning the unchanged jobs downloads the pinned archive successfully, but does not correct the recovery gap.

verifiedDownload retries selected HTTP server statuses. A thrown connection/read failure bypasses the retry loop, and an inactive response has no shorter inactivity policy within the total deadline. A real local HTTP reproduction sends four bytes, then stalls and disconnects while a healthy second response is available. The old public downloader made one request, rejected with ECONNRESET after 12,014 ms and left no output file. A retained fast regression also fails after three real seconds because the stalled first response is never replaced. No clocks or HTTP are mocked.

Source owner: scripts/lib/verified-download.ts in the game repository. Parent #20; related #90 and #219.

Acceptance:

• Retain the public-interface partial-transfer failure, including its complete-byte/hash and no-partial-publication expectations.
• Recover transient connection/read failures and stalls before headers or between body chunks, retrying the same URL within the existing total 120,000 ms deadline and three-attempt cap. Keep the existing bounded backoff.
• Measure inactivity independently of healthy transfer duration. A transfer that keeps making byte progress may last longer than the inactivity window. Empty chunks do not reset progress. Production inactivity is capped at 30,000 ms; callers may shorten it, never extend either guard.
• Keep permanent HTTP failures, checksum mismatches and corrupt cached archives terminal. Never combine bytes from different attempts, write a partial archive, cache an unverified transfer or substitute a mirror.
• Abort/cancel each retired request and release stream readers and timers. Exhausted recovery fails with useful transfer diagnostics and no output file.
• Exercise real HTTP header/body stalls, steady progress, exhaustion, fresh/cached integrity and existing HTTP retry behavior without changing the unit-test deadline. Verify a fresh real archive with its pinned hash and the normal asset conversion/provenance pipeline.
• Run lint, types, complete units, original asset checks, production build and all browser gates. Qualify the pushed version and original diagnostics before closing.

This is download reliability work. It changes no game rules, CI limits, original asset identities, redistribution policy or native qualification.

The public downloader now recovers header stalls, partial-body stalls and transport/read failures inside the original two-minute total deadline and three-attempt cap. Inactivity is capped at 30 seconds and resets only on actual received bytes. Complete-byte verification remains outside the retry loop, so bad checksums are terminal and incomplete attempts never reach disk or get joined to later responses. Retired requests, readers and timers are cleaned up.

All nine real HTTP tests passed, including a healthy transfer lasting longer than its inactivity window, retry exhaustion, permanent statuses, cached integrity and rejection of any attempt to extend the guard. The original five-second unit-test deadline is unchanged. A fresh download from the original archive URL also passed with the pinned checksum: 50,875,904 bytes in 37.9 seconds using production defaults. Normal asset conversion and verification passed for all 95 converted files.

Lint and application/tools/STX types passed. The complete local gate is still running, and this correction has not been published or qualified in CI yet. The issue remains open.

Stalled and interrupted archive transfers now recover through the normal downloader. Retired requests are canceled, partial bytes are discarded, and a file is published only after the complete pinned hash matches. Healthy byte progress has its own inactivity measurement; the total two-minute deadline, three-attempt cap and backoff remain unchanged. Failures include the transfer phase and byte count.

Real HTTP checks cover header/body stalls, steady progress, exhaustion, cancellation and integrity. A fresh original archive also passed its pinned hash and the normal conversion/provenance checks. A real continuously progressing transfer was canceled at the existing two-minute boundary without publishing a file.

CI passed: lint, types, all 417 unit tests, original asset verification, production build and all 16 browser suites with 546 steps and no console, request or collection errors. The original diagnostic ZIP was checked against the API digest and every ZIP CRC. Terrain ran at actual 1x/2x, and the full ten-minute battle and save/reload checks passed.

The older archive timeouts did not record enough transfer detail to establish whether each was inactive or progressing too slowly. The new diagnostics preserve that distinction. This closes the downloader recovery scope; original Gold runtime and native gameplay qualification remain separate.