fix(plex): the reclaim window rolls, and a refused finish is not performed through a third route

Two ways round 6's own fixes did not bound what their comments said they bounded.

The reclaim budget's window anchor was written only where the window RESET, so it marked the window's
start rather than the last loss — a tumbling window, not the rolling one the constant is named for.
Any loss cadence slower than half the window satisfied the reset on every second loss, so the budget
never reached its bound: measured over 200 loss cycles, 61/70/90/119s apart all gave 200 reclaims and
never an error, while 5s and 30s apart correctly gave two and then the honest answer. The failing
band is exactly the case the ERROR handler names — a transcode that falls behind realtime — and both
committed tests spaced their losses 0s and 10min apart, i.e. outside it. The anchor now moves with
every loss.

And `finish`'s refusal handler lowered the play-through latch, which is the only gate on the 10s
interval, the page-hide beacon and `settle`. All three post `absRef`, which on the play-to-the-end
path IS the end of the media, and the backend reads a position within `_FINISH_MARGIN_S` of the
duration as a finish — so within ten seconds of the toast saying the mark had failed, the item was
marked watched, its position cleared and a scrobble sent to Plex. Round 6 closed the explicit
rollback write and left the other three open; the test it added set `upNext: false`, which tears the
effect down before any of them can fire. The refusal now takes back the CLAIM rather than the latch:
a second flag stops `settle` re-asserting watched, and playing again clears both.

`FINISH_MARGIN_S` duplicated the backend's constant in a second language with nothing relating them,
and its comment had the asymmetry backwards — if the BACKEND's margin grows, this guard starts
admitting a rollback the backend reads as a finish, i.e. re-opens the defect above. Pinned by a
contract test that reads the Python, and the comment corrected.

frontend/src/components/PlexPlayer.hls.dom.test.tsx

@@ -220,6 +220,34 @@ describe("an HLS session the server no longer has", () => {
     }
   });
 
+  it("gives up on a session lost over and over on a SLOW cadence too", async () => {
+    // The window's anchor used to be written only where the window RESET, so it marked the start of
+    // the window instead of the last loss — a tumbling window, not the rolling one the constant is
+    // named for. Any cadence slower than half the window then cleared the budget on every second
+    // loss and the bound never bit: a transcode falling ~70s behind realtime — the case the ERROR
+    // handler itself names — reclaimed forever (measured: 200 losses 70s apart → 200 reclaims,
+    // never an error). The two cases above space their losses 0s and 10min apart, i.e. both sit
+    // outside the 60–120s band where the defect lived (deep-review round 7).
+    vi.useFakeTimers({ shouldAdvanceTime: true, toFake: ["Date"] });
+    try {
+      const session = mount();
+      const v = () => document.querySelector("video") as Media;
+      for (let i = 0; i < 6 && !screen.queryByText("plex.player.errGeneric"); i++) {
+        await waitFor(() => expect(hlsInstances).toHaveLength(i + 1));
+        act(() => hlsInstances[i]!.emit(Hls.Events.MANIFEST_PARSED));
+        v()._t = 700;
+        act(() => void v().dispatchEvent(new Event("timeupdate")));
+        act(() => hlsInstances[i]!.emit(Hls.Events.ERROR, lost404));
+        act(() => void vi.setSystemTime(Date.now() + 70_000));
+      }
+      await screen.findByText("plex.player.errGeneric");
+      // Two reclaims, each within two minutes of the loss before it — then the honest answer.
+      expect(session).toHaveBeenCalledTimes(3);
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+
   it("is a failure, not a restart, when the session never played", async () => {
     // Otherwise a session that 404s from the start would restart itself in a loop.
     const session = mount();

frontend/src/components/PlexPlayer.session.dom.test.tsx

@@ -382,6 +382,44 @@ describe("leaving an item that was played through", () => {
     expect(progress.mock.calls.filter(([id, , , final]) => id === "A" && final)).toEqual([]);
   });
 
+  it("performs the refused mark through no OTHER route while it stays on the finished item", async () => {
+    // Round 6 guarded the explicit rollback write, but the same catch lowered the play-through
+    // latch — and that latch is the only gate on the 10s interval, the page-hide beacon and
+    // `settle`. All three post `absRef`, which on this path IS the end of the media, and the
+    // backend reads a position within `_FINISH_MARGIN_S` of the duration as a finish: within ten
+    // seconds of the toast saying the mark had failed, the item was watched, its position cleared
+    // and a scrobble sent to Plex (deep-review round 7). `upNext` is ON here — the default — so the
+    // player STAYS on the finished item and those routes are live; the round-6 test above turns it
+    // off, which tears the effect down before any of them can fire.
+    prefs({ upNext: true });
+    const beacon = vi.spyOn(api, "plexProgressBeacon").mockImplementation(() => {});
+    const { qc, progress, unmount } = mount({
+      details: { A: item("A"), B: item("B") },
+      sessions: { A: () => Promise.resolve(direct("A")), B: () => new Promise(() => {}) },
+      queue: ["A", "B"],
+    });
+    vi.spyOn(api, "plexSetState").mockRejectedValue(new Error("offline"));
+    await playingAt("/media/A", 2995);
+    endMedia(); // the up-next card is up, the item is finished, and the mark comes back refused
+    await tick();
+    progress.mockClear();
+
+    // The viewer closes the tab while the failed-mark toast is still up.
+    act(() => void window.dispatchEvent(new Event("pagehide")));
+    expect(beacon).not.toHaveBeenCalled();
+
+    // The refusal dropped the cached detail — and the open player's own observer refetches it, so
+    // by the time the viewer leaves there is an entry again. `settle` must not re-assert watched
+    // onto it: only the server is honest about this item now.
+    act(() => void qc.setQueryData(qk.plexItem("A", "en"), item("A")));
+
+    // And leaving the player: `settle` must neither post the end position nor re-assert watched.
+    unmount();
+    await tick();
+    expect(progress.mock.calls.filter(([id]) => id === "A")).toEqual([]);
+    expect(qc.getQueryData<PlexItemDetail>(qk.plexItem("A", "en"))?.status).not.toBe("watched");
+  });
+
   it("does restore the position when the refused finish came from the credits skip", async () => {
     // The other caller of the same helper captures a MID-episode position, and there the rollback
     // is the point: without it the viewer loses the stretch they watched. One helper, two callers,

frontend/src/components/PlexPlayer.tsx

@@ -435,9 +435,15 @@ export default function PlexPlayer({ itemId, onClose, queue }: Props) {
           if (parsed && data.type === Hls.ErrorTypes.NETWORK_ERROR && data.response?.code === 404) {
             const now = Date.now();
             // A new window: the last loss was long enough ago that this is a fresh incident, not the
-            // same session being lost over and over.
-            if (now - restartsRef.current.at > RECLAIM_WINDOW_MS)
-              restartsRef.current = { n: 0, at: now };
+            // same session being lost over and over. The anchor moves with EVERY loss, because with
+            // it left at the window's start the window tumbled instead of rolling: any loss period
+            // longer than half the window satisfied the reset on every second loss, so the budget
+            // never reached its bound and the reclaim loop it exists to end ran forever (measured:
+            // 200 losses 70s apart → 200 reclaims, never an error; 5s apart → 2 and an error, which
+            // is why the committed test, spacing its cases 0s and 10min apart, could not see it —
+            // deep-review round 7).
+            if (now - restartsRef.current.at > RECLAIM_WINDOW_MS) restartsRef.current.n = 0;
+            restartsRef.current.at = now;
             if (restartsRef.current.n < MAX_SESSION_RECLAIMS) {
               restartsRef.current.n += 1;
               loadSession(playhead(absRef, loadStartRef), !video.paused);