@torrent-tv/proxy 2.107.57 → 2.107.59

package/bin/cli.js

@@ -14,6 +14,7 @@
 // for the measurement that made it necessary.
 import "./thread-pool.js";
 import { Command } from "commander";
+import { mkdirSync } from "node:fs";
 import os from "node:os";
 import { spawnSync } from "node:child_process";
 import { createRequire } from "node:module";
@@ -35,6 +36,7 @@ import { collectHealthMetrics } from "../services/transport/health-collector.js"
 import { LOAD_REFRESH_MS, ProxyStateReporter } from "../services/transport/proxy-state.js";
 import { createPortMapper } from "../services/transport/port-mapper.js";
 import { installationId } from "../services/identity/installation-id.js";
+import { PROXY_ROOT } from "../services/encode/LocalObservations.js";
 import { classifyNat } from "../services/transport/nat-classifier.js";
 import { DEFAULT_SEGMENT_FORMAT_ID, SEGMENT_FORMAT_IDS } from "../services/encode/segment-formats/index.js";
 import { logToFile, logger } from "../utils/logger.js";
@@ -100,7 +102,7 @@ program
     "--usrsctp-state",
     "Read usrsctp's association state with gdb when a wedge is declared. OFF by default: gdb attaches to THIS process and stops every thread of it while it works."
   )
-  .option("--memory-bytes <bytes>", "Per-torrent budget for pieces kept in memory before spilling to disk (default 512MB)")
+  .option("--memory-bytes <bytes>", "Per-torrent budget for pieces kept in memory before spilling to disk (default: derived from the memory available when the torrent opens, shared equally between open torrents)")
   .option("--budget <kind>", "How much of this machine the proxy may take: adaptive (default), share or fixed")
   .option("--budget-share <fraction>", "With --budget share: the fraction of what is free, 0..1")
   .option("--budget-bytes <bytes>", "With --budget fixed: the ceiling, per resource")
@@ -109,7 +111,7 @@ program
   .option("--ffmpeg-bin <path>", "Path to ffmpeg binary")
   .option(
     "--state-dir <path>",
-    "Where to keep what this host has measured about itself (default: beside the installed proxy)"
+    "Where to keep this installation's id, what this host has measured about itself, and diagnostic dumps (default: the installed proxy's own directory; pass an empty value to keep nothing)"
   )
   .option(
     "--log-file <path>",
@@ -137,7 +139,19 @@ const bindHost = String(options.host);
 const explicitBaseUrl = options.publicBaseUrl
   ? String(options.publicBaseUrl).replace(/\/+$/, "")
   : "";
-const clientId = installationId({ stateDir: options.stateDir, explicitId: options.id });
+// THE STATE DIRECTORY, resolved once: the one named, the installed proxy's own
+// directory when none is named, or "" when the operator passes an empty value
+// (nothing is kept). Every consumer below is handed this value and none reads
+// the option again.
+const stateDir = options.stateDir === undefined ? PROXY_ROOT : String(options.stateDir);
+if (stateDir) {
+  try {
+    mkdirSync(stateDir, { recursive: true });
+  } catch (error) {
+    logger.warn(`Could not create the state directory ${stateDir}: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+const clientId = installationId({ stateDir, explicitId: options.id });
 const clientName = options.name ? String(options.name) : `proxy-${clientId.slice(0, 8)}`;
 const token = String(options.token ?? "");
 const transcodeAudio = options.transcodeAudio !== false;
@@ -347,15 +361,15 @@ async function shutdown(signal) {
 const diagnostics = new Diagnostics({
   logger,
   kinds: [
-    { name: "core dumps", directory: () => options.stateDir || "", matches: (name) => name.startsWith("core.") },
+    { name: "core dumps", directory: () => stateDir, matches: (name) => name.startsWith("core.") },
     {
       name: "heap snapshots",
-      directory: () => options.stateDir || "",
+      directory: () => stateDir,
       matches: (name) => name.endsWith(".heapsnapshot")
     },
     {
       name: "packet captures",
-      directory: () => options.stateDir || "",
+      directory: () => stateDir,
       matches: (name) => name.startsWith("packet-witness")
     }
   ]
@@ -391,7 +405,7 @@ try {
     ffmpegBin,
     memoryBytes,
     segmentFormat: options.segmentFormat,
-    stateDir: options.stateDir,
+    stateDir,
     diagnostics,
     budgetPolicy,
     logFile: options.logFile ?? "",
@@ -444,11 +458,11 @@ try {
   // A native fault writes the whole address space out — 4.18 GB each on the
   // field host, and four of them nearly filled a 235 GB disk. Keep the newest
   // two, which are the evidence for the fault still open, and drop the rest.
-  void pruneCoreDumps(options.stateDir);
+  void pruneCoreDumps(stateDir);
   // Same policy for the packet captures the send-queue witness writes.
   packetWitness = createPacketWitness({
     log: (message) => logger.info(message),
-    dir: options.stateDir || "",
+    dir: stateDir,
     port: actualPort,
     // Evidence takes room from the product, so a capture is asked for rather
     // than taken. Refused, it is a line and not a silence.
@@ -517,8 +531,6 @@ try {
     // read stayed behind the decision to write, so a quiet second costs one
     // call to `process.memoryUsage()`.
     intervalMs: 1_000,
-    quietMs: 60_000,
-    changeBytes: 25 * 1024 * 1024,
     diskPath: os.tmpdir(),
     // WHERE A SNAPSHOT SURVIVES THE PROCESS IT IS ABOUT, and how many are kept
     // — the same answer the torrent worker already had. This scope had neither:
@@ -526,11 +538,8 @@ try {
     // on every restart, and all of them were kept. Fifty-four were written on
     // 2026-09-07 and every one was gone by the time the process that wrote them
     // died of a heap it had never been possible to look at.
-    snapshotDir: options.stateDir || undefined,
+    snapshotDir: stateDir || undefined,
     heapSnapshots: options.heapSnapshots === true,
-    snapshotFloorBytes: 400 * 1024 * 1024,
-    snapshotGrowthBytes: 400 * 1024 * 1024,
-    keepSnapshots: 3
   });
 
   logger.info(`Starting @torrent-tv/proxy v${PROXY_VERSION}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@torrent-tv/proxy",
-  "version": "2.107.57",
+  "version": "2.107.59",
   "description": "Torrent proxy client that exposes webseed-like HTTP stream endpoint.",
   "license": "GPL-3.0-or-later",
   "repository": {

package/services/encode/AdmittedInput.js

@@ -5,7 +5,7 @@ import { pcmNormalization, normalizePcmSlices } from "./pcm-normalization.js";
 const INPUT_WRITE_BATCH_BYTES = 64 * 1024;
 
 /** Acquire complete source ranges before any process can consume the input. */
-export async function admitInput({ sources, reserve, readRanges }) {
+export async function admitInput({ sources, reserve, readRanges, matroskaIdOf }) {
   if (!Array.isArray(sources) || sources.length === 0 || typeof reserve !== "function" || typeof readRanges !== "function") {
     throw new TypeError("Admission requires resolved source inputs, memory reservation and an available-only reader.");
   }
@@ -41,7 +41,7 @@ export async function admitInput({ sources, reserve, readRanges }) {
           pts: packet.pts - (source.timeShiftSeconds ?? 0),
           ...(packet.dts === undefined ? {} : { dts: packet.dts - (source.timeShiftSeconds ?? 0) }) })) };
         tracks.push(shifted);
-        hash.update(matroskaTrackIdentity(input.track));
+        hash.update(matroskaTrackIdentity(input.track, matroskaIdOf));
         hash.update(JSON.stringify(shifted.packets.map(packet => [packet.pts, packet.dts ?? null,
           packet.duration, packet.keyframe === true, packet.ranges, packet.discardPaddingSeconds ?? 0,
           packet.bitOffset ?? null, packet.bitLength ?? null])));
@@ -82,8 +82,8 @@ export async function admitInput({ sources, reserve, readRanges }) {
     }
     retained = true;
     return {
-      kind: "result", bytes, fingerprint: hash.digest("hex"), originSeconds, tracks, readPacket,
-      stream: options => matroskaInput({ tracks,
+      kind: "result", matroskaIdOf, bytes, fingerprint: hash.digest("hex"), originSeconds, tracks, readPacket,
+      stream: options => matroskaInput({ tracks, matroskaIdOf,
         readPacket: (input, packet) => normalized.has(packet) ? [normalized.get(packet)] : packetSlices(input, packet),
         originSeconds, ...options }),
       release: () => {
@@ -112,13 +112,13 @@ export async function admitInput({ sources, reserve, readRanges }) {
 export async function writeAdmittedInput(input, stdin, { next = null, waiting = null, onFirstInputBytes = null } = {}) {
   if (input?.kind !== "result") throw new TypeError("Only complete input may be written to an encoder.");
   const originSeconds = input.originSeconds;
-  const declarations = JSON.stringify(input.tracks.map(input => matroskaTrackIdentity(input.track)));
+  const declarations = JSON.stringify(input.tracks.map(track => matroskaTrackIdentity(track.track, input.matroskaIdOf)));
   const seen = new Map();
   let firstInputBytesNoted = false;
   let current = input, includeHeader = true;
   try {
     while (current) {
-      if (JSON.stringify(current.tracks.map(input => matroskaTrackIdentity(input.track))) !== declarations) {
+      if (JSON.stringify(current.tracks.map(track => matroskaTrackIdentity(track.track, current.matroskaIdOf))) !== declarations) {
         throw new Error("Consecutive encoder input changed its declared tracks.");
       }
       for (let index = 0; index < current.tracks.length; index++) {

package/services/encode/EncodeInputs.js

@@ -67,10 +67,12 @@ export class EncodeInputs {
    */
   #stretchCopied;
   #observeWait;
+  #matroskaIdOf;
 
   constructor({ resolve, readRanges, openWholeFile = null, heldRanges = null, reviseBudget, changed, failed, capacity = () => null, urgent = () => true,
     rankAt = () => null, demandChanged = () => {}, openOf = () => null, log = () => {}, now = Date.now, stretchCopied = () => {},
-    observeWait = null }) {
+    observeWait = null, matroskaIdOf }) {
+    this.#matroskaIdOf = matroskaIdOf;
     this.#stretchCopied = stretchCopied;
     this.#observeWait = observeWait;
     this.#openOf = openOf;
@@ -461,7 +463,7 @@ export class EncodeInputs {
         }
         if (!result) return;
       } else {
-        result = await admitInput({ sources: resolved.sources, readRanges: this.#read, reserve: this.#reserveFor(request) });
+        result = await admitInput({ sources: resolved.sources, readRanges: this.#read, matroskaIdOf: this.#matroskaIdOf, reserve: this.#reserveFor(request) });
         if (result.kind === "result") Object.assign(result, { from: request.from, to: request.from });
       }
       if (this.#requests.get(request.key) !== request) { result.release?.(); return; }

package/services/encode/LocalObservations.js

@@ -48,6 +48,19 @@ import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { configurationKeyOf, kindOfEncoderName } from "./fingerprint.js";
 
+/**
+ * The writer used when none is handed in (a check that only wants the file).
+ * The proxy always hands in the atomic one from `utils/atomic-json.js`, which
+ * this layer may not import.
+ *
+ * @param {string} filePath
+ * @param {unknown} value
+ * @returns {void}
+ */
+function writeInPlace(filePath, value) {
+  writeFileSync(filePath, JSON.stringify(value));
+}
+
 /**
  * The directory of the installed proxy, where these observations are kept when
  * the deployment names no state directory. Deliberately not the working
@@ -84,6 +97,8 @@ export class LocalObservations {
 
   /** @type {{ info: (m: string) => void, warn: (m: string) => void }} */
   #logger;
+  /** @type {(filePath: string, value: unknown) => void} */
+  #writeJson;
 
   /** @type {() => number} */
   #now;
@@ -99,16 +114,19 @@ export class LocalObservations {
    * @param {import("./fingerprint.js").HostFingerprint} params.fingerprint
    * @param {string} params.filePath - Where the readings are kept; empty keeps
    *   them for this process only.
+   * @param {(filePath: string, value: unknown) => void} [params.writeJson] - How
+   *   the file is saved; throws on failure. The atomic writer is handed in.
    * @param {{ info: (m: string) => void, warn: (m: string) => void }} [params.logger]
    * @param {() => number} [params.now]
    */
-  constructor({ fingerprint, filePath, logger = null, now = Date.now }) {
+  constructor({ fingerprint, filePath, writeJson = writeInPlace, logger = null, now = Date.now }) {
     if (!fingerprint || typeof fingerprint !== "object") {
       throw new TypeError("LocalObservations requires the host's fingerprint");
     }
     this.#fingerprint = fingerprint;
     this.#filePath = typeof filePath === "string" ? filePath : "";
     this.#logger = logger ?? { info: () => {}, warn: () => {} };
+    this.#writeJson = writeJson;
     this.#now = now;
   }
 
@@ -367,7 +385,7 @@ export class LocalObservations {
       return;
     }
     try {
-      writeFileSync(this.#filePath, JSON.stringify({ version: FILE_VERSION, entries: this.#entries }));
+      this.#writeJson(this.#filePath, { version: FILE_VERSION, entries: this.#entries });
     } catch (error) {
       // A read-only install keeps what it learned for this process only.
       this.#logger.warn(

package/services/encode/MatroskaInput.js

@@ -2,12 +2,12 @@ import { avcPacketSlices } from "./annex-b-input.js";
 import { bitPayloadSlices } from "./bit-payload.js";
 
 /** Emit already admitted packets as one timestamped Matroska input. */
-export async function* matroskaInput({ tracks, readPacket, originSeconds = 0, includeHeader = true, seen = new Map() }) {
+export async function* matroskaInput({ tracks, readPacket, originSeconds = 0, includeHeader = true, seen = new Map(), matroskaIdOf }) {
   if (!Array.isArray(tracks) || tracks.length === 0 || typeof readPacket !== "function" || !Number.isFinite(originSeconds)) {
     throw new TypeError("A Matroska input requires tracks, admitted packets and a timeline origin.");
   }
   if (includeHeader) {
-  const declarations = tracks.map((input, position) => trackElement(input.track, position + 1));
+  const declarations = tracks.map((input, position) => trackElement(input.track, position + 1, matroskaIdOf));
   yield element("1a45dfa3", Buffer.concat([
     uintElement("4286", 1), uintElement("42f7", 1), uintElement("42f2", 4), uintElement("42f3", 8),
     textElement("4282", "matroska"), uintElement("4287", 4), uintElement("4285", 2)
@@ -107,10 +107,10 @@ export async function* matroskaInput({ tracks, readPacket, originSeconds = 0, in
   }
 }
 
-function trackElement(track, number) {
+function trackElement(track, number, matroskaIdOf) {
   const type = track.type === "video" ? 1 : track.type === "audio" ? 2 : null;
   if (type === null) throw new Error("Admitted input carries an unsupported track type.");
-  const codec = track.matroskaCodecId ?? matroskaCodec(track.codecId);
+  const codec = track.matroskaCodecId ?? matroskaCodec(track.codecId, matroskaIdOf);
   const fields = [uintElement("d7", number), uintElement("73c5", number), uintElement("83", type),
     uintElement("9c", 0), textElement("86", codec)];
   const privateBytes = track.matroskaCodecPrivateB64 ?? track.codecPrivateB64;
@@ -133,9 +133,10 @@ function trackElement(track, number) {
 }
 
 /** Stable identity of every declaration emitted into the input stream. */
-export function matroskaTrackIdentity(track) {
+/** @param {(codec: string) => string | undefined} matroskaIdOf - Names a codec's Matroska id; handed in, since this layer reads no other. */
+export function matroskaTrackIdentity(track, matroskaIdOf) {
   return JSON.stringify([
-    track.type, track.matroskaCodecId ?? matroskaCodec(track.codecId),
+    track.type, track.matroskaCodecId ?? matroskaCodec(track.codecId, matroskaIdOf),
     track.matroskaCodecPrivateB64 ?? track.codecPrivateB64 ?? "",
     track.language ?? "", track.packetFraming ?? "", track.width ?? null, track.height ?? null,
     track.samplingFrequency ?? null, track.channels ?? null, track.bitDepth ?? null,
@@ -143,23 +144,9 @@ export function matroskaTrackIdentity(track) {
   ]);
 }
 
-function matroskaCodec(codec) {
-  if (/^[VA]_/.test(codec)) return codec;
-  if (/^pcm_[su](?:16|24|32|64)le$/.test(codec) || /^pcm_[su]8(?:le|be)?$/.test(codec)) return "A_PCM/INT/LIT";
-  if (/^pcm_[su](?:16|24|32|64)be$/.test(codec)) return "A_PCM/INT/BIG";
-  if (/^pcm_f(?:32|64)(?:le|be)$/.test(codec)) return "A_PCM/FLOAT/IEEE";
-  const declared = new Map([
-    ["avc1", "V_MPEG4/ISO/AVC"], ["avc3", "V_MPEG4/ISO/AVC"], ["h264", "V_MPEG4/ISO/AVC"],
-    ["hvc1", "V_MPEGH/ISO/HEVC"], ["hev1", "V_MPEGH/ISO/HEVC"], ["hevc", "V_MPEGH/ISO/HEVC"],
-    ["av01", "V_AV1"], ["av1", "V_AV1"], ["vp9", "V_VP9"], ["vp8", "V_VP8"],
-    ["mjpeg", "V_MJPEG"], ["ffv1", "V_FFV1"], ["theora", "V_THEORA"], ["jpeg2000", "V_JPEG2000"],
-    ["mpeg1video", "V_MPEG1"], ["mpeg2video", "V_MPEG2"], ["mpeg4", "V_MPEG4/ISO/ASP"],
-    ["FMP4", "V_MPEG4/ISO/ASP"], ["XVID", "V_MPEG4/ISO/ASP"], ["DIVX", "V_MPEG4/ISO/ASP"],
-    ["mp4a", "A_AAC"], ["aac", "A_AAC"], ["mp3", "A_MPEG/L3"], ["mp2", "A_MPEG/L2"], ["mp1", "A_MPEG/L1"],
-    ["ac-3", "A_AC3"], ["ac3", "A_AC3"], ["ec-3", "A_EAC3"], ["eac3", "A_EAC3"],
-    ["Opus", "A_OPUS"], ["opus", "A_OPUS"], ["fLaC", "A_FLAC"], ["flac", "A_FLAC"], ["dts", "A_DTS"],
-    ["vorbis", "A_VORBIS"], ["alac", "A_ALAC"], ["truehd", "A_TRUEHD"]
-  ]).get(codec);
+function matroskaCodec(codec, matroskaIdOf) {
+  if (typeof matroskaIdOf !== "function") throw new TypeError("A Matroska input is given the lookup that names codec ids.");
+  const declared = matroskaIdOf(codec);
   if (!declared) throw new Error(`Admitted codec ${codec} has no Matroska declaration.`);
   return declared;
 }

package/services/encode/decode-cost-fit.js

@@ -334,7 +334,7 @@ export function decodeFamilyOf(source) {
   const codec = typeof source?.codec === "string" ? source.codec.trim().toLowerCase() : "";
   const depth = Number(source?.bitDepth);
   const tenBit = Number.isFinite(depth) && depth >= 10;
-  if (codec === "hevc" || codec === "h265" || codec === "x265") {
+  if (codec === "hevc") {
     return tenBit ? "hevc10" : "hevc";
   }
   // ffmpeg's own names. Only what has a clip set: `msmpeg4v3` (DivX 3) is a

package/services/identity/installation-id.js

@@ -1,9 +1,14 @@
 import { randomUUID } from "node:crypto";
-import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync } from "node:fs";
 import path from "node:path";
+import { writeJsonAtomic } from "../../utils/atomic-json.js";
+import { logger } from "../../utils/logger.js";
 
 const ID_FILE = "proxy-identity.json";
 
+/** Ids that could not be written, by identity file: kept so the process keeps one id. */
+const unsavedIds = new Map();
+
 /**
  * Resolve this installation's registry id. Without a state directory the id
  * remains ephemeral; with one, the id survives process restarts.
@@ -27,12 +32,18 @@ export function installationId({ stateDir, explicitId, makeId = randomUUID } = {
     }
   }
 
-  const id = requestedId || savedId || makeId();
+  const id = requestedId || savedId || unsavedIds.get(file) || makeId();
   if (id !== savedId) {
-    mkdirSync(stateDir, { recursive: true });
-    const temporary = `${file}.${process.pid}.tmp`;
-    writeFileSync(temporary, `${JSON.stringify({ id })}\n`, { mode: 0o600 });
-    renameSync(temporary, file);
+    try {
+      mkdirSync(stateDir, { recursive: true });
+      writeJsonAtomic(file, { id }, { mode: 0o600 });
+      unsavedIds.delete(file);
+    } catch (error) {
+      if (unsavedIds.get(file) !== id) {
+        logger.warn(`Cannot save the proxy identity file ${file} (${error.message}); the installation id lasts only until this process exits`);
+      }
+      unsavedIds.set(file, id);
+    }
   }
   return id;
 }

package/services/media/container/AviContainer.js

@@ -9,6 +9,7 @@
 
 import { FFMPEG_STREAM_SEARCH_SECONDS } from "./ffmpeg-stream-search.js";
 import { Container } from "./Container.js";
+import { MPEG4_FOURCCS } from "../tracks/codec-names.js";
 import { VideoTrack } from "../tracks/VideoTrack.js";
 import { AudioTrack } from "../tracks/AudioTrack.js";
 import { ContainerTrack } from "../tracks/ContainerTrack.js";
@@ -22,7 +23,6 @@ import { ac3Frame } from "./ac3-frame.js";
 import { RetainedReads } from "./RetainedReads.js";
 import { OutsideReadableEdges, edgeReader, emptyWorkTags, text, textList, yearOf } from "./work-tags.js";
 
-const MPEG4_CODECS = new Set(["FMP4", "XVID", "DIVX", "DX50", "MP4V", "M4S2", "MP4S"]);
 /** FFmpeg's input buffer, filled ahead of what its demuxer parses (`IO_BUFFER_SIZE`, libavformat/aviobuf.c n8.1). */
 const FFMPEG_INPUT_BUFFER_BYTES = 32768;
 /** Picture codecs whose every picture stands alone, so decoding order is showing order. */
@@ -473,7 +473,7 @@ export class AviContainer extends Container {
     const clocks = new Map();
     for (const track of tracks.filter(track => ["video", "audio"].includes(track.type))) {
       if (!(track.timeBase > 0)) throw new Error("AVI stream time base is invalid.");
-      if (track.type === "video" && !["h264", "hevc"].includes(track.codecId) && !MPEG4_CODECS.has(track.codecId.toUpperCase()) && !INTRA_PICTURE_CODECS.has(track.codecId.toUpperCase())) {
+      if (track.type === "video" && !["h264", "hevc"].includes(track.codecId) && !MPEG4_FOURCCS.has(track.codecId.toUpperCase()) && !INTRA_PICTURE_CODECS.has(track.codecId.toUpperCase())) {
         throw new Error("AVI video without an index requires elementary picture timing.");
       }
       if (track.type === "audio" && !(track.sampleSize > 0) && !MPEG_AUDIO_CODECS.has(track.codecId)) throw new Error("AVI variable-size audio requires elementary frame timing.");
@@ -651,7 +651,7 @@ export class AviContainer extends Container {
           if (length) await this.#appendPacket(state.index, state.timings, track, { pts, duration, keyframe: true, ranges: [[start, end - 1]] });
           else if (track.type === "video") state.index.extendLastPresentation(trackId, track.timeBase);
           state.clocks.set(trackId, pts + duration);
-          if (!MPEG4_CODECS.has(track.codecId.toUpperCase()) && !["h264", "hevc"].includes(track.codecId) && !MPEG_AUDIO_CODECS.has(track.codecId) && (track.type === "audio" || length)) state.index.coverThrough(trackId, Math.max(0, pts + duration));
+          if (!MPEG4_FOURCCS.has(track.codecId.toUpperCase()) && !["h264", "hevc"].includes(track.codecId) && !MPEG_AUDIO_CODECS.has(track.codecId) && (track.type === "audio" || length)) state.index.coverThrough(trackId, Math.max(0, pts + duration));
         }
         state.at = next;
         state.index.flushPending();
@@ -687,7 +687,7 @@ export class AviContainer extends Container {
       }
       return;
     }
-    if (track.type !== "video" || !MPEG4_CODECS.has(track.codecId.toUpperCase())) {
+    if (track.type !== "video" || !MPEG4_FOURCCS.has(track.codecId.toUpperCase())) {
       index.append(track.trackNumber, packet);
       return;
     }

package/services/media/playback-declarations.js

@@ -1,33 +1,20 @@
 import { AudioTrack } from "./tracks/AudioTrack.js";
 import { TextSubtitleTrack } from "./tracks/TextSubtitleTrack.js";
 import { ContainerTrack } from "./tracks/ContainerTrack.js";
+import { videoCodecName } from "./tracks/codec-names.js";
 
-const VIDEO_CODECS = new Map([
-  ["V_MPEG4/ISO/AVC", "h264"], ["avc1", "h264"], ["avc3", "h264"],
-  ["V_MPEGH/ISO/HEVC", "hevc"], ["hvc1", "hevc"], ["hev1", "hevc"],
-  ["V_MPEG1", "mpeg1video"], ["V_MPEG2", "mpeg2video"],
-  ["V_MPEG4/ISO/ASP", "mpeg4"], ["V_MPEG4/ISO/SP", "mpeg4"], ["mp4v", "mpeg4"],
-  ["V_VP8", "vp8"], ["V_VP9", "vp9"], ["vp09", "vp9"],
-  ["V_AV1", "av1"], ["av01", "av1"], ["V_MJPEG", "mjpeg"],
-  ["V_FFV1", "ffv1"], ["V_THEORA", "theora"]
-]);
 const SUBTITLE_CODECS = new Map([
   ["S_TEXT/UTF8", "subrip"], ["S_TEXT/ASS", "ass"], ["S_TEXT/SSA", "ssa"],
   ["S_TEXT/WEBVTT", "webvtt"], ["wvtt", "webvtt"], ["tx3g", "mov_text"],
   ["S_HDMV/PGS", "hdmv_pgs_subtitle"], ["S_VOBSUB", "dvd_subtitle"]
 ]);
-const FOURCC_CODECS = new Map([
-  ["mjpg", "mjpeg"], ["jpeg", "mjpeg"], ["xvid", "mpeg4"],
-  ["divx", "mpeg4"], ["dx50", "mpeg4"], ["mpg2", "mpeg2video"]
-]);
-
 function videoCodecOf(track) {
   let id = track.codecId;
   if (id === "V_MS/VFW/FOURCC" && track.codecPrivateB64) {
     const header = Buffer.from(track.codecPrivateB64, "base64");
     if (header.length >= 20) id = header.toString("ascii", 16, 20);
   }
-  return VIDEO_CODECS.get(id) ?? FOURCC_CODECS.get(id.toLowerCase()) ?? id.toLowerCase();
+  return videoCodecName(id);
 }
 
 /** One playback inventory, taken from the same declarations used for input. */

package/services/media/tracks/AudioTrack.js

@@ -11,40 +11,9 @@
  */
 
 import { codecParametersOf, peakKbpsOf } from "./audio-bound.js";
+import { audioCodecName } from "./codec-names.js";
 import { ContainerTrack } from "./ContainerTrack.js";
 
-/**
- * Codec identifiers as containers write them, against the name ffmpeg prints.
- *
- * Needed because the browser decides whether it can play a soundtrack from that
- * name, and for a sidecar file there is no ffmpeg banner to read it from — the
- * track came from the container's own table, where Matroska writes `A_AC3` and
- * MP4 writes `ac-3` for the thing ffmpeg calls `ac3`. Only what a soundtrack can
- * actually be is listed; an identifier not here is reported as it was written,
- * which the browser treats as one it does not know and therefore transcodes.
- */
-const CODEC_NAMES = new Map([
-  ["A_AAC", "aac"],
-  ["A_AC3", "ac3"],
-  ["A_EAC3", "eac3"],
-  ["A_DTS", "dts"],
-  ["A_FLAC", "flac"],
-  ["A_OPUS", "opus"],
-  ["A_VORBIS", "vorbis"],
-  ["A_TRUEHD", "truehd"],
-  ["A_MPEG/L3", "mp3"],
-  ["A_MPEG/L2", "mp2"],
-  ["A_ALAC", "alac"],
-  ["mp4a", "aac"],
-  ["ac-3", "ac3"],
-  ["ec-3", "eac3"],
-  ["alac", "alac"],
-  ["opus", "opus"],
-  ["Opus", "opus"],
-  ["fLaC", "flac"],
-  ["flac", "flac"]
-]);
-
 /**
  * Extensions of raw elementary streams, against the codec they carry.
  *
@@ -126,21 +95,7 @@ export class AudioTrack extends ContainerTrack {
     }
     const codecId = typeof track?.codecId === "string" ? track.codecId.trim() : "";
     if (codecId.length > 0) {
-      const known = CODEC_NAMES.get(codecId);
-      if (known) {
-        return known;
-      }
-      // Matroska allows a suffix — `A_AAC/MPEG4/LC`, `A_PCM/INT/LIT` — so the
-      // family is what the first two segments say.
-      const family = codecId.split("/").slice(0, 2).join("/");
-      const byFamily = CODEC_NAMES.get(family) ?? CODEC_NAMES.get(codecId.split("/")[0]);
-      if (byFamily) {
-        return byFamily;
-      }
-      if (codecId.startsWith("A_PCM")) {
-        return "pcm";
-      }
-      return codecId.toLowerCase();
+      return audioCodecName(codecId);
     }
     return CODEC_BY_EXTENSION.get(extension) ?? "";
   }

package/services/media/tracks/codec-names.js

@@ -0,0 +1,83 @@
+/**
+ * @file The one table that names codecs.
+ *
+ * Containers write a codec as a Matroska id (`V_MPEG4/ISO/AVC`), an MP4 sample
+ * entry (`avc1`) or an AVI FOURCC (`XVID`); the rest of the proxy speaks the
+ * names ffmpeg prints (`h264`, `mpeg4`). Every translation lives here, so a
+ * FOURCC cannot be named one thing for the inventory and another for the
+ * container that reads it (torrent-tv/meta#284). Pure: imports nothing.
+ */
+
+/** FOURCCs that are MPEG-4 Part 2 (ASP/SP) whatever their case. */
+export const MPEG4_FOURCCS = new Set(["FMP4", "XVID", "DIVX", "DX50", "MP4V", "M4S2", "MP4S"]);
+
+const VIDEO_NAMES = new Map([
+  ["V_MPEG4/ISO/AVC", "h264"], ["avc1", "h264"], ["avc3", "h264"],
+  ["V_MPEGH/ISO/HEVC", "hevc"], ["hvc1", "hevc"], ["hev1", "hevc"],
+  ["V_MPEG1", "mpeg1video"], ["V_MPEG2", "mpeg2video"], ["mpg2", "mpeg2video"],
+  ["V_MPEG4/ISO/ASP", "mpeg4"], ["V_MPEG4/ISO/SP", "mpeg4"],
+  ["V_VP8", "vp8"], ["V_VP9", "vp9"], ["vp09", "vp9"],
+  ["V_AV1", "av1"], ["av01", "av1"], ["V_MJPEG", "mjpeg"], ["mjpg", "mjpeg"], ["jpeg", "mjpeg"],
+  ["V_FFV1", "ffv1"], ["V_THEORA", "theora"]
+].map(([id, name]) => [id.toLowerCase(), name]));
+
+/** The ffmpeg name of a video track from its codec id or FOURCC, in any case; unknown ids come back lower-cased. */
+export function videoCodecName(id) {
+  const key = String(id ?? "").toLowerCase();
+  if (MPEG4_FOURCCS.has(key.toUpperCase())) return "mpeg4";
+  return VIDEO_NAMES.get(key) ?? key;
+}
+
+const AUDIO_NAMES = new Map([
+  ["A_AAC", "aac"], ["A_AC3", "ac3"], ["A_EAC3", "eac3"], ["A_DTS", "dts"], ["A_FLAC", "flac"],
+  ["A_OPUS", "opus"], ["A_VORBIS", "vorbis"], ["A_TRUEHD", "truehd"], ["A_MPEG/L3", "mp3"],
+  ["A_MPEG/L2", "mp2"], ["A_ALAC", "alac"],
+  ["mp4a", "aac"], ["ac-3", "ac3"], ["ec-3", "eac3"], ["alac", "alac"],
+  ["opus", "opus"], ["Opus", "opus"], ["fLaC", "flac"], ["flac", "flac"]
+]);
+
+/**
+ * The ffmpeg name of a soundtrack from its container id. Matroska allows a
+ * suffix (`A_AAC/MPEG4/LC`, `A_PCM/INT/LIT`), so the family is what the first
+ * two segments say. An id not listed is reported as written, lower-cased.
+ */
+export function audioCodecName(codecId) {
+  const id = String(codecId ?? "").trim();
+  const known = AUDIO_NAMES.get(id);
+  if (known) return known;
+  const family = id.split("/").slice(0, 2).join("/");
+  const byFamily = AUDIO_NAMES.get(family) ?? AUDIO_NAMES.get(id.split("/")[0]);
+  if (byFamily) return byFamily;
+  if (id.startsWith("A_PCM")) return "pcm";
+  return id.toLowerCase();
+}
+
+const MATROSKA_IDS = new Map([
+  ["h264", "V_MPEG4/ISO/AVC"], ["hevc", "V_MPEGH/ISO/HEVC"], ["av1", "V_AV1"], ["vp9", "V_VP9"],
+  ["vp8", "V_VP8"], ["mjpeg", "V_MJPEG"], ["ffv1", "V_FFV1"], ["theora", "V_THEORA"],
+  ["jpeg2000", "V_JPEG2000"], ["mpeg1video", "V_MPEG1"], ["mpeg2video", "V_MPEG2"], ["mpeg4", "V_MPEG4/ISO/ASP"],
+  ["aac", "A_AAC"], ["mp3", "A_MPEG/L3"], ["mp2", "A_MPEG/L2"], ["mp1", "A_MPEG/L1"],
+  ["ac3", "A_AC3"], ["eac3", "A_EAC3"], ["opus", "A_OPUS"], ["flac", "A_FLAC"], ["dts", "A_DTS"],
+  ["vorbis", "A_VORBIS"], ["alac", "A_ALAC"], ["truehd", "A_TRUEHD"]
+]);
+// Spellings an input may carry besides the canonical name, taken exactly: a
+// codec outside this list has no Matroska declaration, and `M4S2` or `xvid`
+// stay refused because an input's key follows its declared track identity.
+const MATROSKA_SPELLINGS = [
+  ...["avc1", "avc3", "hvc1", "hev1", "av01"].map(spelling => [spelling, videoCodecName(spelling)]),
+  ...["FMP4", "XVID", "DIVX"].map(spelling => [spelling, "mpeg4"]),
+  ...["mp4a", "ac-3", "ec-3", "Opus", "fLaC"].map(spelling => [spelling, audioCodecName(spelling)])
+];
+
+/**
+ * The exact Matroska CodecID a canonical codec name is declared as, or
+ * `undefined` when there is none. Reverse of the names above, never wider.
+ */
+export function matroskaIdOf(codec) {
+  if (/^[VA]_/.test(codec)) return codec;
+  if (/^pcm_[su](?:16|24|32|64)le$/.test(codec) || /^pcm_[su]8(?:le|be)?$/.test(codec)) return "A_PCM/INT/LIT";
+  if (/^pcm_[su](?:16|24|32|64)be$/.test(codec)) return "A_PCM/INT/BIG";
+  if (/^pcm_f(?:32|64)(?:le|be)$/.test(codec)) return "A_PCM/FLOAT/IEEE";
+  const spelled = MATROSKA_SPELLINGS.find(([spelling]) => spelling === codec);
+  return MATROSKA_IDS.get(spelled ? spelled[1] : codec);
+}

package/services/server/wire-outputs.js

@@ -9,8 +9,10 @@
  */
 
 import { EventEmitter } from "node:events";
+import { writeJsonAtomic } from "../../utils/atomic-json.js";
 import { logger } from "../../utils/logger.js";
 import { KeyframeTables } from "../media/KeyframeTables.js";
+import { matroskaIdOf } from "../media/tracks/codec-names.js";
 import { bandOf, WaitLedger } from "../encode/OutputWaitLedger.js";
 import { readEndedChildrenCpuSeconds, readMachineState, readProcessCpuSeconds, readProxyCpuSeconds, readSystemCpu, shareOfMachine } from "../encode/host-load.js";
 import { minimumBufferFrom } from "../torrent/supply-margin.js";
@@ -100,7 +102,7 @@ import { freeBytesFor } from "../storage/free.js";
 import { PlaybackStorageDemand } from "../storage/PlaybackStorageDemand.js";
 import { inputCacheRoot, probeInputCache } from "../encode/input-cache.js";
 import path from "node:path";
-import { contentOf, LocalObservations, PROXY_ROOT } from "../encode/LocalObservations.js";
+import { contentOf, LocalObservations } from "../encode/LocalObservations.js";
 import { configurationKeyOf } from "../encode/fingerprint.js";
 import { qualityStateOf } from "../encode/quality/OutputQualityState.js";
 import { preparedAddresses, watchedAddresses } from "../viewer/watched-addresses.js";
@@ -875,7 +877,9 @@ export function wireOutputs({
   if (calibration?.fingerprint) {
     parts.localObservations = new LocalObservations({
       fingerprint: calibration.fingerprint,
-      filePath: path.join(typeof stateDir === "string" && stateDir.length > 0 ? stateDir : PROXY_ROOT, "local-observations.json"),
+      // The state directory arrives resolved; none keeps the observations in memory only.
+      filePath: typeof stateDir === "string" && stateDir.length > 0 ? path.join(stateDir, "local-observations.json") : "",
+      writeJson: writeJsonAtomic,
       logger
     });
     parts.localObservations.load(calibration.kinds().map((kind) => configurationKeyOf(calibration.fingerprint, {
@@ -1194,6 +1198,7 @@ export function wireOutputs({
   parts.encodeInputs = encodeInputs ?? (typeof encodeInputResolution?.resolve === "function" ? new EncodeInputs({
     resolve: (...args) => encodeInputResolution.resolve(...args),
     readRanges: readEncodeRanges,
+    matroskaIdOf,
     openWholeFile: openEncodeWholeFile,
     heldRanges: readEncodeHeldRanges,
     stretchCopied: (...args) => encodeInputResolution.stretchCopied(...args),

package/services/storage/files/CompletedFiles.js

@@ -27,6 +27,7 @@ import fs from "node:fs/promises";
 import { randomUUID } from "node:crypto";
 import os from "node:os";
 import path from "node:path";
+import { writeJsonAtomic } from "../../../utils/atomic-json.js";
 import { IDLE_KEEP_MS } from "../keep.js";
 
 /**
@@ -541,7 +542,11 @@ export class CompletedFiles {
       await fs.rm(directory, { ...REMOVAL, recursive: true }).catch(() => undefined);
       return;
     }
-    await fs.writeFile(path.join(directory, "manifest.json"), JSON.stringify(named)).catch(() => undefined);
+    try {
+      writeJsonAtomic(path.join(directory, "manifest.json"), named);
+    } catch {
+      // The manifest is a convenience for the next start; a failed write is not a failed keep.
+    }
   }
 
   /** Remove an empty or partial-only directory discovered during startup. */

package/services/storage/memory-report.js

@@ -459,13 +459,13 @@ export function startMemoryReport({
   label = "",
   diskPath = "",
   intervalMs = MEMORY_REPORT_INTERVAL_MS,
-  quietMs = 0,
-  changeBytes = 0,
+  quietMs = 60_000,
+  changeBytes = 25 * 1024 * 1024,
   snapshotDir = "",
   mayKeep = null,
-  snapshotFloorBytes = 500 * 1024 * 1024,
-  snapshotGrowthBytes = 100 * 1024 * 1024,
-  keepSnapshots = 0,
+  snapshotFloorBytes = 400 * 1024 * 1024,
+  snapshotGrowthBytes = 400 * 1024 * 1024,
+  keepSnapshots = 3,
   heapSnapshots = false,
   bufferSnapshotFloorBytes = 0,
   bufferSnapshotGrowthBytes = 500 * 1024 * 1024

package/services/storage/segment-store/SegmentStore.js

@@ -44,6 +44,7 @@ import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync, statSync,
 import { rmSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
+import { writeFileAtomic } from "../../../utils/atomic-json.js";
 
 /** Where every output's segments live. One root for the process. */
 const DEFAULT_STORE_ROOT = path.join(os.tmpdir(), "torrent-tv-hls");
@@ -235,7 +236,7 @@ export class SegmentStore {
       mkdirSync(dir, { recursive: true });
       // What this directory is, for whoever finds it after this process has
       // been killed. Without it the sweep can only throw everything away.
-      writeFileSync(path.join(dir, KEY_FILE), `${key}\n`, "utf8");
+      writeFileAtomic(path.join(dir, KEY_FILE), `${key}\n`);
     }
     this.#touched.set(key, this.#now());
     // Production is about to begin here, and a piece closing in this directory

package/services/torrent/worker/worker.js

@@ -793,20 +793,15 @@ startMemoryReport({
   scope: "thread",
   label: "torrent worker",
   intervalMs: WORKER_MEMORY_SAMPLE_MS,
-  quietMs: 60_000,
-  changeBytes: 25 * 1024 * 1024,
   snapshotDir: workerData?.stateDir || undefined,
   heapSnapshots: workerData?.heapSnapshots === true,
-  snapshotFloorBytes: 400 * 1024 * 1024,
-  snapshotGrowthBytes: 400 * 1024 * 1024,
   // CHOSEN, not derived: no healthy session has recorded this figure yet, so
   // there is no measured normal to stand above. It is set well below the
   // 2.1-4.3 GB the worker held in the minutes before the kills of 2026-10-01,
   // while the machine still has room to write a snapshot. The line prints what the
   // stores hold beside it, which is what a derived floor will come from.
   bufferSnapshotFloorBytes: 500 * 1024 * 1024,
-  bufferSnapshotGrowthBytes: 500 * 1024 * 1024,
-  keepSnapshots: 3
+  bufferSnapshotGrowthBytes: 500 * 1024 * 1024
 });
 
 const STORE_REPORT_INTERVAL_MS = 60_000;

package/utils/atomic-json.js

@@ -0,0 +1,46 @@
+import nodeFs from "node:fs";
+import path from "node:path";
+
+let writes = 0;
+
+/**
+ * Write a file so that a reader (or a restart after a crash) sees either the
+ * previous content or the new content, never a half-written file: the text goes
+ * to a temporary file beside the target, then is renamed over it. Synchronous;
+ * throws on failure and removes its temporary file when it can. It never writes
+ * `filePath` itself.
+ *
+ * @param {string} filePath
+ * @param {string | Uint8Array} data
+ * @param {{ fs?: Partial<typeof nodeFs>, mode?: number }} [options] - `fs`
+ *   overrides individual `node:fs` functions (a check stops the write between
+ *   the two steps with it).
+ * @returns {void}
+ */
+export function writeFileAtomic(filePath, data, { fs = {}, mode } = {}) {
+  const io = { ...nodeFs, ...fs };
+  const temporary = path.join(path.dirname(filePath), `${path.basename(filePath)}.${process.pid}.${++writes}.tmp`);
+  try {
+    io.writeFileSync(temporary, data, mode === undefined ? undefined : { mode });
+    io.renameSync(temporary, filePath);
+  } catch (error) {
+    try {
+      nodeFs.rmSync(temporary, { force: true });
+    } catch {
+      // The write already failed; a temporary file that cannot be removed is the lesser fault.
+    }
+    throw error;
+  }
+}
+
+/**
+ * Serialise `value` as JSON and write it with {@link writeFileAtomic}.
+ *
+ * @param {string} filePath
+ * @param {unknown} value
+ * @param {{ fs?: Partial<typeof nodeFs>, mode?: number }} [options]
+ * @returns {void}
+ */
+export function writeJsonAtomic(filePath, value, options = {}) {
+  writeFileAtomic(filePath, `${JSON.stringify(value)}\n`, options);
+}