@torrent-tv/proxy 2.22.0 → 2.24.0

package/services/hls-session-manager.js

@@ -20,6 +20,8 @@ import { logger } from "../utils/logger.js";
 import { readKeyframeIndex } from "./container-index/index.js";
 import { readMachineState, readProcessCpuSeconds, readProxyCpuSeconds, readSystemCpu, shareOfMachine } from "./host-load.js";
 import { speedFromReadings } from "./encoder-readings.js";
+import { ENCODE_RUN_EVENT, ENCODE_RUN_STATE, INITIAL_RUN_STATE, nextState } from "./encode-run-state.js";
+import { ENCODE_EXIT, classifyEncodeExit } from "./encode-exit.js";
 
 /** Own package version, stamped onto session-start log lines. */
 const PROXY_VERSION = createRequire(import.meta.url)("../package.json").version;
@@ -1176,6 +1178,7 @@ function normalizeLogFileName(fileName, fileIndex) {
  * @param {number | null} fileLengthBytes
  * @returns {number | null}
  */
+
 function sourceMegabytesPerSecond(session, fileLengthBytes) {
   // The FILE's rate, not the video stream's. What the torrent moves is the
   // container: on the releases this serves, two or three AC-3 tracks add 10-25 %
@@ -1190,6 +1193,29 @@ function sourceMegabytesPerSecond(session, fileLengthBytes) {
   return null;
 }
 
+/**
+ * Which cost a speed reading from this session is a measurement OF.
+ *
+ * Three encodes share one reading path and price three different things: a
+ * soundtrack published on its own, a picture being re-encoded (whose reading
+ * prices this source's DECODING, the encode half being known from the startup
+ * benchmark), and a picture being copied (which prices copying).
+ *
+ * Exported because the routing is where the fault was: a rendition was refused
+ * a reading by one guard while the call that would have priced it sat behind
+ * another, so the soundtrack was charged at nothing no matter how long it ran.
+ * A pure function makes that a test rather than a field session.
+ *
+ * @param {{ audioOnly?: boolean, transcodeVideo?: boolean }} session
+ * @returns {"audio" | "decode" | "copy"}
+ */
+export function costKindForSession(session) {
+  if (session?.audioOnly === true) {
+    return "audio";
+  }
+  return session?.transcodeVideo === true ? "decode" : "copy";
+}
+
 export class HlsSessionManager {
   /**
    * Recent times from session-create to a servable first segment, in ms.
@@ -1232,6 +1258,28 @@ export class HlsSessionManager {
    * @type {Map<string, { costSec: number, readings: number[], version: number }>}
    */
   #observedCopyCost = new Map();
+
+  /**
+   * What encoding one audio TRACK of one file costs this host, in seconds of
+   * work per second of video. Keyed by source, file and track, because two
+   * tracks of one film are not the same encode: a 5.1 AC-3 dub and a stereo
+   * AAC original decode and mix differently.
+   *
+   * Measured exactly as the copy's price is — from an audio-only session's own
+   * reported speed, past its start, alone on the machine, and never while the
+   * torrent is what is short.
+   *
+   * @type {Map<string, { costSec: number, readings: number[], version: number }>}
+   */
+  #observedAudioCost = new Map();
+
+  /**
+   * The last "not offering" line written, so the same one is not written again.
+   * See the end of {@link HlsSessionManager##sustainableHeights}.
+   *
+   * @type {string}
+   */
+  #lastOfferLine = "";
   /** The previous reading of the machine, to compare the next one against. */
   #hostLoadSample = null;
   /** The previous reading taken while nothing was encoding, for the torrent's own cost. */
@@ -1746,6 +1794,13 @@ export class HlsSessionManager {
       lastAccessedAt: Date.now(),
       ffmpeg: null,
       encodeRunGeneration: 0,
+      // What the ENCODER RUN is doing, as one control state from the table in
+      // `encode-run-state.js`. Written at every event today and read by nothing
+      // yet: a refused pair in the log is the model disagreeing with reality,
+      // and that disagreement is the measurement this release exists to take.
+      // The fields it will replace — `state`, `progress.state`, `encoderPaused`
+      // and the repeated liveness checks — keep their current writes meanwhile.
+      runState: INITIAL_RUN_STATE,
       lastError: "",
       // Cold-start timing: entry timestamp + a once-guard so the first servable
       // segment logs its latency exactly once.
@@ -2600,8 +2655,8 @@ export class HlsSessionManager {
     if (aheadSeconds === null) {
       // The segment the viewer needs does not exist. Whatever else is on disk,
       // this encoder has work to do right now.
-      if (session.encoderPaused) {
-        this.#resumeEncoder(session, "the viewer needs a segment nobody has made");
+      if (session.encoderPaused && this.#resumeEncoder(session, "the viewer needs a segment nobody has made")) {
+        this.#transitionRun(session, ENCODE_RUN_EVENT.RESUME_ORDERED);
       }
       return;
     }
@@ -2643,7 +2698,9 @@ export class HlsSessionManager {
           `${reading.total} segment file(s) present)`
       );
     } else if (session.encoderPaused && aheadSeconds <= LOOKAHEAD_RESUME_SECONDS) {
-      this.#resumeEncoder(session, `${Math.round(aheadSeconds)}s ahead of the viewer`);
+      if (this.#resumeEncoder(session, `${Math.round(aheadSeconds)}s ahead of the viewer`)) {
+        this.#transitionRun(session, ENCODE_RUN_EVENT.RESUME_ORDERED);
+      }
     }
   }
 
@@ -2688,6 +2745,91 @@ export class HlsSessionManager {
     return { seconds: Math.max(0, to - from), lastCovered, total: present.size };
   }
 
+  /**
+   * Move this session's encoder run to the state the table says an event leads
+   * to, and say so in the log.
+   *
+   * The log line is the point of it. Every transition a real run makes is
+   * printed as state, event and target, so a session can be checked against the
+   * specification after the fact — and a pair the table does not declare prints
+   * as a refusal, which is a cell nobody considered rather than a line nobody
+   * wrote. Five field failures in a row were exactly that.
+   *
+   * Refusing changes nothing and never throws: an event that means nothing here
+   * is ignored, and the caller's own work goes on. The machine this pattern
+   * replaces threw from inside a handler, so a refused transition abandoned the
+   * rest of it and left the app describing a state it was no longer in.
+   *
+   * @param {HlsSession} session
+   * @param {string} event - One of {@link ENCODE_RUN_EVENT}.
+   * @returns {string} The state now in force.
+   */
+  #transitionRun(session, event) {
+    const from = session.runState ?? INITIAL_RUN_STATE;
+    const to = nextState(from, event);
+    if (to === null) {
+      logger.warn(`run-state ${session.id} ${from} + ${event} — no such edge; ignored`);
+      return from;
+    }
+    session.runState = to;
+    logger.info(`run-state ${session.id} ${from} --${event}--> ${to}`);
+    return to;
+  }
+
+  /**
+   * Does this process's exit still say anything about the session?
+   *
+   * Two conditions, and the second is why this is a method rather than a
+   * comparison. A process is not the session's own run once a NEWER one has
+   * been installed — and also once it has been marked for replacement, which
+   * happens BEFORE the replacement exists. Between those two moments the field
+   * still names the doomed process, so comparing against it alone answers
+   * "yes, this is the current run" about a process we have just killed.
+   *
+   * @param {HlsSession} session
+   * @param {import("node:child_process").ChildProcess} ffmpeg
+   * @returns {boolean}
+   */
+  #isCurrentRun(session, ffmpeg) {
+    if (session.ffmpeg !== ffmpeg) {
+      return false;
+    }
+    return session.supersededRuns?.has(ffmpeg) !== true;
+  }
+
+  /**
+   * A segment this run made has just been served.
+   *
+   * The one event whose raising is guarded by the state, and the guard is a
+   * READ of the state rather than a second copy of it: "something has been
+   * produced" is a level, not an edge, so without the guard every served
+   * segment would raise it and the log would fill with refusals.
+   *
+   * Whose file it is decides the rest, and the directory answers that outright:
+   * runs write into one each, and serving searches them newest-first, so a
+   * segment left by an EARLIER run is served routinely. Comparing indices
+   * instead would have been fooled by the ordinary case of a backward seek —
+   * the new run starts at #10, the old one left #50 on disk, and #50 is above
+   * the new run's start index while saying nothing about it.
+   *
+   * @param {HlsSession} session
+   * @param {string} filePath - Where the served segment was actually found.
+   * @returns {void}
+   */
+  #noteRunProducedSegment(session, filePath) {
+    if (session.runState !== ENCODE_RUN_STATE.STARTING) {
+      return;
+    }
+    const runDir = session.runDirPath;
+    if (typeof runDir !== "string" || runDir.length === 0 || typeof filePath !== "string") {
+      return;
+    }
+    if (path.dirname(filePath) !== runDir) {
+      return;
+    }
+    this.#transitionRun(session, ENCODE_RUN_EVENT.FIRST_SEGMENT);
+  }
+
   /**
    * Suspend a session's encoder. No-op when already paused or unsupported here.
    *
@@ -2712,6 +2854,7 @@ export class HlsSessionManager {
       return;
     }
     session.encoderPaused = true;
+    this.#transitionRun(session, ENCODE_RUN_EVENT.SUSPEND_ORDERED);
     logger.info(
       `transcode ${session.id} encoder suspended — ${reason} ` +
         `"${session.fileName}"`
@@ -2721,23 +2864,40 @@ export class HlsSessionManager {
   /**
    * Let a suspended encoder run again.
    *
+   * Answers whether a process was actually continued, because three of the four
+   * callers do this in order to KILL it — a suspended process ignores SIGTERM
+   * until it is running — and only the two look-ahead callers mean "carry on".
+   * The run's state is theirs to move; a continue-then-kill is not a resume.
+   *
    * @param {HlsSession} session
    * @param {string} reason
-   * @returns {void}
+   * @returns {boolean} True when a live process was continued.
    */
   #resumeEncoder(session, reason) {
     // Any pair spanning this would count a stopped encoder as slow.
     session.learnSample = null;
     if (!session.encoderPaused || !session.ffmpeg?.pid) {
-      return;
+      return false;
     }
+    let continued = true;
     try {
       process.kill(session.ffmpeg.pid, "SIGCONT");
     } catch {
-      // The process is gone; the exit handler will deal with it.
+      // The process is gone; the exit handler will deal with it. The flag is
+      // cleared either way — but nothing was resumed, and saying so is what
+      // stops a dead run being reported as producing again.
+      continued = false;
     }
     session.encoderPaused = false;
-    logger.info(`transcode ${session.id} encoder resumed — ${reason} "${session.fileName}"`);
+    // Two records of one moment must not contradict each other: a line saying
+    // the encoder resumed, beside a return value saying nothing was resumed, is
+    // the sort of pair that costs an hour of reading a field log.
+    logger.info(
+      continued
+        ? `transcode ${session.id} encoder resumed — ${reason} "${session.fileName}"`
+        : `transcode ${session.id} could not resume the encoder (the process is gone) — ${reason} "${session.fileName}"`
+    );
+    return continued;
   }
 
   /**
@@ -2833,10 +2993,13 @@ export class HlsSessionManager {
     const encoding = [...this.sessionsById.values()].filter(
       (session) => session?.ffmpeg != null && !hasChildExited(session.ffmpeg) && session.state !== "disposed"
     );
-    if (encoding.length === 0) {
-      // Nothing is encoding, which is the ONLY moment the torrent's own cost
-      // can be attributed cleanly: whatever this process spends now is the
-      // download, the hashing, the piece store and the delivery. Item 7.
+    const runningNow = encoding.filter((session) => session.encoderPaused !== true);
+    if (runningNow.length === 0) {
+      // No encoder is RUNNING. A suspended one costs nothing, and counting it
+      // as work meant this was never reached: measured 2026-08-15, four minutes
+      // in which every encoder was suspended, the torrent's price could have
+      // been taken, and none was. What this process spends now is the download,
+      // the verification, the piece store and the delivery. Item 7.
       await this.#learnTorrentCost();
       this.#hostLoadSample = null;
       return;
@@ -3080,6 +3243,12 @@ export class HlsSessionManager {
     session.budgetSlowSince = 0;
     session.encodeWidth = rung.width;
     session.encodeHeight = rung.height;
+    // What this session was last seen doing described the encode it is no
+    // longer running. Kept, it prices the new, cheaper picture at the old one's
+    // cost, and it keeps the step it was measured on withdrawn from the offer
+    // although nothing is producing that step any more. The next reading of the
+    // new encode replaces it.
+    session.lastAloneSpeed = null;
     // Priced the same way the offer and the starting rung are. Choosing the
     // preset on the encoder alone treats decoding as free, which is how the
     // check and the encode came to disagree in the first place — and here it
@@ -3189,6 +3358,27 @@ export class HlsSessionManager {
     session.behindHeadAsks = new Map();
     const generation = ++session.encodeRunGeneration;
     const previousFfmpeg = session.ffmpeg;
+    // Marked BEFORE it is killed, and this is not a formality.
+    //
+    // The exit handler decides whether an exit belongs to the current run by
+    // comparing against `session.ffmpeg` — and that field still names the
+    // PREVIOUS process here, because the new one is not spawned for another
+    // few hundred lines. So a predecessor killed for a seek passed the identity
+    // check and was handled as though the session's own run had died: exit code
+    // null with a signal, i.e. the "ffmpeg failed" branch. Consequences, in
+    // rising order of cost — a spurious `state = "failed"` for the moment
+    // between the kill and the spawn, which a segment request landing in that
+    // window is answered 500 for; a fast-failure tally against a target that
+    // never failed; and on any host with a hardware encoder, the runtime safety
+    // net firing on every seek: the proxy downgraded itself to libx264 for good
+    // and started an extra run at the OLD index, which then took the generation
+    // and made the real restart abort. The comment further down claiming this
+    // could not happen ("the old process's exit handler no-ops") described an
+    // earlier arrangement where the field was already reassigned.
+    session.supersededRuns ??= new WeakSet();
+    if (previousFfmpeg) {
+      session.supersededRuns.add(previousFfmpeg);
+    }
     // A suspended process does not act on SIGTERM until it is continued, so the
     // wait below would never end. Let it run before asking it to stop.
     this.#resumeEncoder(session, "terminating for a new run");
@@ -3246,11 +3436,13 @@ export class HlsSessionManager {
       ? segmentCutTimesFrom(session.segmentBoundaries, safeIndex)
       : null;
 
-    // Terminate any existing encode process before starting a new one.  The
-    // old process's exit handler no-ops because session.ffmpeg is reassigned
-    // below (it checks identity).
+    // A second chance for a predecessor that survived the escalation above —
+    // the first block is the one that does the work. Its exit is ignored
+    // because it was marked superseded there, not because the field it is
+    // compared against has changed: the spawn is still below this line.
     this.#resumeEncoder(session, "terminating");
     if (session.ffmpeg && !session.ffmpeg.killed) {
+      session.supersededRuns.add(session.ffmpeg);
       try {
         session.ffmpeg.kill("SIGTERM");
       } catch (_error) {
@@ -3467,6 +3659,7 @@ export class HlsSessionManager {
       stdio: ["ignore", "pipe", "pipe"]
     });
     session.ffmpeg = ffmpeg;
+    this.#transitionRun(session, ENCODE_RUN_EVENT.SPAWNED);
     // Whether this run cuts at times we gave it. Decides how a segment is
     // judged finished — see getFileStream.
     session.usesExplicitCuts = Boolean(cutTimes && cutTimes.length > 0);
@@ -3607,25 +3800,42 @@ export class HlsSessionManager {
     });
 
     ffmpeg.on("error", (error) => {
-      if (session.ffmpeg !== ffmpeg) {
+      if (!this.#isCurrentRun(session, ffmpeg)) {
         return;
       }
       session.state = "failed";
       session.lastError = error instanceof Error ? error.message : String(error);
       session.progress.state = "failed";
       session.progress.updatedAt = Date.now();
+      this.#transitionRun(session, ENCODE_RUN_EVENT.EXITED_FAILED);
       logger.error(`ffmpeg ${session.id} process error: ${session.lastError}`);
     });
 
     ffmpeg.on("exit", (code, signal) => {
-      // Ignore the exit of a process that was superseded by a seek-restart.
-      if (session.ffmpeg !== ffmpeg) {
+      // Asked FIRST, before anything is written or read. An exit that belongs
+      // to a replaced run must not touch the session's error, which the viewer
+      // is shown and the next real exit is classified by, and must not send the
+      // handler reading directories on its behalf.
+      if (!this.#isCurrentRun(session, ffmpeg) || session.state === "disposed") {
         return;
       }
-      if (session.state === "disposed") {
+      const producedThrough = code === 0 ? this.#latestProducedSegment(session) : null;
+      const expectedLast = session.segmentCount > 0 ? session.segmentCount - 1 : null;
+      if (!session.lastError && code !== 0) {
+        session.lastError = `ffmpeg exited with code ${code ?? -1}${signal ? ` (signal ${signal})` : ""}`;
+      }
+      // What this exit means is decided in one place, from facts, and the
+      // reasoning behind each answer lives with it in `encode-exit.js`.
+      const outcome = classifyEncodeExit({
+        code,
+        producedThrough,
+        lastSegmentIndex: expectedLast,
+        inputUnavailable: isInputUnavailable(session.lastError)
+      });
+      if (outcome === ENCODE_EXIT.IGNORED) {
         return;
       }
-      if (code === 0) {
+      if (outcome === ENCODE_EXIT.SHORT) {
         // ffmpeg exits 0 both when it reaches the end of the file and when its
         // input simply stops producing bytes — over HTTP the two look identical
         // to it. Field 2026-08-05: the torrent's download died, the read ended,
@@ -3634,35 +3844,41 @@ export class HlsSessionManager {
         // segment nobody was making. So the claim is checked against the
         // playlist we published, and a run that stopped short is a FAILURE that
         // can be restarted, not a finished file.
-        const producedThrough = this.#latestProducedSegment(session);
-        const expectedLast = session.segmentCount > 0 ? session.segmentCount - 1 : null;
-        if (expectedLast !== null && producedThrough !== null && producedThrough < expectedLast) {
-          session.state = "failed";
-          session.progress.state = "failed";
-          session.progress.updatedAt = Date.now();
-          session.lastError =
-            `input ended after segment #${producedThrough} of ${expectedLast} — ` +
-            "the source stopped delivering data";
-          logger.error(
-            `transcode ${session.id} ${session.runLabel ?? "run#?"} encode-run ended early: ` +
-            `${session.lastError} "${session.fileName}"`
-          );
-          return;
-        }
+        session.state = "failed";
+        session.progress.state = "failed";
+        session.progress.updatedAt = Date.now();
+        session.lastError =
+          `input ended after segment #${producedThrough} of ${expectedLast} — ` +
+          "the source stopped delivering data";
+        this.#transitionRun(session, ENCODE_RUN_EVENT.EXITED_SHORT);
+        logger.error(
+          `transcode ${session.id} ${session.runLabel ?? "run#?"} encode-run ended early: ` +
+          `${session.lastError} "${session.fileName}"`
+        );
+        return;
+      }
+      if (outcome === ENCODE_EXIT.COMPLETE) {
         session.state = "ready";
         session.progress.state = "ready";
         session.progress.updatedAt = Date.now();
+        this.#transitionRun(session, ENCODE_RUN_EVENT.EXITED_COMPLETE);
         logger.info(`transcode ${session.id} encode-run complete "${session.fileName}"`);
         return;
       }
-      if (!session.lastError) {
-        session.lastError = `ffmpeg exited with code ${code ?? -1}${signal ? ` (signal ${signal})` : ""}`;
-      }
       // Runtime safety net: if a hardware encode fails, downgrade this proxy to
       // software encoding for all sessions and restart this one, so playback is
       // never permanently broken by a hardware/driver issue.
-      if (session.transcodeVideo && this.videoEncoder.kind !== "software") {
+      //
+      // Asked only of a genuine encoder failure. It used to be asked of every
+      // non-zero exit, so a run whose TORRENT DATA went away — which says
+      // nothing whatever about the encoder — condemned a working NVENC or
+      // QuickSync to software for the life of the process, and started an extra
+      // run at the old index while it was at it.
+      if (outcome === ENCODE_EXIT.FAILED && session.transcodeVideo && this.videoEncoder.kind !== "software") {
         const failedEncoder = this.videoEncoder.name;
+        // The run died before the software one takes its place: the failure is
+        // an event of its own, and the restart below is a separate spawn.
+        this.#transitionRun(session, ENCODE_RUN_EVENT.EXITED_FAILED);
         this.videoEncoder = softwareDescriptor();
         logger.warn(
           `transcode ${session.id} hardware encoder ${failedEncoder} failed ` +
@@ -3704,13 +3920,14 @@ export class HlsSessionManager {
       // the data would have come back in seconds. The circuit breaker below
       // stays for what it was built for, a target that genuinely cannot be
       // encoded; it must not condemn a session whose data merely went away.
-      if (isInputUnavailable(session.lastError)) {
+      if (outcome === ENCODE_EXIT.INPUT_LOST) {
         session.state = "recovering";
         // On the wire it is simply "not ready yet" — a state the browser has
         // always known how to wait through. Only the proxy needs the
         // distinction between waiting for data and having given up.
         session.progress.state = "starting";
         session.progress.updatedAt = Date.now();
+        this.#transitionRun(session, ENCODE_RUN_EVENT.EXITED_INPUT_LOST);
         session.inputRetryCount = (session.inputRetryCount ?? 0) + 1;
         const delayMs = Math.min(
           INPUT_RETRY_MAX_MS,
@@ -3726,6 +3943,7 @@ export class HlsSessionManager {
           if (session.state !== "recovering") {
             return;
           }
+          this.#transitionRun(session, ENCODE_RUN_EVENT.RETRY_DUE);
           const at = Number.isInteger(session.lastRequestedSegment)
             ? session.lastRequestedSegment
             : (session.encodeStartIndex ?? 0);
@@ -3737,6 +3955,7 @@ export class HlsSessionManager {
       session.state = "failed";
       session.progress.state = "failed";
       session.progress.updatedAt = Date.now();
+      this.#transitionRun(session, ENCODE_RUN_EVENT.EXITED_FAILED);
       logger.error(
         `transcode ${session.id} ${session.runLabel ?? "run#?"} encode-run failed: ${session.lastError}`
       );
@@ -4608,6 +4827,19 @@ export class HlsSessionManager {
           }
         }
       }
+      // The soundtracks published separately. They are encoders of this family
+      // exactly as the quality steps are — one runs for as long as the picture
+      // does — and they were reachable only through `audioRenditionSessions`,
+      // which nothing here walked. So a family never contained one, and every
+      // sum taken over the family priced the soundtrack at nothing.
+      if (root.audioRenditionSessions instanceof Map) {
+        for (const renditionId of root.audioRenditionSessions.values()) {
+          const rendition = this.sessionsById.get(renditionId);
+          if (rendition) {
+            family.add(rendition);
+          }
+        }
+      }
     }
     return [...family];
   }
@@ -4730,7 +4962,43 @@ export class HlsSessionManager {
     // never moves at all, so the cache would never be recomputed.
     const copyVersion = this.#observedCopyCost.get(`${owner.sourceKey}:${owner.fileIndex}`)?.version ?? 0;
     const torrentCost = this.#observedTorrentCostPerMegabyte ?? 0;
-    const version = `${observed?.version ?? 0}:${playing}:${copyVersion}:${torrentCost.toFixed(6)}`;
+    // The soundtrack's price is an input too, and so is how many encoders of
+    // this family are running: both move the answer, and an answer cached
+    // across them is the stale menu this key exists to prevent.
+    const audioVersion = [...this.#familyOf(owner)]
+      .filter((member) => member.audioOnly === true)
+      .map((member) => this.#observedAudioCost.get(this.#audioCostKey(member))?.version ?? 0)
+      .reduce((total, one) => total + one, 0);
+    const running = [...this.#familyOf(owner)]
+      .filter((member) => member.ffmpeg != null && !hasChildExited(member.ffmpeg)).length;
+    // What each running encode was last seen doing, which is BOTH an input to
+    // the answer twice over — it withdraws a step measured below realtime, and
+    // it prices every running picture in the committed total — and a figure
+    // rewritten every five seconds. Left out of the key, the menu could be
+    // pinned to what was computed before anything had been measured: on a
+    // COPIED picture the decode version never moves at all, so nothing else in
+    // the key would ever have recomputed it.
+    // Encoded for the DECISIONS it feeds, not as a raw figure. Two of them: is
+    // this encode below realtime (which withdraws its own step outright), and
+    // what does it cost (which is charged against every other step). A raw
+    // speed at two decimals moves on nearly every five-second reading, so the
+    // menu would be recomputed — and its "not offering" line written — for the
+    // whole film; while rounding alone would hide the 0.995-1.005 crossing,
+    // which is exactly the band a step spends its time in when the host is
+    // marginal. The flag carries the crossing, the rounded cost carries the
+    // rest.
+    const measured = this.#familyOf(owner)
+      .map((member) => {
+        const speed = member.lastAloneSpeed;
+        if (!Number.isFinite(speed) || !(speed > 0)) {
+          return "-";
+        }
+        return `${speed < 1 ? "slow" : "ok"}${(1 / speed).toFixed(2)}`;
+      })
+      .join(",");
+    const version =
+      `${observed?.version ?? 0}:${playing}:${copyVersion}:${torrentCost.toFixed(6)}:` +
+      `${audioVersion}:${running}:${measured}`;
     if (Array.isArray(owner.offeredHeightsCache) && owner.offeredHeightsVersion === version) {
       return owner.offeredHeightsCache;
     }
@@ -4757,6 +5025,9 @@ export class HlsSessionManager {
       // picture being COPIED is the common case and used to be priced at
       // nothing; measured, it is about an eighth of the machine.
       concurrentCostSec: this.#committedCostOf(owner),
+      // So a height already being produced is not charged for itself when it is
+      // judged. See the subtraction in #sustainableHeights.
+      runningCostByHeight: this.#runningCostByHeight(owner),
       sourceWidth: Number(owner.sourceWidth) || 0,
       sourceHeight: Math.round(Number(owner.sourceHeight) || 0),
       fps: Number(owner.outputFps) || TRANSCODE_FPS,
@@ -4871,13 +5142,8 @@ export class HlsSessionManager {
       session.state === "disposed" ||
       session.state === "failed" ||
       !session.ffmpeg ||
-      session.encoderPaused === true ||
-      session.audioOnly === true
+      session.encoderPaused === true
     ) {
-      // An audio rendition is excluded because its speed is the price of a
-      // soundtrack, which neither decoding nor copying the picture is. A COPY
-      // is NOT excluded any more: it says what copying costs, and that used to
-      // be counted as nothing.
       session.learnSample = null;
       return;
     }
@@ -4900,24 +5166,60 @@ export class HlsSessionManager {
     if (speed === null) {
       return;
     }
-    // Only while this encoder had the machine to itself. A reading taken beside
-    // another encoder already contains that other work — and the budget then
-    // ADDS the same work again when it predicts, so the cost is counted twice
-    // and grows with every reading. Measured 2026-08-15 in the field: copying,
-    // whose truth is 7.9x, was learned as 2.03x, and decoding, whose clips say
-    // 2.6x, as 0.87x. Every rung was then refused, the offer collapsed to the
-    // one copied height, and the viewer lost the quality menu altogether.
+    const kind = costKindForSession(session);
+    // A reading taken beside another encoder contains that other encoder's
+    // work, and the budget ADDS the same work again when it predicts — so filed
+    // as it stands the price is counted twice and grows with every reading.
+    // Measured 2026-08-15 in the field: copying, whose truth is 7.9x, was
+    // learned as 2.03x, and decoding, whose clips say 2.6x, as 0.87x. Every
+    // step was then refused, the offer collapsed to the one copied height, and
+    // the viewer lost the quality menu altogether.
+    //
+    // For a picture the answer is to wait for a moment alone, which comes often
+    // enough. For a SOUNDTRACK it never comes: a rendition runs for exactly as
+    // long as the picture it accompanies, so "alone" is a state it is never in,
+    // and the price stayed unmeasured for ever — the hole this was meant to
+    // close. Its share is instead recovered by subtracting what the machine is
+    // already known to be spending, which is the same arithmetic that recovers
+    // this source's decoding from a running encoder, and it is only done when
+    // every other running encode HAS a price. Otherwise the unpriced work would
+    // land in the soundtrack's account and refuse steps on it.
+    let othersCostSec = 0;
     if (this.#runningEncoders() > 1) {
-      return;
+      if (kind !== "audio") {
+        return;
+      }
+      const others = this.#pricedConcurrentCost(session);
+      if (others === null) {
+        return; // something running has no price; nothing can be attributed
+      }
+      othersCostSec = others;
     }
-    // What this rung did with the machine to itself — the one figure a live
-    // reading is authority on, and what withdraws a rung that has been seen
-    // failing without letting it speak for rungs nobody has run.
-    session.lastAloneSpeed = speed;
     if (speed < BUDGET_SPEED_OK && await this.#classifyTranscodeBound(session) === "download") {
       return; // the torrent is what is short; this says nothing about the host
     }
-    if (session.transcodeVideo === true) {
+    // What this encode did with the machine to itself — the one figure a live
+    // reading is authority on, and what withdraws a quality step that has been
+    // seen failing without letting it speak for steps nobody has run.
+    //
+    // Recorded only AFTER the download-bound check, and that order is the whole
+    // point: a run starved of torrent data reports a speed that measures the
+    // swarm. Stored first, as it was, that figure became this encode's price —
+    // 0.3x reads as 3.33 s of work per second of video, more than the machine
+    // has — and every other quality step was refused on the download's account.
+    session.lastAloneSpeed = speed;
+    if (kind === "audio") {
+      // What is left after the work that was already accounted for. `null` when
+      // the subtraction leaves nothing positive, which means the reading says
+      // less than the noise in it.
+      const ownCostSec = 1 / speed - othersCostSec;
+      if (!(ownCostSec > 0) || !Number.isFinite(ownCostSec)) {
+        return;
+      }
+      await this.#learnAudioCost(session, 1 / ownCostSec);
+      return;
+    }
+    if (kind === "decode") {
       this.#learnDecodeCost(session, speed);
       return;
     }
@@ -4976,23 +5278,70 @@ export class HlsSessionManager {
     );
   }
 
+  /**
+   * What this file's audio track costs to encode on this host.
+   *
+   * A rendition is a second encoder, running for as long as the picture does,
+   * and the budget counted it at nothing — which is half of what roadmap item 6
+   * was left owing. It is small beside a picture, and small is not zero: on a
+   * host where a rung needs almost the whole machine, a soundtrack is the
+   * difference between offering it and refusing it.
+   *
+   * Same rules as {@link #learnCopyCost}, for the same reasons: past the run's
+   * own start, never suspended, never while the torrent is what is short.
+   *
+   * @param {HlsSession} session
+   * @param {number} speed
+   */
+  async #learnAudioCost(session, speed) {
+    const runStartedAt = Number(session.encodeRunStartedAt);
+    if (!Number.isFinite(runStartedAt) || Date.now() - runStartedAt < DECODE_LEARNING_SETTLE_MS) {
+      return;
+    }
+    if (session.encoderPaused === true) {
+      return;
+    }
+    if (await this.#classifyTranscodeBound(session) === "download") {
+      return;
+    }
+    const costSec = 1 / speed;
+    if (!(costSec > 0) || !Number.isFinite(costSec)) {
+      return;
+    }
+    const key = this.#audioCostKey(session);
+    const known = this.#observedAudioCost.get(key);
+    const readings = [...(known?.readings ?? []), costSec].slice(-DECODE_LEARNING_READINGS);
+    const sorted = [...readings].sort((left, right) => left - right);
+    const median = sorted[Math.floor(sorted.length / 2)];
+    if (known && Math.abs(median - known.costSec) / known.costSec < DECODE_LEARNING_CHANGE) {
+      this.#observedAudioCost.set(key, { ...known, readings });
+      return;
+    }
+    this.#observedAudioCost.set(key, { costSec: median, readings, version: (known?.version ?? 0) + 1 });
+    logger.info(
+      `transcode: ${session.fileName} encodes audio track ${session.audioTrackIndex ?? 0} at ` +
+        `${(1 / median).toFixed(2)}x on this host (median of ${readings.length}, latest ${speed.toFixed(2)}x)`
+    );
+  }
+
+  /**
+   * @param {HlsSession} session
+   * @returns {string}
+   */
+  #audioCostKey(session) {
+    return `${session.sourceKey}:${session.fileIndex}:${session.audioTrackIndex ?? 0}`;
+  }
+
   #learnDecodeCost(session, speed) {
     if (!(speed > 0)) {
       return;
     }
     if (session.transcodeVideo !== true) {
-      // A copied video decodes nothing, so it says nothing about DECODING —
-      // but it says exactly what COPYING costs, which the budget has been
-      // treating as free. Field 2026-08-15: a copy ran at 7.92-8.02x, i.e.
-      // about an eighth of a second of work per second of video, while a rung
-      // warmed beside it needed the rest of the machine.
-      //
-      // An audio rendition also carries no video, and its speed is the cost of
-      // encoding a soundtrack — a different quantity that must not be filed
-      // under what copying the picture costs.
-      if (session.audioOnly !== true) {
-        void this.#learnCopyCost(session, speed);
-      }
+      // Nothing to learn about decoding here, and nothing else either: the
+      // caller routes a copy to #learnCopyCost and a rendition to
+      // #learnAudioCost before this is ever reached. Routing them from here as
+      // well put both calls behind a guard the caller had already made
+      // (`transcodeVideo === true`), so neither could run.
       return;
     }
     const runStartedAt = Number(session.encodeRunStartedAt);
@@ -5140,25 +5489,178 @@ export class HlsSessionManager {
    * @param {{ heights: number[], ownHeight: number, sourceWidth: number, sourceHeight: number, fps: number, source: { megapixelsPerSecond: number, megabitsPerSecond: number } | null, transcodeVideo: boolean }} params
    * @returns {number[]}
    */
+  /**
+   * What a running re-encode of the picture costs, in seconds of work per
+   * second of video.
+   *
+   * Measured first: `lastAloneSpeed` is what this very rung did with the
+   * machine to itself. Failing that, the encode model that decides every rung —
+   * the same benchmark, the same decode term — applied to this rung's own pixel
+   * rate. There is no third answer: a rung whose cost cannot be derived at all
+   * contributes nothing rather than a number somebody invented.
+   *
+   * @param {HlsSession} session
+   * @returns {number}
+   */
+  #pictureCostOf(session) {
+    if (Number.isFinite(session.lastAloneSpeed) && session.lastAloneSpeed > 0) {
+      return 1 / session.lastAloneSpeed;
+    }
+    const benchmark = this.softwarePresetBenchmark;
+    const width = Number(session.encodeWidth) || 0;
+    const height = Number(session.encodeHeight) || 0;
+    const fps = Number(session.outputFps) || TRANSCODE_FPS;
+    if (!Array.isArray(benchmark) || benchmark.length === 0 || width <= 0 || height <= 0) {
+      return 0;
+    }
+    const { speed } = canSustainOutput({
+      benchmark,
+      decodeModel: this.decodeCostModel,
+      source: session.sourceDecode ?? null,
+      outputPixelsPerSec: width * height * fps,
+      observedDecodeCostSec: null,
+      concurrentCostSec: 0
+    });
+    return Number.isFinite(speed) && speed > 0 ? 1 / speed : 0;
+  }
+
+  /**
+   * What everything OTHER than this session is costing right now, or null when
+   * any of it is unpriced.
+   *
+   * Used to recover a soundtrack's own share from a reading taken beside the
+   * picture — the only kind of reading a rendition ever gives, since it runs
+   * exactly as long as the picture does. Refusing to answer when something
+   * running has no price is the point: unpriced work would otherwise be
+   * attributed to the soundtrack, and an overpriced soundtrack refuses quality
+   * steps the host could actually hold.
+   *
+   * @param {HlsSession} session
+   * @returns {number | null}
+   */
+  #pricedConcurrentCost(session) {
+    let cost = 0;
+    for (const member of this.#familyOf(session)) {
+      if (member === session || member.ffmpeg == null || hasChildExited(member.ffmpeg)) {
+        continue;
+      }
+      if (member.audioOnly === true) {
+        const audio = this.#observedAudioCost.get(this.#audioCostKey(member));
+        if (!audio || !(audio.costSec > 0)) {
+          return null;
+        }
+        cost += audio.costSec;
+        continue;
+      }
+      if (member.transcodeVideo !== true) {
+        const copy = this.#observedCopyCost.get(`${member.sourceKey}:${member.fileIndex}`);
+        if (!copy || !(copy.costSec > 0)) {
+          return null;
+        }
+        cost += copy.costSec;
+        continue;
+      }
+      const picture = this.#pictureCostOf(member);
+      if (!(picture > 0)) {
+        return null;
+      }
+      cost += picture;
+    }
+    // Encoders outside this family are counted by number only — there is no
+    // price to look up for another film's session — so a reading taken while
+    // one is running cannot be attributed either.
+    return this.#runningEncoders() > this.#familyOf(session).filter(
+      (member) => member.ffmpeg != null && !hasChildExited(member.ffmpeg)
+    ).length
+      ? null
+      : cost;
+  }
+
+  /**
+   * What each height of this family is costing RIGHT NOW, for the heights an
+   * encoder is actually running at.
+   *
+   * Exists so a height can be judged against what the machine spends on
+   * everything else — a step being warmed is running while it is judged, and
+   * charged its own cost it refuses itself.
+   *
+   * @param {HlsSession} session
+   * @returns {Map<number, number>}
+   */
+  #runningCostByHeight(session) {
+    /** @type {Map<number, number>} */
+    const byHeight = new Map();
+    for (const member of this.#familyOf(session)) {
+      if (member.audioOnly === true || member.transcodeVideo !== true) {
+        continue;
+      }
+      if (member.ffmpeg == null || hasChildExited(member.ffmpeg)) {
+        continue;
+      }
+      const height = this.variantHeightOf(member);
+      if (height > 0) {
+        byHeight.set(height, (byHeight.get(height) ?? 0) + this.#pictureCostOf(member));
+      }
+    }
+    return byHeight;
+  }
+
   /**
    * Seconds of work per second of video this family is ALREADY committed to,
    * beside any rung being considered.
    *
-   * Today that is the copy of the picture, where the video is copied and its
-   * cost has been observed. An encoded picture is not added: a viewer changing
-   * quality leaves the rung they are on, so the two do not overlap for long,
-   * and the warm-up that does overlap is bounded by the switch. An audio
-   * rendition is not added either, until its cost is measured the same way —
-   * counting it at a guess would refuse rungs on arithmetic nobody took.
+   * Every encoder of the family that is actually running: the picture, whether
+   * it is copied or re-encoded, and each audio rendition. The rung the viewer
+   * is watching and the source's own copied height are never withdrawn by the
+   * caller, so charging for the encoder that serves them cannot strand anyone —
+   * what it does is stop the NEXT rung being offered as though the machine were
+   * idle, which is what the field disproved on 2026-08-15.
+   *
+   * Anything whose cost is neither measured nor derivable contributes nothing.
+   * A guess here would refuse rungs on arithmetic nobody performed.
    *
    * @param {HlsSession} session
    * @returns {number}
    */
   #committedCostOf(session) {
     let cost = 0;
-    if (session.transcodeVideo !== true) {
-      const observed = this.#observedCopyCost.get(`${session.sourceKey}:${session.fileIndex}`);
-      cost += observed && observed.costSec > 0 ? observed.costSec : 0;
+    for (const member of this.#familyOf(session)) {
+      // Only what still HAS an encoder. A quality step the viewer left keeps
+      // its session and its segments but not a process, and it produces nothing
+      // for anybody — charging the machine for it would refuse steps on work
+      // nobody is doing.
+      //
+      // A SUSPENDED encoder is charged, deliberately, and this is not the same
+      // question. The unit here is seconds of work per second of VIDEO, not per
+      // second of wall clock: a copy running at 8x costs 0.125 s/s whether it
+      // is producing right now or parked by the look-ahead cap, because over an
+      // hour of watching it still produces an hour of video. Suspension is how
+      // that cost is spread, not a discount on it — and pricing a parked
+      // encoder at zero would offer a step on the strength of a pause that ends
+      // the moment the viewer catches up.
+      if (member.ffmpeg == null || hasChildExited(member.ffmpeg)) {
+        continue;
+      }
+      if (member.audioOnly === true) {
+        // A soundtrack encoder, priced from its own measured speed. Nothing is
+        // charged for a track nobody has measured: a guess here refuses rungs
+        // on arithmetic no one performed.
+        const audio = this.#observedAudioCost.get(this.#audioCostKey(member));
+        cost += audio && audio.costSec > 0 ? audio.costSec : 0;
+        continue;
+      }
+      if (member.transcodeVideo !== true) {
+        const observed = this.#observedCopyCost.get(`${member.sourceKey}:${member.fileIndex}`);
+        cost += observed && observed.costSec > 0 ? observed.costSec : 0;
+        continue;
+      }
+      // A picture being RE-ENCODED beside the rung being judged — the warm-up
+      // that makes a quality switch seamless is two encoders by design, and
+      // that overlap is exactly where the field measured 0.504x on a rung
+      // predicted at 1.58x (2026-08-15). Priced by what it has been SEEN doing
+      // when it had the machine to itself, and otherwise by the same model that
+      // judges every rung — which is a prediction, not a guess.
+      cost += this.#pictureCostOf(member);
     }
     // And what the FILE costs simply by being fetched and delivered while it is
     // watched: a viewer consumes it at its own byte rate, and every one of
@@ -5213,6 +5715,7 @@ export class HlsSessionManager {
     transcodeVideo,
     observedDecodeCostSec = null,
     concurrentCostSec = 0,
+    runningCostByHeight = null,
     measuredHeights = null
   }) {
     const benchmark = this.softwarePresetBenchmark;
@@ -5254,13 +5757,24 @@ export class HlsSessionManager {
         continue;
       }
       const width = Math.round(((sourceWidth / sourceHeight) * height) / 2) * 2;
+      // What the machine is spending on everything EXCEPT this height. A step
+      // being warmed for a switch is already running while it is judged, so its
+      // own cost is inside the committed total — and charged against itself it
+      // is counted twice. Measured against the field figures of 2026-08-15
+      // that is 1.83x against 1.03x: below the margin, so the step the viewer
+      // had just asked for was dropped from the offer by the act of warming it,
+      // and its next segment answered 404 on a stream that was playing.
+      const concurrentBesideThis = Math.max(
+        0,
+        concurrentCostSec - (runningCostByHeight?.get(height) ?? 0)
+      );
       const { speed, sustainable } = canSustainOutput({
         benchmark,
         decodeModel: this.decodeCostModel,
         source,
         outputPixelsPerSec: width * height * fps,
         observedDecodeCostSec,
-        concurrentCostSec
+        concurrentCostSec: concurrentBesideThis
       });
       if (sustainable) {
         kept.push(height);
@@ -5268,11 +5782,21 @@ export class HlsSessionManager {
       }
       dropped.push(`${height}p=${speed === null ? "n/a" : `${speed.toFixed(2)}x`}`);
     }
+    // Written when the ANSWER changes, not when the answer is recomputed. This
+    // is asked on the path that serves every playlist, init and segment, and
+    // the figures behind it move every five seconds — so an unconditional line
+    // here is roughly seven hundred identical lines an hour into a forwarder
+    // that holds five hundred, which buries whatever is worth reading.
     if (dropped.length > 0) {
-      logger.info(
+      const line =
         `transcode: not offering ${dropped.join(" ")} — below realtime × ${REALTIME_SPEED_MARGIN} ` +
-          `(offering ${kept.map((height) => `${height}p`).join(" ")})`
-      );
+        `(offering ${kept.map((height) => `${height}p`).join(" ")})`;
+      if (line !== this.#lastOfferLine) {
+        this.#lastOfferLine = line;
+        logger.info(line);
+      }
+    } else {
+      this.#lastOfferLine = "";
     }
     return kept;
   }
@@ -5415,7 +5939,12 @@ export class HlsSessionManager {
     // Cleared BEFORE the signal: the exit handler checks identity against this
     // field, so a deliberate stop must not read as a run that failed.
     session.ffmpeg = null;
+    // Only a run that was still going is being STOPPED. The handle outlives the
+    // process — nothing nulls it when a run ends — so a rung that had already
+    // finished or failed reaches here too, and calling that a stop would erase
+    // how it actually ended.
     if (!hasChildExited(ffmpeg)) {
+      this.#transitionRun(session, ENCODE_RUN_EVENT.STOP_ORDERED);
       try {
         ffmpeg.kill("SIGTERM");
       } catch {
@@ -6435,6 +6964,7 @@ export class HlsSessionManager {
           startSeconds: trueStart ?? declaredStart,
           initBytes: session.initBytes ?? null
         });
+        this.#noteRunProducedSegment(session, filePath);
         return {
           kind: "file",
           stream: Readable.from([prepared]),
@@ -6442,6 +6972,9 @@ export class HlsSessionManager {
           isPlaylist: false
         };
       }
+      if (!isPlaylist) {
+        this.#noteRunProducedSegment(session, filePath);
+      }
       return {
         kind: "file",
         stream: isPlaylist
@@ -6855,7 +7388,16 @@ export class HlsSessionManager {
     }
 
     this.#resumeEncoder(session, "session disposed");
-    if (session.ffmpeg && !session.ffmpeg.killed) {
+    // Whether the process is still RUNNING, not whether anyone has called kill
+    // on it: `.killed` means only that a signal was sent, and a run that ended
+    // by itself — the file watched through, or a failure — was never killed at
+    // all. Asked the old way, every idle session on disposal signalled a dead
+    // pid and claimed to be stopping a run that had already ended.
+    if (session.ffmpeg && !hasChildExited(session.ffmpeg)) {
+      // The run ends with the session, and the state must say so: left where it
+      // was, it would go on claiming a process that can be signalled and an
+      // input that is being read, about a session that no longer exists.
+      this.#transitionRun(session, ENCODE_RUN_EVENT.STOP_ORDERED);
       session.ffmpeg.kill("SIGTERM");
       await waitForChildExit(session.ffmpeg);
     }