@torrent-tv/proxy 2.80.17 → 2.80.19

package/services/hls-session-manager.js

@@ -70,7 +70,6 @@ import { Output, Outputs } from "./output/Output.js";
 import { masterPlaylistText, mediaPlaylistText, segmentIndexForTime } from "./output/playlists.js";
 import { SourceFiles, sourceDecodeCharacteristics } from "./source/SourceFile.js";
 import { ProducedIndex } from "./produced-index.js";
-import { discardOpenPiece } from "./encode/open-piece.js";
 import { SegmentStore } from "./encode/SegmentStore.js";
 import { EncodeCost } from "./quality/EncodeCost.js";
 import {
@@ -425,10 +424,6 @@ const TRUE_START_MEMORY = 200;
 // twice. It runs on the restart path and a session an hour in has thousands of
 // segments; the figure is for a comparison, not an inventory.
 const BACKWARD_RESTART_SCAN_SEGMENTS = 300;
-// Grace period to wait for the PREVIOUS ffmpeg process to exit (per signal
-// escalation step: SIGTERM, then SIGKILL) before spawning its replacement into
-// the same session directory. See #startEncodeRun.
-const ENCODE_RUN_TERMINATE_GRACE_MS = 2_000;
 // A seek-restart run that exits this fast never did real work — it failed at
 // the seek/open step itself (container demux error, bad audio frame boundary,
 // etc.), not mid-stream. Used to tell a genuine seek failure apart from a
@@ -5535,7 +5530,7 @@ export class HlsSessionManager {
       inputUnavailable: (message) => isInputUnavailable(message),
       onProgress: (report) => this.#noteRunProgress(session, run, report),
       indexOfName: (name) => session.segmentFormat.segmentIndexFromName(name),
-      onClosed: (name) => this.segmentStore.markClosed(session.outputKey ?? "", session.segmentFormat.segmentIndexFromName(name)),
+      onClosed: (name) => this.segmentStore.publish(session.outputKey ?? "", name, session.segmentFormat),
       onEnded: (ended) => this.noteRunEnded(session, run, ended)
     });
     session.runs.add(run);
@@ -7692,31 +7687,15 @@ export class HlsSessionManager {
     // disposed. A run that had already finished or failed is not among them,
     // which is what keeps a stop from erasing how it actually ended.
     for (const run of running) {
-      const ffmpeg = run.process;
-      // The stretch it was given, read now rather than when the process finally
-      // exits: by then the session may have started another run with another
-      // stretch, and the piece to discard belongs to this one.
-      const stoppedSpan = {
-        from: Number.isInteger(run.from) ? run.from : 0,
-        to: Number.isInteger(run.to) ? run.to : -1
-      };
       // The run resumes itself if it was suspended — a stopped process does not
       // act on SIGTERM until it is continued — records the cause, and answers
       // its own exit. Nothing here has to null a field so that the exit is read
       // correctly, because there is no shared field left to misread.
       run.stop(reason);
-      // The session outlives its runs — a stopped rung keeps serving what it
-      // made — so the piece this one had open must not be left looking like one
-      // of them. Not awaited: the caller's own work does not depend on it, and
-      // the wait is for a process that has already been told to go.
-      // WHAT THE RUN ITSELF NAMED, which is the only thing that can say a piece
-      // is whole — a piece cut short still decodes. Written 2026-09-06 and never
-      // passed from here, so the clearing-up ran with nothing proven and fell
-      // back to bounding itself by the run's declared stretch alone.
-      const provenName = typeof run.provenName === "string" ? run.provenName : null;
-      void waitForChildExit(ffmpeg, ENCODE_RUN_TERMINATE_GRACE_MS).then(() =>
-        this.#discardUnfinishedPiece(session, session.dirPath, stoppedSpan, provenName)
-      );
+      // Nothing is cleared up from here. What this run left open is under its
+      // own working name, and the encoding layer removes it when the run's
+      // ending reaches it — one place, and it needs neither the stretch nor the
+      // init bytes this method used to fetch to judge a file by its contents.
     }
     logger.info(`transcode ${session.id} ${running.length} encoder(s) stopped: ${reason}`);
   }
@@ -9589,63 +9568,6 @@ export class HlsSessionManager {
     return this.#producedIndex(session).pathOf(fileName);
   }
 
-  /**
-   * Throw away the piece a run was in the middle of when it ended.
-   *
-   * The `segment` muxer creates its output file when it opens it and writes
-   * into it until the next cut, so at any instant exactly one file in a run's
-   * directory is unfinished: the highest-numbered one. A run that reaches the
-   * end of its work closes that file properly and it is a good piece; a run
-   * killed for a seek does not — measured 2026-09-03, ffmpeg exited 19 ms after
-   * SIGTERM and left `segment-00025.mp4` at zero bytes.
-   *
-   * Leaving it is what created the deadlock this method exists to prevent: an
-   * empty file has a name like any other, so it closed the only hole in the
-   * numbering and the look-ahead kept the encoder stopped for having "produced"
-   * it. Removing it at the moment the run ends means the question never has to
-   * be asked again by anyone.
-   *
-   * A piece is removed only when it is unusable. A run that finished its last
-   * file — the ordinary end of a file, or a stop that arrived between two cuts
-   * — has nothing wrong with it, and deleting good output would cost the work
-   * of making it twice.
-   *
-   * @param {HlsSession} session
-   * @param {string | null | undefined} runDirPath
-   * @returns {Promise<void>}
-   */
-  async #discardUnfinishedPiece(session, runDirPath, within = null, provenName = null) {
-    const canJudgeTracks =
-      typeof session.segmentFormat?.hasEveryTrack === "function" &&
-      session.initBytes &&
-      session.initBytes.length > 0;
-    const removed = await discardOpenPiece(
-      runDirPath,
-      session.segmentFormat,
-      within,
-      canJudgeTracks
-        ? (raw) => {
-          const bytes = cutsAtGivenTimes(session) && session.segmentFormat.stripInit
-            ? session.segmentFormat.stripInit(raw)
-            : raw;
-          return session.segmentFormat.hasEveryTrack(bytes, session.initBytes);
-        }
-        : null,
-      provenName
-    );
-    if (removed !== null) {
-      // Removed on purpose, so the index must not go on answering with it.
-      this.#producedIndex(session).invalidate();
-      logger.info(
-        `transcode ${session.id} discarded segment #${removed}: ` +
-          "the run ended while it was open, so it holds no usable piece"
-      );
-    }
-  }
-
-
-
-
   #holdForProduction(session, fileName, isPlaylist, options) {
     /** @type {{ address: string, rank: number, topRank: number } | null} */
     let ranked = null;

package/services/orchestrators/EncodeOrchestrator.js

@@ -273,11 +273,10 @@ export class EncodeOrchestrator {
    * @param {number} index
    */
   noteProduced(address, index) {
-    // TOLD TO THE AUTHORITY, not only to the map. A piece being closed is a fact
-    // about the disk, and the store is what holds those; told to the map alone
-    // it would survive exactly until the next time the map is brought back into
-    // step, and then be gone with no file to show for it.
-    this.segmentStore?.markClosed(address, index);
+    // Nothing is told to the store: by the time this is called the piece is
+    // ALREADY under its served name, because the rename is what closing it
+    // means. A statement kept beside the disk would be a second owner of one
+    // fact, which is what item 87 removed from the coverage map.
     this.coverageOf(address).markReady(index);
     for (const run of this.runsOn(address)) {
       run.noteProduced(index);
@@ -375,6 +374,23 @@ export class EncodeOrchestrator {
     // when the reason it cuts the budget changes, so asking it three times in
     // one pass is three chances to say a thing that happened once.
     const maxRuns = this.#affordableOn(address, live);
+    // THE TERMS EVERY ARRIVAL IS COMPUTED FROM, named here so the line below can
+    // print them. A decision of this plan is `delay + (index - at) / rate +
+    // madeBetween * refetch` against a deadline, so without the rate and the two
+    // prices no recorded decision can be reproduced — which is what happened
+    // with the one-piece intervals of 2026-09-08: the rate was substituted six
+    // times from the speeds the session reported elsewhere and none of them gave
+    // the answer the plan had given.
+    const costs = this.#costs.seconds();
+    const refetchSecPerFilmSecond = this.refetchSecPerFilmSecond(address);
+    // The best figure this host has: what a run here is doing now, what one was
+    // last measured doing, or what the startup benchmark predicted. The first
+    // two are this output's own; the third exists before either.
+    const speedX = Math.max(
+      live.reduce((best, run) => Math.max(best, run.speedX || 0), 0),
+      this.#lastSpeed.get(address) ?? 0,
+      this.startingSpeedFor(address) || 0
+    );
     const actions = planEncoders({
       coverage,
       windows,
@@ -387,26 +403,19 @@ export class EncodeOrchestrator {
       // What a start and a kill cost, measured from this host's own runs rather
       // than written into the code from one machine's reading. Zero until
       // something has been measured, which is the same convention as the
-      // refetch price below and is stated so the bias is known.
-      ...this.#costs.seconds(),
+      // refetch price and is stated so the bias is known.
+      ...costs,
       // What a second of film costs to fetch again, in seconds of swarm time.
       // Answered by whoever measures the film's own byte rate and the swarm's;
       // zero until they have, which makes driving through look cheaper than it
       // is and is stated here so the bias is known.
-      refetchSecPerFilmSecond: this.refetchSecPerFilmSecond(address),
+      refetchSecPerFilmSecond,
       // How much slower one encoder runs beside others, read off this host's own
       // startup measurement. A pure function over a measured table: beyond what
       // was measured it holds the largest reading rather than continuing a curve
       // nothing observed.
       contentionPenaltyFor: (others) => contentionPenalty(others, this.contentionPenalties).penalty,
-      // The best figure this host has: what a run here is doing now, what one
-      // was last measured doing, or what the startup benchmark predicted. The
-      // first two are this output's own; the third exists before either.
-      speedX: Math.max(
-        live.reduce((best, run) => Math.max(best, run.speedX || 0), 0),
-        this.#lastSpeed.get(address) ?? 0,
-        this.startingSpeedFor(address) || 0
-      )
+      speedX
     });
 
     // A move is the plan taking a running encoder away from where it already
@@ -417,6 +426,33 @@ export class EncodeOrchestrator {
     // happens — everything a rerun of the same decision needs: the windows
     // this call saw (priority, the real time, which side of the viewers),
     // the budget, and where every live run stood.
+    // WHAT WAS DECIDED AND WITH WHAT INTERVAL, said whenever anything is placed
+    // or taken away — not only on a move.
+    //
+    // Field 2026-09-08 could not be diagnosed from this line: it printed the
+    // windows, the budget and where the live runs stood, and NOT the intervals
+    // the actions carried. What the session actually did was give every encoder
+    // an interval of exactly ONE segment — 63 runs, each making one piece and
+    // exiting, twelve of them normally — and the reasons printed beside them
+    // read as moves, so the fault was diagnosed three times as something it was
+    // not. An interval is what a run is, and it was the one thing missing.
+    //
+    // AND THE TERMS, for the same reason one step further: an interval says what
+    // was decided and the terms say why. `speed` is what every arrival is
+    // divided by, so a decision recorded without it can be re-read and not
+    // recomputed; `firstByte` and `kill` are what a start and a stop cost here;
+    // `refetch` is what a second of film costs to fetch again. A zero in the
+    // last three is a measurement nobody has taken, not a free operation, and it
+    // is printed so that reading it as free is a choice rather than an accident.
+    if (actions.some((action) => action.type !== "keep")) {
+      this.logger.info(
+        `encode-plan on ${address}: ` +
+        `${actions.map((action) => `${action.type} #${action.from ?? "?"}..#${action.to ?? "?"}`).join(", ")}` +
+        ` [speed=${speedX.toFixed(2)}x firstByte=${costs.firstByteWaitSec.toFixed(2)}s ` +
+        `kill=${costs.killCostSec.toFixed(2)}s refetch=${refetchSecPerFilmSecond.toFixed(3)}s/s ` +
+        `maxRuns=${maxRuns} live=${live.length}]`
+      );
+    }
     if (actions.some((action) => action.type === "move")) {
       this.logger.info(
         `encode-plan move on ${address}: windows=${JSON.stringify(windows)} ` +
@@ -531,17 +567,12 @@ export class EncodeOrchestrator {
     const onThisOutput = this.#runs.get(address) ?? [];
     onThisOutput.push(run);
     this.#runs.set(address, onThisOutput);
-    // This run rewrites the stretch it was given, so what was closed inside that
-    // stretch is no longer closed. Without this a number closed by an earlier run
-    // stays servable while a later one is halfway through writing it again.
-    //
-    // Bounded by the run's own end, which is the same number the claim below
-    // carries. Unbounded it unproved the whole film beyond the start of any run,
-    // and readiness is now a projection of what is proven — so a one-segment run
-    // at the beginning would have declared the rest of the output unmade.
-    const runsTo = endOfRun({ from, to });
-    this.segmentStore?.forgetClosed(address, from, runsTo);
-    this.coverageOf(address).claim(run, from, runsTo);
+    // Nothing has to be un-proved when a run takes a stretch that has already
+    // been written. A piece is only ever NAMED as served once it is closed, and
+    // a run writing that number again writes under a working name until it
+    // closes its own — so the file standing there is a complete piece made by
+    // somebody, and serving it is right until the newer one replaces it whole.
+    this.coverageOf(address).claim(run, from, endOfRun({ from, to }));
     run.start(because);
   }
 
@@ -638,15 +669,11 @@ export class EncodeOrchestrator {
     this.#costs.note(ended);
     // Exactly one ending is normal — the run reached the end of the stretch it
     // was given and closed its last file. Every other leaves a piece open, and
-    // that file looks finished however the run ended: stopped, ffmpeg writes it
-    // out and names it like any other; killed harder, it leaves the bytes it
-    // had. Either way it decodes and holds less film than its number promises.
-    // So what is kept is what the run PROVED it finished, and nothing beyond.
-    if (ended.ending !== ENCODE_EXIT.COMPLETE && this.segmentStore) {
-      void this.segmentStore
-        .discardOpenPieceOf(ended.address, { from: ended.from, to: ended.to }, null, ended.provenName)
-        .catch(() => {});
-    }
+    // that piece is under this run's OWN working name, so clearing up after it
+    // is a name match: no stretch to search and no bytes to judge. Done for
+    // every ending, the normal one included, since a run that finished cleanly
+    // has nothing under a working name and the sweep then removes nothing.
+    this.segmentStore?.clearUpAfter(ended.address, ended.from);
     this.coverageOf(ended.address).release(ended.run);
     const remaining = this.runsOn(ended.address).filter((run) => run !== ended.run);
     if (remaining.length === 0) {

package/services/segment-formats/fmp4.js

@@ -76,6 +76,9 @@ function findFragmentBounds(bytes) {
 }
 
 const INIT_FILE_NAME = "init.mp4";
+// What a piece is called while it is still being written. See
+// `makingFileNameTemplate`.
+const MAKING_PATTERN = /^making-([0-9a-z]+)-(\d{5})\.mp4$/;
 const SEGMENT_PATTERN = /^segment-(\d{5})\.mp4$/;
 
 /**
@@ -140,6 +143,57 @@ export const fmp4Format = {
   },
 
   /** The output path template for the `segment` muxer. */
+  /**
+   * The name ffmpeg is told to write a piece under WHILE IT IS MAKING IT.
+   *
+   * Not the name it is served under. A piece being written is not a piece, and
+   * under its final name it is indistinguishable from one — which is how half a
+   * segment came to be served: the proof of completeness was "the next file
+   * exists", true of one writer walking forward and false the moment two runs
+   * share an output, because the next file is then written by another process.
+   * Field 2026-09-08: `segment-00057.mp4` served at 2 268 361 bytes and then at
+   * 4 510 940, and the browser refused the whole one for the rest of the session.
+   *
+   * With a working name, the served name appears only when the encoder has said
+   * the piece is closed, and existence under it IS the proof — one rule, the
+   * same for every branch, and true whether or not our own process is alive.
+   *
+   * @returns {string}
+   */
+  makingFileNameTemplate(tag) {
+    return `making-${String(tag ?? "0").replace(/[^0-9a-z]/g, "")}-%05d.mp4`;
+  },
+
+  /**
+   * Which run is writing this working name, or null when the name is not one.
+   *
+   * The tag is what makes clearing up after a dead run possible without
+   * guessing: several runs write into one directory, so "the unfinished pieces"
+   * is only a well-formed question per run. It used to be answered by looking
+   * for the highest SERVED name inside the stretch the ended run was given and
+   * judging its bytes — a guess, and under the naming rule above it would remove
+   * a complete piece somebody else had closed.
+   *
+   * @param {string} name
+   * @returns {string | null}
+   */
+  makingTagOf(name) {
+    const match = MAKING_PATTERN.exec(String(name ?? "").trim());
+    return match ? match[1] : null;
+  },
+
+  /**
+   * The name a piece just closed under a working name is served as, or null when
+   * the name is not one of ours.
+   *
+   * @param {string} makingName
+   * @returns {string | null}
+   */
+  servedNameOf(makingName) {
+    const match = MAKING_PATTERN.exec(String(makingName ?? "").trim());
+    return match ? this.segmentFileName(Number(match[2])) : null;
+  },
+
   segmentFileNameTemplate() {
     return "segment-%05d.mp4";
   },

package/services/segment-formats/mpegts.js

@@ -14,6 +14,9 @@
  * See {@link SegmentFormat} in `./index.js` for the interface contract.
  */
 
+// What a piece is called while it is still being written. See
+// `makingFileNameTemplate`.
+const MAKING_PATTERN = /^making-([0-9a-z]+)-(\d{5})\.ts$/;
 const SEGMENT_PATTERN = /^segment-(\d{5})\.ts$/;
 
 /**
@@ -47,6 +50,57 @@ export const mpegtsFormat = {
   },
 
   /** The output path template for the `segment` muxer. */
+  /**
+   * The name ffmpeg is told to write a piece under WHILE IT IS MAKING IT.
+   *
+   * Not the name it is served under. A piece being written is not a piece, and
+   * under its final name it is indistinguishable from one — which is how half a
+   * segment came to be served: the proof of completeness was "the next file
+   * exists", true of one writer walking forward and false the moment two runs
+   * share an output, because the next file is then written by another process.
+   * Field 2026-09-08: `segment-00057.mp4` served at 2 268 361 bytes and then at
+   * 4 510 940, and the browser refused the whole one for the rest of the session.
+   *
+   * With a working name, the served name appears only when the encoder has said
+   * the piece is closed, and existence under it IS the proof — one rule, the
+   * same for every branch, and true whether or not our own process is alive.
+   *
+   * @returns {string}
+   */
+  makingFileNameTemplate(tag) {
+    return `making-${String(tag ?? "0").replace(/[^0-9a-z]/g, "")}-%05d.ts`;
+  },
+
+  /**
+   * Which run is writing this working name, or null when the name is not one.
+   *
+   * The tag is what makes clearing up after a dead run possible without
+   * guessing: several runs write into one directory, so "the unfinished pieces"
+   * is only a well-formed question per run. It used to be answered by looking
+   * for the highest SERVED name inside the stretch the ended run was given and
+   * judging its bytes — a guess, and under the naming rule above it would remove
+   * a complete piece somebody else had closed.
+   *
+   * @param {string} name
+   * @returns {string | null}
+   */
+  makingTagOf(name) {
+    const match = MAKING_PATTERN.exec(String(name ?? "").trim());
+    return match ? match[1] : null;
+  },
+
+  /**
+   * The name a piece just closed under a working name is served as, or null when
+   * the name is not one of ours.
+   *
+   * @param {string} makingName
+   * @returns {string | null}
+   */
+  servedNameOf(makingName) {
+    const match = MAKING_PATTERN.exec(String(makingName ?? "").trim());
+    return match ? this.segmentFileName(Number(match[2])) : null;
+  },
+
   segmentFileNameTemplate() {
     return "segment-%05d.ts";
   },

package/test/coverage-follows-the-disk.test.js

@@ -103,8 +103,12 @@ function aViewerAtTheStart(made) {
  */
 function theWholeFilmIsOnDisk(store, dir) {
   for (let index = 0; index < SEGMENTS; index += 1) {
+    // Under the served name, which is the whole of what says a piece is closed:
+    // it takes that name only when its writer has said so. There used to be a
+    // statement kept beside the disk as well, told by whoever noticed a piece
+    // being produced — a second owner of one fact, and the fault this file's own
+    // subject is.
     writeFileSync(path.join(dir, fmp4Format.segmentFileName(index)), Buffer.alloc(16));
-    store.markClosed(PICTURE, index);
   }
 }
 

package/test/move-cost.test.js

@@ -41,73 +41,145 @@ import { RunCosts } from "../services/encode/run-costs.js";
 import { planEncoders } from "../services/encode/EncodePlan.js";
 import { CoverageMap } from "../services/encode/CoverageMap.js";
 
-test("nothing measured means a move is refused, not priced at zero", () => {
+test("nothing measured is a plain zero, and the floor is derived where the arithmetic is", () => {
   const costs = new RunCosts();
 
-  const { moveCostSec, firstByteWaitSec, killCostSec } = costs.seconds();
-  assert.equal(moveCostSec, Number.POSITIVE_INFINITY, "moving is not free while unpriced");
-  // Placing one where there is none is the OTHER question, and it has no
-  // alternative: the film gets made or it does not.
-  assert.equal(firstByteWaitSec, 0, "placing an encoder is not blocked by an unknown price");
+  const { firstByteWaitSec, killCostSec } = costs.seconds();
+  assert.equal(firstByteWaitSec, 0, "no reading is said as none, not as a guess");
   assert.equal(killCostSec, 0);
+  // There was an `Infinity` here — the cost of a move, made unaffordable until
+  // something had been measured, on the reasoning that an unmeasured price must
+  // not license an irreversible act. It was an exception in a model that needs
+  // none: a first piece cannot appear faster than it takes to ENCODE one, and
+  // how fast this host encodes is measured before any viewer exists, so the
+  // floor belongs where the arithmetic is.
+  assert.equal("moveCostSec" in costs.seconds(), false, "no such figure any more");
 });
 
 test("a run killed before producing anything is a lower bound on the first output", () => {
   const costs = new RunCosts();
 
   // Exactly what a thrash supplies: a run that lived 800 ms and finished
-  // nothing. It says the first output takes AT LEAST that long, which is a fact.
+  // nothing. It says the first output takes AT LEAST that long, which is a fact
+  // and the only reading a thrash can give — every run in one is killed before
+  // it produces.
   costs.note({ livedMs: 800, dyingMs: 40 });
 
-  const { moveCostSec } = costs.seconds();
-  assert.ok(Number.isFinite(moveCostSec), "one killed run is enough to stop the blindness");
-  assert.ok(Math.abs(moveCostSec - 0.84) < 0.001, `got ${moveCostSec}`);
+  const { firstByteWaitSec, killCostSec } = costs.seconds();
+  assert.ok(Math.abs(firstByteWaitSec - 0.8) < 0.001, `got ${firstByteWaitSec}`);
+  assert.ok(Math.abs(killCostSec - 0.04) < 0.001, `got ${killCostSec}`);
 });
 
 test("a run that produced something is measured by its first output, not its life", () => {
   const costs = new RunCosts();
 
-  costs.note({ livedMs: 60_000, firstOutputMs: 900, dyingMs: 100 });
+  costs.note({ livedMs: 60_000, firstOutputMs: 1260, dyingMs: 100 });
 
-  const { moveCostSec, firstByteWaitSec } = costs.seconds();
-  assert.ok(Math.abs(firstByteWaitSec - 0.9) < 0.001, `got ${firstByteWaitSec}`);
-  assert.ok(Math.abs(moveCostSec - 1.0) < 0.001, `got ${moveCostSec}`);
+  const { firstByteWaitSec } = costs.seconds();
+  assert.ok(Math.abs(firstByteWaitSec - 1.26) < 0.001, `got ${firstByteWaitSec}`);
 });
 
-test("the zone sliding one number does not move an encoder that is already reaching it", () => {
-  // The field shape exactly: a run standing at #58 with the viewer's urgent zone
-  // sliding #58..#59 → #59..#60. Driving through one segment costs the encoder a
-  // fraction of a second; moving costs a kill and a cold start.
+/**
+ * The map's real shape: one segment at the viewer, doubling zones ahead down to
+ * p91, and everything behind them at p1 with no deadline. Written out because a
+ * fixture of two zones is not this, and the difference decides the answer: with
+ * nothing stated past the viewer's own zone, a run one segment behind it is
+ * compared on that zone alone and loses by a tenth of a second.
+ *
+ * @param {number} head - The segment the viewer is on.
+ * @param {number} count
+ * @returns {object[]}
+ */
+function mapAt(head, count) {
+  const zones = [];
+  if (head > 0) {
+    zones.push({ from: 0, to: head - 1, priority: 1, withinSeconds: null, behind: true });
+  }
+  let from = head;
+  let width = 1;
+  let rank = 100;
+  while (from < count && rank > 90) {
+    const to = Math.min(count - 1, from + width - 1);
+    zones.push({ from, to, priority: rank, withinSeconds: (from - head) * 4.2, behind: false });
+    from = to + 1;
+    width *= 2;
+    rank -= 1;
+  }
+  if (from < count) {
+    zones.push({ from, to: count - 1, priority: 90, withinSeconds: (from - head) * 4.2, behind: false });
+  }
+  return zones;
+}
+
+test("an encoder is left alone while the viewer is still at or before it", () => {
+  // Every slide of the viewer's zone used to make standing one number behind it
+  // score worse than standing in it — by ten milliseconds, which is nothing but
+  // the double charge for a piece already being made. What holds now is the
+  // narrower and true statement: while the viewer's own zone still contains the
+  // encoder's position, it is left alone. A viewer BEFORE it is a different
+  // case entirely and correctly moves it back — encoders only go forward, so
+  // one standing past a viewer never reaches them.
+  //
+  // Once the viewer has PASSED it, moving forward is correct and happens once: a
+  // run that has produced nothing in 0.8 s of a 1.26 s warm-up owes 0.46 s
+  // before its piece exists, while a fresh one at the viewer's own number owes
+  // 0.32 s of spawn and then the piece — so the viewer is served sooner, and the
+  // number left behind is in nobody's zone.
   const coverage = new CoverageMap();
   coverage.setSegmentCount(482);
-  const run = { from: 58, to: 481, head: 58, speedX: 4.45, isAlive: true };
-  coverage.claim(run, 58, 481);
+  const run = { from: 58, to: -1, head: 58, speedX: 4.45, isAlive: true, startedAt: 1_000_000 };
+  coverage.claim(run, 58, -1);
 
-  const actions = planEncoders({
+  for (const viewerAt of [58]) {
+    const actions = planEncoders({
+      coverage,
+      windows: mapAt(viewerAt, 482),
+      runs: [run],
+      maxRuns: 3,
+      segmentSeconds: 4.2,
+      speedX: 4.45,
+      killCostSec: 0.04,
+      // Measured on the addon host: a run started at 15:50:15.521 and its first
+      // piece existed at 15:50:16.785.
+      firstByteWaitSec: 1.26,
+      refetchSecPerFilmSecond: 0,
+      // 1.98 at 1920x1080, measured: a second encoder takes very nearly all of
+      // the first's speed.
+      contentionPenaltyFor: (others) => (others <= 0 ? 1 : 1.98 ** others),
+      now: 1_000_000 + 800
+    });
+
+    assert.deepEqual(
+      actions.filter((one) => one.type === "move"),
+      [],
+      `the viewer at #${viewerAt} does not cost the encoder its place`
+    );
+  }
+
+  // And once they are past it, exactly one move — not one per slide.
+  const past = [59, 60, 61].map((viewerAt) => planEncoders({
     coverage,
-    windows: [
-      { from: 0, to: 57, priority: 1, withinSeconds: null, behind: true },
-      { from: 59, to: 60, priority: 100, withinSeconds: 0, behind: false }
-    ],
+    windows: mapAt(viewerAt, 482),
     runs: [run],
     maxRuns: 3,
     segmentSeconds: 4.2,
     speedX: 4.45,
-    // Measured on this host: killing takes 40 ms, a fresh encoder's first piece
-    // 900 ms. Against that, driving one segment at 4.45x costs 0.94 s — so the
-    // two are close, and what settles it is that the move ALSO has to encode
-    // the same segment afterwards.
     killCostSec: 0.04,
-    firstByteWaitSec: 0.9,
-    moveCostSec: 0.94,
+    firstByteWaitSec: 1.26,
     refetchSecPerFilmSecond: 0,
-    contentionPenaltyFor: () => 1
-  });
+    contentionPenaltyFor: (others) => (others <= 0 ? 1 : 1.98 ** others),
+    now: 1_000_000 + 800
+  }).filter((one) => one.type === "move"));
 
   assert.deepEqual(
-    actions.filter((one) => one.type === "move"),
-    [],
-    "a run one number behind the zone is already on its way into it"
+    past.map((moves) => moves.length),
+    [1, 1, 1],
+    "one move to where the viewer now is, whichever number that is"
+  );
+  assert.deepEqual(
+    past.map((moves) => moves[0].from),
+    [59, 60, 61],
+    "and it goes to the viewer's own number, not one past it"
   );
 });
 
@@ -128,8 +200,7 @@ test("a move that genuinely saves the viewer time still happens", () => {
     segmentSeconds: 4.2,
     speedX: 4.45,
     killCostSec: 0.04,
-    firstByteWaitSec: 0.9,
-    moveCostSec: 0.94,
+    firstByteWaitSec: 1.26,
     refetchSecPerFilmSecond: 0,
     contentionPenaltyFor: () => 1
   });

package/test/orchestrator-wired.test.js

@@ -190,6 +190,10 @@ test("segments already made are known to the plan, whoever made them", (t) => {
   const coverage = manager.encodeOrchestrator.coverageOf(KEY);
   assert.equal(coverage.isReady(0), true);
   assert.equal(coverage.isReady(2), true);
-  assert.equal(coverage.isReady(3), false, "the highest has no successor to prove it closed");
+  // Including the highest. It used to be excluded for having no successor to
+  // prove it closed, which left the last piece of every run unprovable for ever
+  // — and proved a half-written one whenever the number above it was written by
+  // another run of the same output. A served name is the proof now.
+  assert.equal(coverage.isReady(3), true, "its name says it is closed");
   void store;
 });