@torrent-tv/proxy 2.80.18 → 2.80.19

package/services/encode/run-command.js

@@ -703,7 +703,22 @@ export function buildRunCommand({
       "-segment_list_flags",
       "+live",
       ...explicitTimes,
-      segmentFormat.segmentFileNameTemplate()
+      // UNDER A WORKING NAME, not the one it is served as. A piece under its
+      // served name is complete by construction then, whoever else is writing
+      // into the same directory — and the name arrives on the channel above the
+      // instant ffmpeg closes it, which is what turns it into the served one.
+      //
+      // The other branch needs none of this: the HLS muxer writes through a
+      // temporary name of its own (`+temp_file`), so its files appear under
+      // their final name whole.
+      //
+      // TAGGED WITH THE STRETCH IT WAS GIVEN, which names the run without any
+      // counter to keep: intervals never overlap, so two live runs of one output
+      // begin at different numbers by construction. That is what makes clearing
+      // up after a dead run a well-formed question — its unfinished pieces are
+      // the ones carrying its own tag — where before it was answered by taking
+      // the highest SERVED name inside its stretch and judging the bytes.
+      segmentFormat.makingFileNameTemplate(String(safeIndex))
     );
   } else {
     args.push(

package/services/hls-session-manager.js

@@ -70,7 +70,6 @@ import { Output, Outputs } from "./output/Output.js";
 import { masterPlaylistText, mediaPlaylistText, segmentIndexForTime } from "./output/playlists.js";
 import { SourceFiles, sourceDecodeCharacteristics } from "./source/SourceFile.js";
 import { ProducedIndex } from "./produced-index.js";
-import { discardOpenPiece } from "./encode/open-piece.js";
 import { SegmentStore } from "./encode/SegmentStore.js";
 import { EncodeCost } from "./quality/EncodeCost.js";
 import {
@@ -425,10 +424,6 @@ const TRUE_START_MEMORY = 200;
 // twice. It runs on the restart path and a session an hour in has thousands of
 // segments; the figure is for a comparison, not an inventory.
 const BACKWARD_RESTART_SCAN_SEGMENTS = 300;
-// Grace period to wait for the PREVIOUS ffmpeg process to exit (per signal
-// escalation step: SIGTERM, then SIGKILL) before spawning its replacement into
-// the same session directory. See #startEncodeRun.
-const ENCODE_RUN_TERMINATE_GRACE_MS = 2_000;
 // A seek-restart run that exits this fast never did real work — it failed at
 // the seek/open step itself (container demux error, bad audio frame boundary,
 // etc.), not mid-stream. Used to tell a genuine seek failure apart from a
@@ -5535,7 +5530,7 @@ export class HlsSessionManager {
       inputUnavailable: (message) => isInputUnavailable(message),
       onProgress: (report) => this.#noteRunProgress(session, run, report),
       indexOfName: (name) => session.segmentFormat.segmentIndexFromName(name),
-      onClosed: (name) => this.segmentStore.markClosed(session.outputKey ?? "", session.segmentFormat.segmentIndexFromName(name)),
+      onClosed: (name) => this.segmentStore.publish(session.outputKey ?? "", name, session.segmentFormat),
       onEnded: (ended) => this.noteRunEnded(session, run, ended)
     });
     session.runs.add(run);
@@ -7692,31 +7687,15 @@ export class HlsSessionManager {
     // disposed. A run that had already finished or failed is not among them,
     // which is what keeps a stop from erasing how it actually ended.
     for (const run of running) {
-      const ffmpeg = run.process;
-      // The stretch it was given, read now rather than when the process finally
-      // exits: by then the session may have started another run with another
-      // stretch, and the piece to discard belongs to this one.
-      const stoppedSpan = {
-        from: Number.isInteger(run.from) ? run.from : 0,
-        to: Number.isInteger(run.to) ? run.to : -1
-      };
       // The run resumes itself if it was suspended — a stopped process does not
       // act on SIGTERM until it is continued — records the cause, and answers
       // its own exit. Nothing here has to null a field so that the exit is read
       // correctly, because there is no shared field left to misread.
       run.stop(reason);
-      // The session outlives its runs — a stopped rung keeps serving what it
-      // made — so the piece this one had open must not be left looking like one
-      // of them. Not awaited: the caller's own work does not depend on it, and
-      // the wait is for a process that has already been told to go.
-      // WHAT THE RUN ITSELF NAMED, which is the only thing that can say a piece
-      // is whole — a piece cut short still decodes. Written 2026-09-06 and never
-      // passed from here, so the clearing-up ran with nothing proven and fell
-      // back to bounding itself by the run's declared stretch alone.
-      const provenName = typeof run.provenName === "string" ? run.provenName : null;
-      void waitForChildExit(ffmpeg, ENCODE_RUN_TERMINATE_GRACE_MS).then(() =>
-        this.#discardUnfinishedPiece(session, session.dirPath, stoppedSpan, provenName)
-      );
+      // Nothing is cleared up from here. What this run left open is under its
+      // own working name, and the encoding layer removes it when the run's
+      // ending reaches it — one place, and it needs neither the stretch nor the
+      // init bytes this method used to fetch to judge a file by its contents.
     }
     logger.info(`transcode ${session.id} ${running.length} encoder(s) stopped: ${reason}`);
   }
@@ -9589,63 +9568,6 @@ export class HlsSessionManager {
     return this.#producedIndex(session).pathOf(fileName);
   }
 
-  /**
-   * Throw away the piece a run was in the middle of when it ended.
-   *
-   * The `segment` muxer creates its output file when it opens it and writes
-   * into it until the next cut, so at any instant exactly one file in a run's
-   * directory is unfinished: the highest-numbered one. A run that reaches the
-   * end of its work closes that file properly and it is a good piece; a run
-   * killed for a seek does not — measured 2026-09-03, ffmpeg exited 19 ms after
-   * SIGTERM and left `segment-00025.mp4` at zero bytes.
-   *
-   * Leaving it is what created the deadlock this method exists to prevent: an
-   * empty file has a name like any other, so it closed the only hole in the
-   * numbering and the look-ahead kept the encoder stopped for having "produced"
-   * it. Removing it at the moment the run ends means the question never has to
-   * be asked again by anyone.
-   *
-   * A piece is removed only when it is unusable. A run that finished its last
-   * file — the ordinary end of a file, or a stop that arrived between two cuts
-   * — has nothing wrong with it, and deleting good output would cost the work
-   * of making it twice.
-   *
-   * @param {HlsSession} session
-   * @param {string | null | undefined} runDirPath
-   * @returns {Promise<void>}
-   */
-  async #discardUnfinishedPiece(session, runDirPath, within = null, provenName = null) {
-    const canJudgeTracks =
-      typeof session.segmentFormat?.hasEveryTrack === "function" &&
-      session.initBytes &&
-      session.initBytes.length > 0;
-    const removed = await discardOpenPiece(
-      runDirPath,
-      session.segmentFormat,
-      within,
-      canJudgeTracks
-        ? (raw) => {
-          const bytes = cutsAtGivenTimes(session) && session.segmentFormat.stripInit
-            ? session.segmentFormat.stripInit(raw)
-            : raw;
-          return session.segmentFormat.hasEveryTrack(bytes, session.initBytes);
-        }
-        : null,
-      provenName
-    );
-    if (removed !== null) {
-      // Removed on purpose, so the index must not go on answering with it.
-      this.#producedIndex(session).invalidate();
-      logger.info(
-        `transcode ${session.id} discarded segment #${removed}: ` +
-          "the run ended while it was open, so it holds no usable piece"
-      );
-    }
-  }
-
-
-
-
   #holdForProduction(session, fileName, isPlaylist, options) {
     /** @type {{ address: string, rank: number, topRank: number } | null} */
     let ranked = null;

package/services/orchestrators/EncodeOrchestrator.js

@@ -273,11 +273,10 @@ export class EncodeOrchestrator {
    * @param {number} index
    */
   noteProduced(address, index) {
-    // TOLD TO THE AUTHORITY, not only to the map. A piece being closed is a fact
-    // about the disk, and the store is what holds those; told to the map alone
-    // it would survive exactly until the next time the map is brought back into
-    // step, and then be gone with no file to show for it.
-    this.segmentStore?.markClosed(address, index);
+    // Nothing is told to the store: by the time this is called the piece is
+    // ALREADY under its served name, because the rename is what closing it
+    // means. A statement kept beside the disk would be a second owner of one
+    // fact, which is what item 87 removed from the coverage map.
     this.coverageOf(address).markReady(index);
     for (const run of this.runsOn(address)) {
       run.noteProduced(index);
@@ -375,6 +374,23 @@ export class EncodeOrchestrator {
     // when the reason it cuts the budget changes, so asking it three times in
     // one pass is three chances to say a thing that happened once.
     const maxRuns = this.#affordableOn(address, live);
+    // THE TERMS EVERY ARRIVAL IS COMPUTED FROM, named here so the line below can
+    // print them. A decision of this plan is `delay + (index - at) / rate +
+    // madeBetween * refetch` against a deadline, so without the rate and the two
+    // prices no recorded decision can be reproduced — which is what happened
+    // with the one-piece intervals of 2026-09-08: the rate was substituted six
+    // times from the speeds the session reported elsewhere and none of them gave
+    // the answer the plan had given.
+    const costs = this.#costs.seconds();
+    const refetchSecPerFilmSecond = this.refetchSecPerFilmSecond(address);
+    // The best figure this host has: what a run here is doing now, what one was
+    // last measured doing, or what the startup benchmark predicted. The first
+    // two are this output's own; the third exists before either.
+    const speedX = Math.max(
+      live.reduce((best, run) => Math.max(best, run.speedX || 0), 0),
+      this.#lastSpeed.get(address) ?? 0,
+      this.startingSpeedFor(address) || 0
+    );
     const actions = planEncoders({
       coverage,
       windows,
@@ -387,26 +403,19 @@ export class EncodeOrchestrator {
       // What a start and a kill cost, measured from this host's own runs rather
       // than written into the code from one machine's reading. Zero until
       // something has been measured, which is the same convention as the
-      // refetch price below and is stated so the bias is known.
-      ...this.#costs.seconds(),
+      // refetch price and is stated so the bias is known.
+      ...costs,
       // What a second of film costs to fetch again, in seconds of swarm time.
       // Answered by whoever measures the film's own byte rate and the swarm's;
       // zero until they have, which makes driving through look cheaper than it
       // is and is stated here so the bias is known.
-      refetchSecPerFilmSecond: this.refetchSecPerFilmSecond(address),
+      refetchSecPerFilmSecond,
       // How much slower one encoder runs beside others, read off this host's own
       // startup measurement. A pure function over a measured table: beyond what
       // was measured it holds the largest reading rather than continuing a curve
       // nothing observed.
       contentionPenaltyFor: (others) => contentionPenalty(others, this.contentionPenalties).penalty,
-      // The best figure this host has: what a run here is doing now, what one
-      // was last measured doing, or what the startup benchmark predicted. The
-      // first two are this output's own; the third exists before either.
-      speedX: Math.max(
-        live.reduce((best, run) => Math.max(best, run.speedX || 0), 0),
-        this.#lastSpeed.get(address) ?? 0,
-        this.startingSpeedFor(address) || 0
-      )
+      speedX
     });
 
     // A move is the plan taking a running encoder away from where it already
@@ -427,10 +436,21 @@ export class EncodeOrchestrator {
     // exiting, twelve of them normally — and the reasons printed beside them
     // read as moves, so the fault was diagnosed three times as something it was
     // not. An interval is what a run is, and it was the one thing missing.
+    //
+    // AND THE TERMS, for the same reason one step further: an interval says what
+    // was decided and the terms say why. `speed` is what every arrival is
+    // divided by, so a decision recorded without it can be re-read and not
+    // recomputed; `firstByte` and `kill` are what a start and a stop cost here;
+    // `refetch` is what a second of film costs to fetch again. A zero in the
+    // last three is a measurement nobody has taken, not a free operation, and it
+    // is printed so that reading it as free is a choice rather than an accident.
     if (actions.some((action) => action.type !== "keep")) {
       this.logger.info(
         `encode-plan on ${address}: ` +
-        `${actions.map((action) => `${action.type} #${action.from ?? "?"}..#${action.to ?? "?"}`).join(", ")}`
+        `${actions.map((action) => `${action.type} #${action.from ?? "?"}..#${action.to ?? "?"}`).join(", ")}` +
+        ` [speed=${speedX.toFixed(2)}x firstByte=${costs.firstByteWaitSec.toFixed(2)}s ` +
+        `kill=${costs.killCostSec.toFixed(2)}s refetch=${refetchSecPerFilmSecond.toFixed(3)}s/s ` +
+        `maxRuns=${maxRuns} live=${live.length}]`
       );
     }
     if (actions.some((action) => action.type === "move")) {
@@ -547,17 +567,12 @@ export class EncodeOrchestrator {
     const onThisOutput = this.#runs.get(address) ?? [];
     onThisOutput.push(run);
     this.#runs.set(address, onThisOutput);
-    // This run rewrites the stretch it was given, so what was closed inside that
-    // stretch is no longer closed. Without this a number closed by an earlier run
-    // stays servable while a later one is halfway through writing it again.
-    //
-    // Bounded by the run's own end, which is the same number the claim below
-    // carries. Unbounded it unproved the whole film beyond the start of any run,
-    // and readiness is now a projection of what is proven — so a one-segment run
-    // at the beginning would have declared the rest of the output unmade.
-    const runsTo = endOfRun({ from, to });
-    this.segmentStore?.forgetClosed(address, from, runsTo);
-    this.coverageOf(address).claim(run, from, runsTo);
+    // Nothing has to be un-proved when a run takes a stretch that has already
+    // been written. A piece is only ever NAMED as served once it is closed, and
+    // a run writing that number again writes under a working name until it
+    // closes its own — so the file standing there is a complete piece made by
+    // somebody, and serving it is right until the newer one replaces it whole.
+    this.coverageOf(address).claim(run, from, endOfRun({ from, to }));
     run.start(because);
   }
 
@@ -654,15 +669,11 @@ export class EncodeOrchestrator {
     this.#costs.note(ended);
     // Exactly one ending is normal — the run reached the end of the stretch it
     // was given and closed its last file. Every other leaves a piece open, and
-    // that file looks finished however the run ended: stopped, ffmpeg writes it
-    // out and names it like any other; killed harder, it leaves the bytes it
-    // had. Either way it decodes and holds less film than its number promises.
-    // So what is kept is what the run PROVED it finished, and nothing beyond.
-    if (ended.ending !== ENCODE_EXIT.COMPLETE && this.segmentStore) {
-      void this.segmentStore
-        .discardOpenPieceOf(ended.address, { from: ended.from, to: ended.to }, null, ended.provenName)
-        .catch(() => {});
-    }
+    // that piece is under this run's OWN working name, so clearing up after it
+    // is a name match: no stretch to search and no bytes to judge. Done for
+    // every ending, the normal one included, since a run that finished cleanly
+    // has nothing under a working name and the sweep then removes nothing.
+    this.segmentStore?.clearUpAfter(ended.address, ended.from);
     this.coverageOf(ended.address).release(ended.run);
     const remaining = this.runsOn(ended.address).filter((run) => run !== ended.run);
     if (remaining.length === 0) {

package/services/segment-formats/fmp4.js

@@ -76,6 +76,9 @@ function findFragmentBounds(bytes) {
 }
 
 const INIT_FILE_NAME = "init.mp4";
+// What a piece is called while it is still being written. See
+// `makingFileNameTemplate`.
+const MAKING_PATTERN = /^making-([0-9a-z]+)-(\d{5})\.mp4$/;
 const SEGMENT_PATTERN = /^segment-(\d{5})\.mp4$/;
 
 /**
@@ -140,6 +143,57 @@ export const fmp4Format = {
   },
 
   /** The output path template for the `segment` muxer. */
+  /**
+   * The name ffmpeg is told to write a piece under WHILE IT IS MAKING IT.
+   *
+   * Not the name it is served under. A piece being written is not a piece, and
+   * under its final name it is indistinguishable from one — which is how half a
+   * segment came to be served: the proof of completeness was "the next file
+   * exists", true of one writer walking forward and false the moment two runs
+   * share an output, because the next file is then written by another process.
+   * Field 2026-09-08: `segment-00057.mp4` served at 2 268 361 bytes and then at
+   * 4 510 940, and the browser refused the whole one for the rest of the session.
+   *
+   * With a working name, the served name appears only when the encoder has said
+   * the piece is closed, and existence under it IS the proof — one rule, the
+   * same for every branch, and true whether or not our own process is alive.
+   *
+   * @returns {string}
+   */
+  makingFileNameTemplate(tag) {
+    return `making-${String(tag ?? "0").replace(/[^0-9a-z]/g, "")}-%05d.mp4`;
+  },
+
+  /**
+   * Which run is writing this working name, or null when the name is not one.
+   *
+   * The tag is what makes clearing up after a dead run possible without
+   * guessing: several runs write into one directory, so "the unfinished pieces"
+   * is only a well-formed question per run. It used to be answered by looking
+   * for the highest SERVED name inside the stretch the ended run was given and
+   * judging its bytes — a guess, and under the naming rule above it would remove
+   * a complete piece somebody else had closed.
+   *
+   * @param {string} name
+   * @returns {string | null}
+   */
+  makingTagOf(name) {
+    const match = MAKING_PATTERN.exec(String(name ?? "").trim());
+    return match ? match[1] : null;
+  },
+
+  /**
+   * The name a piece just closed under a working name is served as, or null when
+   * the name is not one of ours.
+   *
+   * @param {string} makingName
+   * @returns {string | null}
+   */
+  servedNameOf(makingName) {
+    const match = MAKING_PATTERN.exec(String(makingName ?? "").trim());
+    return match ? this.segmentFileName(Number(match[2])) : null;
+  },
+
   segmentFileNameTemplate() {
     return "segment-%05d.mp4";
   },

package/services/segment-formats/mpegts.js

@@ -14,6 +14,9 @@
  * See {@link SegmentFormat} in `./index.js` for the interface contract.
  */
 
+// What a piece is called while it is still being written. See
+// `makingFileNameTemplate`.
+const MAKING_PATTERN = /^making-([0-9a-z]+)-(\d{5})\.ts$/;
 const SEGMENT_PATTERN = /^segment-(\d{5})\.ts$/;
 
 /**
@@ -47,6 +50,57 @@ export const mpegtsFormat = {
   },
 
   /** The output path template for the `segment` muxer. */
+  /**
+   * The name ffmpeg is told to write a piece under WHILE IT IS MAKING IT.
+   *
+   * Not the name it is served under. A piece being written is not a piece, and
+   * under its final name it is indistinguishable from one — which is how half a
+   * segment came to be served: the proof of completeness was "the next file
+   * exists", true of one writer walking forward and false the moment two runs
+   * share an output, because the next file is then written by another process.
+   * Field 2026-09-08: `segment-00057.mp4` served at 2 268 361 bytes and then at
+   * 4 510 940, and the browser refused the whole one for the rest of the session.
+   *
+   * With a working name, the served name appears only when the encoder has said
+   * the piece is closed, and existence under it IS the proof — one rule, the
+   * same for every branch, and true whether or not our own process is alive.
+   *
+   * @returns {string}
+   */
+  makingFileNameTemplate(tag) {
+    return `making-${String(tag ?? "0").replace(/[^0-9a-z]/g, "")}-%05d.ts`;
+  },
+
+  /**
+   * Which run is writing this working name, or null when the name is not one.
+   *
+   * The tag is what makes clearing up after a dead run possible without
+   * guessing: several runs write into one directory, so "the unfinished pieces"
+   * is only a well-formed question per run. It used to be answered by looking
+   * for the highest SERVED name inside the stretch the ended run was given and
+   * judging its bytes — a guess, and under the naming rule above it would remove
+   * a complete piece somebody else had closed.
+   *
+   * @param {string} name
+   * @returns {string | null}
+   */
+  makingTagOf(name) {
+    const match = MAKING_PATTERN.exec(String(name ?? "").trim());
+    return match ? match[1] : null;
+  },
+
+  /**
+   * The name a piece just closed under a working name is served as, or null when
+   * the name is not one of ours.
+   *
+   * @param {string} makingName
+   * @returns {string | null}
+   */
+  servedNameOf(makingName) {
+    const match = MAKING_PATTERN.exec(String(makingName ?? "").trim());
+    return match ? this.segmentFileName(Number(match[2])) : null;
+  },
+
   segmentFileNameTemplate() {
     return "segment-%05d.ts";
   },

package/test/coverage-follows-the-disk.test.js

@@ -103,8 +103,12 @@ function aViewerAtTheStart(made) {
  */
 function theWholeFilmIsOnDisk(store, dir) {
   for (let index = 0; index < SEGMENTS; index += 1) {
+    // Under the served name, which is the whole of what says a piece is closed:
+    // it takes that name only when its writer has said so. There used to be a
+    // statement kept beside the disk as well, told by whoever noticed a piece
+    // being produced — a second owner of one fact, and the fault this file's own
+    // subject is.
     writeFileSync(path.join(dir, fmp4Format.segmentFileName(index)), Buffer.alloc(16));
-    store.markClosed(PICTURE, index);
   }
 }
 

package/test/orchestrator-wired.test.js

@@ -190,6 +190,10 @@ test("segments already made are known to the plan, whoever made them", (t) => {
   const coverage = manager.encodeOrchestrator.coverageOf(KEY);
   assert.equal(coverage.isReady(0), true);
   assert.equal(coverage.isReady(2), true);
-  assert.equal(coverage.isReady(3), false, "the highest has no successor to prove it closed");
+  // Including the highest. It used to be excluded for having no successor to
+  // prove it closed, which left the last piece of every run unprovable for ever
+  // — and proved a half-written one whenever the number above it was written by
+  // another run of the same output. A served name is the proof now.
+  assert.equal(coverage.isReady(3), true, "its name says it is closed");
   void store;
 });