@torrent-tv/proxy 2.80.3 → 2.80.4

package/CHANGELOG.md

@@ -1,3 +1,9 @@
+## 2.80.4
+
+- **Fix**: The piece an encoder writes out while it is being stopped is thrown away instead of served. `-segment_list pipe:3` was taken as proof that a piece is whole — ffmpeg names a file when it closes it, so a named file is closed. That is true of the FILE and false of the SPAN: on `SIGTERM` ffmpeg writes out the piece it had open and names it like any other, so what lands on disk is a valid, decodable piece holding film only up to the instant of the stop, under a name whose playlist entry promises the whole span. Field 2026-09-06, one session, both tracks: `segment-00010.mp4` held 3.92 s of its declared 5.589 s — 96 frames — and the picture jumped 1.5 s at 1:02, while the soundtrack's own stopped run left the same shape at 17.5 s, 2.8 s wide. Both were the viewer's report of the picture and the sound jerking.
+- **Fix**: Which piece that is comes from the run itself — the last name it wrote after being told to stop — so nothing is read, no span is measured and no tolerance is chosen. The cleanup already existed and already ran on every abnormal ending; it removed the piece only when the piece did not decode, and this one decodes.
+- **Chore**: A piece genuinely finished a moment before the stop can be named here too, and is then made a second time. That is the cheaper of the two errors by the rule this project already holds: the other one is a hole the viewer sees.
+
 ## 2.80.3
 
 - **Fix**: A boundary carries the keyframe it IS, instead of being looked up by value in the container's list. A cut is kept on the player's clock — `keyframe - startTime`, rounded to six places — and the seek used to add the start time back and search the file's own keyframes for the result. That round trip is lossy: a keyframe at 26.234 s in a container starting at 0.083 s comes back as 26.233999999999998, and "the keyframe at or before that" is then the PREVIOUS one. Two parts in a quadrillion became 8.717 seconds. Where each cut is on the file's own clock is now carried by index (`output/cut-grid.js`, `Timeline.sourceTimes`) and asked for directly, so a boundary cannot fail to find itself.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@torrent-tv/proxy",
-  "version": "2.80.3",
+  "version": "2.80.4",
   "description": "Torrent proxy client that exposes webseed-like HTTP stream endpoint.",
   "license": "GPL-3.0-or-later",
   "publishConfig": {

package/services/encode/EncodeRun.js

@@ -61,6 +61,11 @@ const MICROSECONDS_PER_SECOND = 1_000_000;
  * @property {number} livedMs
  * @property {boolean} normal - Whether this ending is the expected one.
  * @property {string} lastError - The last thing ffmpeg said on stderr.
+ * @property {string | null} flushedName - The piece the encoder wrote out while
+ *   it was shutting down, if it wrote one. It is closed and it is SHORT: it
+ *   holds film only up to the instant the run was stopped, while its name
+ *   promises the whole span the playlist gives that number. Null where the run
+ *   was never told to stop.
  */
 
 /**
@@ -99,6 +104,26 @@ export class EncodeRun {
   /** Half a name left over from the last chunk of the encoder's own channel. */
   #closedTail = "";
 
+  /**
+   * The last piece named on the ready channel AFTER the run was told to stop.
+   *
+   * On SIGTERM ffmpeg writes out the piece it had open and names it like any
+   * other, so "the encoder closed it" stops meaning "it is whole". Field
+   * 2026-09-06: a run stopped mid-piece left `segment-00010.mp4` holding 3.92 s
+   * of the 5.589 s its name promises, and the viewer's picture jumped 1.5 s at
+   * 1:02. The soundtrack did the same at 17.5 s, 2.8 s wide, in the same
+   * session.
+   *
+   * Distinguished by WHEN the name arrives, which is exact and needs no reading
+   * of the file: a name that arrives after the stop was ordered is the flush.
+   * A piece genuinely closed a moment before the stop can land here too, and
+   * then it is made a second time — the cheaper of the two errors, since the
+   * other one is a hole the viewer sees.
+   *
+   * @type {string | null}
+   */
+  #flushedName = null;
+
   /**
    * When this run was told to stop, so the death itself can be priced.
    *
@@ -426,6 +451,9 @@ export class EncodeRun {
       if (name.length === 0) {
         continue;
       }
+      if (this.#stopping) {
+        this.#flushedName = name;
+      }
       this.onClosed(name);
     }
   }
@@ -615,6 +643,7 @@ export class EncodeRun {
       from: this.from,
       to: this.to,
       reached: this.reached,
+      flushedName: this.#flushedName,
       livedMs,
       // How long dying took, and how long the first output took to appear.
       // Null where the run was never told to stop, or never produced anything:

package/services/encode/SegmentStore.js

@@ -350,12 +350,12 @@ export class SegmentStore {
    * @param {((raw: Buffer) => boolean) | null} [judgeUsable]
    * @returns {Promise<number | null>} The segment number removed, or null.
    */
-  async discardOpenPieceOf(key, within, judgeUsable = null) {
+  async discardOpenPieceOf(key, within, judgeUsable = null, flushedName = null) {
     const format = this.#formats.get(key);
     if (!format) {
       return null;
     }
-    const removed = await discardOpenPiece(this.directoryFor(key), format, within, judgeUsable);
+    const removed = await discardOpenPiece(this.directoryFor(key), format, within, judgeUsable, flushedName);
     if (removed !== null) {
       this.#held.delete(key);
       this.#logger?.info?.(

package/services/encode/open-piece.js

@@ -23,17 +23,37 @@ import path from "node:path";
  * numbering and convinced the look-ahead to keep the encoder stopped for having
  * "produced" it.
  *
- * Only an unusable piece goes. A run stopped between two cuts leaves a finished
- * file behind, and deleting good output would mean making it a second time.
+ * Two kinds of file are removed, and the second is the one a viewer feels.
+ *
+ * The first is unreadable — a run that died mid-write. The second READS
+ * perfectly and is SHORT: on SIGTERM ffmpeg writes out the piece it had open
+ * and names it on the ready channel like any other, so it is a valid fMP4
+ * holding film only up to the instant of the stop, under a name that promises
+ * the whole span the playlist gives that number. Field 2026-09-06:
+ * `segment-00010.mp4` held 3.92 s of its declared 5.589 s — 96 frames — and the
+ * picture jumped 1.5 s at 1:02; the soundtrack did the same at 17.5 s, 2.8 s
+ * wide, in the same session. Judging such a file by whether it decodes says
+ * yes, which is how both survived.
+ *
+ * Which file that is comes from the run itself — the last name it wrote after
+ * being told to stop — and not from reading the pieces, so there is no span to
+ * measure and no tolerance to choose.
+ *
+ * A piece that was genuinely finished a moment before the stop can be named
+ * here too, and is then made a second time. That is the cheaper error: the
+ * other one is a hole the viewer sees.
  *
  * @param {string | null | undefined} runDirPath
  * @param {{ isSegmentFileName: (name: string) => boolean, segmentIndexFromName: (name: string) => number }} segmentFormat
  * @param {((raw: Buffer) => boolean) | null} judgeUsable - Whether a non-empty
  *   piece carries what it should. Null where nothing can say, and then only an
  *   empty file is removed.
+ * @param {string | null} [flushedName] - The piece the encoder wrote out while
+ *   shutting down. Removed whether or not it reads, because reading is not the
+ *   question about it.
  * @returns {Promise<number | null>} The segment number removed, or null.
  */
-export async function discardOpenPiece(runDirPath, segmentFormat, within, judgeUsable) {
+export async function discardOpenPiece(runDirPath, segmentFormat, within, judgeUsable, flushedName = null) {
   if (!runDirPath || typeof segmentFormat?.isSegmentFileName !== "function") {
     return null;
   }
@@ -65,12 +85,16 @@ export async function discardOpenPiece(runDirPath, segmentFormat, within, judgeU
     return null;
   }
   const filePath = path.join(runDirPath, highest.name);
-  let unusable = false;
+  // The encoder named this one on its way out, so it holds film up to the stop
+  // and no further. Nothing about its contents can say that — it decodes — so
+  // nothing about its contents is asked.
+  const wasFlushedOnTheWayOut = typeof flushedName === "string" && flushedName === highest.name;
+  let unusable = wasFlushedOnTheWayOut;
   try {
     const info = await stat(filePath);
     if (info.size === 0) {
       unusable = true;
-    } else if (typeof judgeUsable === "function") {
+    } else if (!unusable && typeof judgeUsable === "function") {
       unusable = !judgeUsable(await readFile(filePath));
     }
   } catch {

package/services/orchestrators/EncodeOrchestrator.js

@@ -474,10 +474,13 @@ export class EncodeOrchestrator {
     this.#costs.note(ended);
     // Exactly one ending is normal — the run reached the end of the stretch it
     // was given and closed its last file. Every other leaves a piece open, and
-    // that file's name is indistinguishable from a finished one's.
+    // that file's name is indistinguishable from a finished one's: on SIGTERM
+    // ffmpeg writes the open piece out and names it on the ready channel like
+    // any other, so it is a valid file holding less film than its name
+    // promises. The run says which one that was.
     if (ended.ending !== ENCODE_EXIT.COMPLETE && this.segmentStore) {
       void this.segmentStore
-        .discardOpenPieceOf(ended.address, { from: ended.from, to: ended.to })
+        .discardOpenPieceOf(ended.address, { from: ended.from, to: ended.to }, null, ended.flushedName)
         .catch(() => {});
     }
     this.coverageOf(ended.address).release(ended.run);

package/test/flushed-piece.test.js

@@ -0,0 +1,108 @@
+/**
+ * @file The piece an encoder writes out on its way to being stopped.
+ *
+ * `-segment_list pipe:3` was taken as proof that a piece is whole: ffmpeg names
+ * a file when it closes it, so a named file is closed. True of the FILE and
+ * false of the SPAN. On SIGTERM ffmpeg writes out the piece it had open and
+ * names it like any other, so the result is a valid, decodable piece holding
+ * film only up to the instant of the stop — under a name whose playlist entry
+ * promises the whole span.
+ *
+ * Field 2026-09-06, one session, both tracks: `segment-00010.mp4` held 3.92 s
+ * of its declared 5.589 s (96 frames), and the picture jumped 1.5 s at 1:02;
+ * the soundtrack's own stopped run left the same shape at 17.5 s, 2.8 s wide.
+ * Judging such a file by whether it decodes answers yes, which is how both
+ * reached the viewer.
+ */
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import { mkdtemp, rm, writeFile, readdir } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { discardOpenPiece } from "../services/encode/open-piece.js";
+
+const format = {
+  isSegmentFileName: (name) => /^segment-\d{5}\.mp4$/.test(name),
+  segmentIndexFromName: (name) => Number(name.slice(8, 13))
+};
+
+/** A run directory holding pieces 0..last, every one of them readable. */
+async function runDirectory(last) {
+  const dir = await mkdtemp(path.join(os.tmpdir(), "flushed-piece-"));
+  for (let index = 0; index <= last; index += 1) {
+    await writeFile(path.join(dir, `segment-${String(index).padStart(5, "0")}.mp4`), Buffer.alloc(64, 7));
+  }
+  return dir;
+}
+
+test("the piece named on the way out goes, though it reads perfectly", async () => {
+  const dir = await runDirectory(10);
+  try {
+    const removed = await discardOpenPiece(
+      dir,
+      format,
+      { from: 0, to: 535 },
+      // Everything decodes. This is the field case exactly: the short piece is
+      // a valid fMP4 and nothing about its contents betrays it.
+      () => true,
+      "segment-00010.mp4"
+    );
+    assert.equal(removed, 10, "the flushed piece was kept because it decodes");
+    const left = await readdir(dir);
+    assert.ok(!left.includes("segment-00010.mp4"));
+    assert.ok(left.includes("segment-00009.mp4"), "a piece closed before the stop was taken too");
+  } finally {
+    await rm(dir, { recursive: true, force: true });
+  }
+});
+
+test("a run that named nothing on the way out loses no readable piece", async () => {
+  // A run that reached the end of its stretch closed its last file properly.
+  // Removing it would mean encoding it a second time for nothing.
+  const dir = await runDirectory(10);
+  try {
+    const removed = await discardOpenPiece(dir, format, { from: 0, to: 535 }, () => true, null);
+    assert.equal(removed, null);
+    assert.ok((await readdir(dir)).includes("segment-00010.mp4"));
+  } finally {
+    await rm(dir, { recursive: true, force: true });
+  }
+});
+
+test("a piece that does not read still goes, named or not", async () => {
+  const dir = await runDirectory(10);
+  try {
+    const removed = await discardOpenPiece(dir, format, { from: 0, to: 535 }, () => false, null);
+    assert.equal(removed, 10, "an unreadable last piece survived");
+  } finally {
+    await rm(dir, { recursive: true, force: true });
+  }
+});
+
+test("only inside the stretch the ended run was given", async () => {
+  // Several runs write into one directory, kept apart by their intervals. The
+  // highest file overall may belong to a run that is still going.
+  const dir = await runDirectory(20);
+  try {
+    const removed = await discardOpenPiece(
+      dir, format, { from: 0, to: 10 }, () => true, "segment-00010.mp4"
+    );
+    assert.equal(removed, 10);
+    assert.ok((await readdir(dir)).includes("segment-00020.mp4"), "another run's piece was taken");
+  } finally {
+    await rm(dir, { recursive: true, force: true });
+  }
+});
+
+test("a name from another run's stretch takes nothing", async () => {
+  const dir = await runDirectory(20);
+  try {
+    const removed = await discardOpenPiece(
+      dir, format, { from: 0, to: 10 }, () => true, "segment-00020.mp4"
+    );
+    assert.equal(removed, null, "a name outside the stretch removed a piece anyway");
+  } finally {
+    await rm(dir, { recursive: true, force: true });
+  }
+});