@torrent-tv/proxy 2.80.3 → 2.80.5

package/CHANGELOG.md

@@ -1,3 +1,13 @@
+## 2.80.5
+
+- **Fix**: A piece is kept only where the run PROVED it finished, which closes the half 2.80.4 left open. That release recognised the piece ffmpeg writes out on `SIGTERM` and named it by when it arrived on the ready channel — right for our own stop, and blind to every other way a run ends. Killed harder, or dying on its own, a run leaves the same piece half-written and with no name at all; it decodes just as well and is just as short. The question asked of the highest-numbered file in a run's stretch is no longer what it contains but whether the run named it while still running normally, so all three endings are covered by one fact the run already holds.
+
+## 2.80.4
+
+- **Fix**: The piece an encoder writes out while it is being stopped is thrown away instead of served. `-segment_list pipe:3` was taken as proof that a piece is whole — ffmpeg names a file when it closes it, so a named file is closed. That is true of the FILE and false of the SPAN: on `SIGTERM` ffmpeg writes out the piece it had open and names it like any other, so what lands on disk is a valid, decodable piece holding film only up to the instant of the stop, under a name whose playlist entry promises the whole span. Field 2026-09-06, one session, both tracks: `segment-00010.mp4` held 3.92 s of its declared 5.589 s — 96 frames — and the picture jumped 1.5 s at 1:02, while the soundtrack's own stopped run left the same shape at 17.5 s, 2.8 s wide. Both were the viewer's report of the picture and the sound jerking.
+- **Fix**: Which piece that is comes from the run itself — the last name it wrote after being told to stop — so nothing is read, no span is measured and no tolerance is chosen. The cleanup already existed and already ran on every abnormal ending; it removed the piece only when the piece did not decode, and this one decodes.
+- **Chore**: A piece genuinely finished a moment before the stop can be named here too, and is then made a second time. That is the cheaper of the two errors by the rule this project already holds: the other one is a hole the viewer sees.
+
 ## 2.80.3
 
 - **Fix**: A boundary carries the keyframe it IS, instead of being looked up by value in the container's list. A cut is kept on the player's clock — `keyframe - startTime`, rounded to six places — and the seek used to add the start time back and search the file's own keyframes for the result. That round trip is lossy: a keyframe at 26.234 s in a container starting at 0.083 s comes back as 26.233999999999998, and "the keyframe at or before that" is then the PREVIOUS one. Two parts in a quadrillion became 8.717 seconds. Where each cut is on the file's own clock is now carried by index (`output/cut-grid.js`, `Timeline.sourceTimes`) and asked for directly, so a boundary cannot fail to find itself.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@torrent-tv/proxy",
-  "version": "2.80.3",
+  "version": "2.80.5",
   "description": "Torrent proxy client that exposes webseed-like HTTP stream endpoint.",
   "license": "GPL-3.0-or-later",
   "publishConfig": {

package/services/encode/EncodeRun.js

@@ -61,6 +61,10 @@ const MICROSECONDS_PER_SECOND = 1_000_000;
  * @property {number} livedMs
  * @property {boolean} normal - Whether this ending is the expected one.
  * @property {string} lastError - The last thing ffmpeg said on stderr.
+ * @property {string | null} provenName - The last piece this run named while it
+ *   was still running normally, and therefore the last one it is known to have
+ *   finished. Anything on disk beyond it was open when the run ended, whatever
+ *   ended it. Null where the run named nothing.
  */
 
 /**
@@ -99,6 +103,29 @@ export class EncodeRun {
   /** Half a name left over from the last chunk of the encoder's own channel. */
   #closedTail = "";
 
+  /**
+   * The last piece named on the ready channel while the run was still running
+   * normally — the last one it is KNOWN to have finished.
+   *
+   * "The encoder named it" was taken to mean "it is whole". That is true of the
+   * file and false of the span. On SIGTERM ffmpeg writes out the piece it had
+   * open and names it like any other; killed harder, or dying on its own, it
+   * leaves that piece unnamed and half-written. Both are readable, and neither
+   * covers the span its number promises. Field 2026-09-06: a run stopped
+   * mid-piece left `segment-00010.mp4` holding 3.92 s of the 5.589 s the
+   * playlist gives #10, and the viewer's picture jumped 1.5 s at 1:02; the
+   * soundtrack did the same at 17.5 s, 2.8 s wide, in the same session.
+   *
+   * Recorded by WHEN the name arrives, so nothing is read and no span is
+   * measured: a name that arrives after the stop was ordered is the flush and
+   * does not count as proof. A piece genuinely closed in the moment between the
+   * last normal name and the stop is then made a second time — the cheaper of
+   * the two errors, since the other is a hole the viewer sees.
+   *
+   * @type {string | null}
+   */
+  #provenName = null;
+
   /**
    * When this run was told to stop, so the death itself can be priced.
    *
@@ -426,6 +453,9 @@ export class EncodeRun {
       if (name.length === 0) {
         continue;
       }
+      if (!this.#stopping) {
+        this.#provenName = name;
+      }
       this.onClosed(name);
     }
   }
@@ -615,6 +645,7 @@ export class EncodeRun {
       from: this.from,
       to: this.to,
       reached: this.reached,
+      provenName: this.#provenName,
       livedMs,
       // How long dying took, and how long the first output took to appear.
       // Null where the run was never told to stop, or never produced anything:

package/services/encode/SegmentStore.js

@@ -350,12 +350,12 @@ export class SegmentStore {
    * @param {((raw: Buffer) => boolean) | null} [judgeUsable]
    * @returns {Promise<number | null>} The segment number removed, or null.
    */
-  async discardOpenPieceOf(key, within, judgeUsable = null) {
+  async discardOpenPieceOf(key, within, judgeUsable = null, provenName = null) {
     const format = this.#formats.get(key);
     if (!format) {
       return null;
     }
-    const removed = await discardOpenPiece(this.directoryFor(key), format, within, judgeUsable);
+    const removed = await discardOpenPiece(this.directoryFor(key), format, within, judgeUsable, provenName);
     if (removed !== null) {
       this.#held.delete(key);
       this.#logger?.info?.(

package/services/encode/open-piece.js

@@ -23,17 +23,39 @@ import path from "node:path";
  * numbering and convinced the look-ahead to keep the encoder stopped for having
  * "produced" it.
  *
- * Only an unusable piece goes. A run stopped between two cuts leaves a finished
- * file behind, and deleting good output would mean making it a second time.
+ * **A piece is whole only if the run PROVED it, and reading it proves nothing.**
+ *
+ * The highest-numbered file in a run's stretch is the one it had open. How a
+ * run ends decides what became of that file, and all three outcomes leave it
+ * readable-looking: stopped with SIGTERM, ffmpeg writes it out and names it on
+ * the ready channel exactly as it names a finished one; killed harder, or dying
+ * on its own, it leaves the bytes it had written with no name at all. In every
+ * case the file decodes and holds film only up to the instant the run ended,
+ * under a number whose playlist entry promises a whole span. Field 2026-09-06:
+ * `segment-00010.mp4` held 3.92 s of its declared 5.589 s — 96 frames — and the
+ * picture jumped 1.5 s at 1:02; the soundtrack did the same at 17.5 s, 2.8 s
+ * wide, in the same session. Both decoded, which is how both reached the viewer.
+ *
+ * So the question asked here is not what the file contains but whether the run
+ * named it while it was still running normally. That is a fact the run holds,
+ * so there is no span to measure and no tolerance to choose.
+ *
+ * A piece finished in the moment between the last such name and the end is
+ * then made a second time. That is the cheaper error: the other is a hole the
+ * viewer sees.
  *
  * @param {string | null | undefined} runDirPath
  * @param {{ isSegmentFileName: (name: string) => boolean, segmentIndexFromName: (name: string) => number }} segmentFormat
  * @param {((raw: Buffer) => boolean) | null} judgeUsable - Whether a non-empty
  *   piece carries what it should. Null where nothing can say, and then only an
  *   empty file is removed.
+ * @param {string | null} [provenName] - The last piece the run named while it
+ *   was running normally. A file beyond it was open when the run ended and goes
+ *   whether or not it reads. Null where the run proved nothing, and then every
+ *   piece it left is unproven.
  * @returns {Promise<number | null>} The segment number removed, or null.
  */
-export async function discardOpenPiece(runDirPath, segmentFormat, within, judgeUsable) {
+export async function discardOpenPiece(runDirPath, segmentFormat, within, judgeUsable, provenName = null) {
   if (!runDirPath || typeof segmentFormat?.isSegmentFileName !== "function") {
     return null;
   }
@@ -65,12 +87,16 @@ export async function discardOpenPiece(runDirPath, segmentFormat, within, judgeU
     return null;
   }
   const filePath = path.join(runDirPath, highest.name);
-  let unusable = false;
+  // Proven finished only if the run said so while it was running. Anything
+  // beyond that name was open when the run ended, and its contents cannot say
+  // so — it decodes.
+  const proven = typeof provenName === "string" && provenName === highest.name;
+  let unusable = !proven;
   try {
     const info = await stat(filePath);
     if (info.size === 0) {
       unusable = true;
-    } else if (typeof judgeUsable === "function") {
+    } else if (!unusable && typeof judgeUsable === "function") {
       unusable = !judgeUsable(await readFile(filePath));
     }
   } catch {

package/services/orchestrators/EncodeOrchestrator.js

@@ -474,10 +474,13 @@ export class EncodeOrchestrator {
     this.#costs.note(ended);
     // Exactly one ending is normal — the run reached the end of the stretch it
     // was given and closed its last file. Every other leaves a piece open, and
-    // that file's name is indistinguishable from a finished one's.
+    // that file looks finished however the run ended: stopped, ffmpeg writes it
+    // out and names it like any other; killed harder, it leaves the bytes it
+    // had. Either way it decodes and holds less film than its number promises.
+    // So what is kept is what the run PROVED it finished, and nothing beyond.
     if (ended.ending !== ENCODE_EXIT.COMPLETE && this.segmentStore) {
       void this.segmentStore
-        .discardOpenPieceOf(ended.address, { from: ended.from, to: ended.to })
+        .discardOpenPieceOf(ended.address, { from: ended.from, to: ended.to }, null, ended.provenName)
         .catch(() => {});
     }
     this.coverageOf(ended.address).release(ended.run);

package/test/open-piece.test.js

@@ -0,0 +1,112 @@
+/**
+ * @file The piece a run had open when it ended, and what proves one whole.
+ *
+ * `-segment_list pipe:3` was taken as proof: ffmpeg names a file when it closes
+ * it, so a named file is closed. True of the FILE and false of the SPAN. The
+ * highest-numbered file in a run's stretch is the one it had open, and how the
+ * run ended decides what became of it — stopped with SIGTERM, ffmpeg writes it
+ * out and names it exactly as it names a finished one; killed harder, or dying
+ * on its own, it leaves the bytes it had written. All three outcomes decode,
+ * and all three hold film only up to the instant the run ended.
+ *
+ * Field 2026-09-06, one session, both tracks: `segment-00010.mp4` held 3.92 s
+ * of its declared 5.589 s (96 frames), and the picture jumped 1.5 s at 1:02;
+ * the soundtrack's own stopped run left the same shape at 17.5 s, 2.8 s wide.
+ * Judging such a file by whether it decodes answers yes, which is how both
+ * reached the viewer.
+ *
+ * So what is kept is what the run PROVED it finished: the last piece it named
+ * while it was still running normally.
+ */
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import { mkdtemp, rm, writeFile, readdir } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { discardOpenPiece } from "../services/encode/open-piece.js";
+
+const format = {
+  isSegmentFileName: (name) => /^segment-\d{5}\.mp4$/.test(name),
+  segmentIndexFromName: (name) => Number(name.slice(8, 13))
+};
+
+/** A run directory holding pieces 0..last, every one of them readable. */
+async function runDirectory(last) {
+  const dir = await mkdtemp(path.join(os.tmpdir(), "open-piece-"));
+  for (let index = 0; index <= last; index += 1) {
+    await writeFile(path.join(dir, `segment-${String(index).padStart(5, "0")}.mp4`), Buffer.alloc(64, 7));
+  }
+  return dir;
+}
+
+test("the piece written out on the way to being stopped goes, though it reads", async () => {
+  // The field case: ffmpeg named #10 while shutting down, so #9 is the last it
+  // proved. Everything decodes, and nothing about #10's contents betrays it.
+  const dir = await runDirectory(10);
+  try {
+    const removed = await discardOpenPiece(
+      dir, format, { from: 0, to: 535 }, () => true, "segment-00009.mp4"
+    );
+    assert.equal(removed, 10, "the open piece was kept because it decodes");
+    const left = await readdir(dir);
+    assert.ok(!left.includes("segment-00010.mp4"));
+    assert.ok(left.includes("segment-00009.mp4"), "a piece the run proved was taken too");
+  } finally {
+    await rm(dir, { recursive: true, force: true });
+  }
+});
+
+test("a piece the run never named goes too, however it was killed", async () => {
+  // Killed harder than SIGTERM, or dead on its own: the open piece is left
+  // half-written and unnamed. It still decodes, and it is still short.
+  const dir = await runDirectory(10);
+  try {
+    const removed = await discardOpenPiece(
+      dir, format, { from: 0, to: 535 }, () => true, "segment-00009.mp4"
+    );
+    assert.equal(removed, 10);
+  } finally {
+    await rm(dir, { recursive: true, force: true });
+  }
+});
+
+test("the piece the run proved finished stays", async () => {
+  // A run stopped in the moment after closing #10 and before opening #11
+  // proved #10. Removing it would mean encoding it a second time for nothing.
+  const dir = await runDirectory(10);
+  try {
+    const removed = await discardOpenPiece(
+      dir, format, { from: 0, to: 535 }, () => true, "segment-00010.mp4"
+    );
+    assert.equal(removed, null);
+    assert.ok((await readdir(dir)).includes("segment-00010.mp4"));
+  } finally {
+    await rm(dir, { recursive: true, force: true });
+  }
+});
+
+test("a run that proved nothing keeps nothing", async () => {
+  const dir = await runDirectory(3);
+  try {
+    const removed = await discardOpenPiece(dir, format, { from: 0, to: 535 }, () => true, null);
+    assert.equal(removed, 3, "a run that named nothing had its last piece believed");
+  } finally {
+    await rm(dir, { recursive: true, force: true });
+  }
+});
+
+test("only inside the stretch the ended run was given", async () => {
+  // Several runs write into one directory, kept apart by their intervals. The
+  // highest file overall may belong to a run that is still going.
+  const dir = await runDirectory(20);
+  try {
+    const removed = await discardOpenPiece(
+      dir, format, { from: 0, to: 10 }, () => true, "segment-00009.mp4"
+    );
+    assert.equal(removed, 10);
+    assert.ok((await readdir(dir)).includes("segment-00020.mp4"), "another run's piece was taken");
+  } finally {
+    await rm(dir, { recursive: true, force: true });
+  }
+});