@torrent-tv/proxy 2.80.4 → 2.80.5

package/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 2.80.5
+
+- **Fix**: A piece is kept only where the run PROVED it finished, which closes the half 2.80.4 left open. That release recognised the piece ffmpeg writes out on `SIGTERM` and named it by when it arrived on the ready channel — right for our own stop, and blind to every other way a run ends. Killed harder, or dying on its own, a run leaves the same piece half-written and with no name at all; it decodes just as well and is just as short. The question asked of the highest-numbered file in a run's stretch is no longer what it contains but whether the run named it while still running normally, so all three endings are covered by one fact the run already holds.
+
 ## 2.80.4
 
 - **Fix**: The piece an encoder writes out while it is being stopped is thrown away instead of served. `-segment_list pipe:3` was taken as proof that a piece is whole — ffmpeg names a file when it closes it, so a named file is closed. That is true of the FILE and false of the SPAN: on `SIGTERM` ffmpeg writes out the piece it had open and names it like any other, so what lands on disk is a valid, decodable piece holding film only up to the instant of the stop, under a name whose playlist entry promises the whole span. Field 2026-09-06, one session, both tracks: `segment-00010.mp4` held 3.92 s of its declared 5.589 s — 96 frames — and the picture jumped 1.5 s at 1:02, while the soundtrack's own stopped run left the same shape at 17.5 s, 2.8 s wide. Both were the viewer's report of the picture and the sound jerking.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@torrent-tv/proxy",
-  "version": "2.80.4",
+  "version": "2.80.5",
   "description": "Torrent proxy client that exposes webseed-like HTTP stream endpoint.",
   "license": "GPL-3.0-or-later",
   "publishConfig": {

package/services/encode/EncodeRun.js

@@ -61,11 +61,10 @@ const MICROSECONDS_PER_SECOND = 1_000_000;
  * @property {number} livedMs
  * @property {boolean} normal - Whether this ending is the expected one.
  * @property {string} lastError - The last thing ffmpeg said on stderr.
- * @property {string | null} flushedName - The piece the encoder wrote out while
- *   it was shutting down, if it wrote one. It is closed and it is SHORT: it
- *   holds film only up to the instant the run was stopped, while its name
- *   promises the whole span the playlist gives that number. Null where the run
- *   was never told to stop.
+ * @property {string | null} provenName - The last piece this run named while it
+ *   was still running normally, and therefore the last one it is known to have
+ *   finished. Anything on disk beyond it was open when the run ended, whatever
+ *   ended it. Null where the run named nothing.
  */
 
 /**
@@ -105,24 +104,27 @@ export class EncodeRun {
   #closedTail = "";
 
   /**
-   * The last piece named on the ready channel AFTER the run was told to stop.
+   * The last piece named on the ready channel while the run was still running
+   * normally — the last one it is KNOWN to have finished.
    *
-   * On SIGTERM ffmpeg writes out the piece it had open and names it like any
-   * other, so "the encoder closed it" stops meaning "it is whole". Field
-   * 2026-09-06: a run stopped mid-piece left `segment-00010.mp4` holding 3.92 s
-   * of the 5.589 s its name promises, and the viewer's picture jumped 1.5 s at
-   * 1:02. The soundtrack did the same at 17.5 s, 2.8 s wide, in the same
-   * session.
+   * "The encoder named it" was taken to mean "it is whole". That is true of the
+   * file and false of the span. On SIGTERM ffmpeg writes out the piece it had
+   * open and names it like any other; killed harder, or dying on its own, it
+   * leaves that piece unnamed and half-written. Both are readable, and neither
+   * covers the span its number promises. Field 2026-09-06: a run stopped
+   * mid-piece left `segment-00010.mp4` holding 3.92 s of the 5.589 s the
+   * playlist gives #10, and the viewer's picture jumped 1.5 s at 1:02; the
+   * soundtrack did the same at 17.5 s, 2.8 s wide, in the same session.
    *
-   * Distinguished by WHEN the name arrives, which is exact and needs no reading
-   * of the file: a name that arrives after the stop was ordered is the flush.
-   * A piece genuinely closed a moment before the stop can land here too, and
-   * then it is made a second time — the cheaper of the two errors, since the
-   * other one is a hole the viewer sees.
+   * Recorded by WHEN the name arrives, so nothing is read and no span is
+   * measured: a name that arrives after the stop was ordered is the flush and
+   * does not count as proof. A piece genuinely closed in the moment between the
+   * last normal name and the stop is then made a second time — the cheaper of
+   * the two errors, since the other is a hole the viewer sees.
    *
    * @type {string | null}
    */
-  #flushedName = null;
+  #provenName = null;
 
   /**
    * When this run was told to stop, so the death itself can be priced.
@@ -451,8 +453,8 @@ export class EncodeRun {
       if (name.length === 0) {
         continue;
       }
-      if (this.#stopping) {
-        this.#flushedName = name;
+      if (!this.#stopping) {
+        this.#provenName = name;
       }
       this.onClosed(name);
     }
@@ -643,7 +645,7 @@ export class EncodeRun {
       from: this.from,
       to: this.to,
       reached: this.reached,
-      flushedName: this.#flushedName,
+      provenName: this.#provenName,
       livedMs,
       // How long dying took, and how long the first output took to appear.
       // Null where the run was never told to stop, or never produced anything:

package/services/encode/SegmentStore.js

@@ -350,12 +350,12 @@ export class SegmentStore {
    * @param {((raw: Buffer) => boolean) | null} [judgeUsable]
    * @returns {Promise<number | null>} The segment number removed, or null.
    */
-  async discardOpenPieceOf(key, within, judgeUsable = null, flushedName = null) {
+  async discardOpenPieceOf(key, within, judgeUsable = null, provenName = null) {
     const format = this.#formats.get(key);
     if (!format) {
       return null;
     }
-    const removed = await discardOpenPiece(this.directoryFor(key), format, within, judgeUsable, flushedName);
+    const removed = await discardOpenPiece(this.directoryFor(key), format, within, judgeUsable, provenName);
     if (removed !== null) {
       this.#held.delete(key);
       this.#logger?.info?.(

package/services/encode/open-piece.js

@@ -23,37 +23,39 @@ import path from "node:path";
  * numbering and convinced the look-ahead to keep the encoder stopped for having
  * "produced" it.
  *
- * Two kinds of file are removed, and the second is the one a viewer feels.
+ * **A piece is whole only if the run PROVED it, and reading it proves nothing.**
  *
- * The first is unreadable — a run that died mid-write. The second READS
- * perfectly and is SHORT: on SIGTERM ffmpeg writes out the piece it had open
- * and names it on the ready channel like any other, so it is a valid fMP4
- * holding film only up to the instant of the stop, under a name that promises
- * the whole span the playlist gives that number. Field 2026-09-06:
+ * The highest-numbered file in a run's stretch is the one it had open. How a
+ * run ends decides what became of that file, and all three outcomes leave it
+ * readable-looking: stopped with SIGTERM, ffmpeg writes it out and names it on
+ * the ready channel exactly as it names a finished one; killed harder, or dying
+ * on its own, it leaves the bytes it had written with no name at all. In every
+ * case the file decodes and holds film only up to the instant the run ended,
+ * under a number whose playlist entry promises a whole span. Field 2026-09-06:
  * `segment-00010.mp4` held 3.92 s of its declared 5.589 s — 96 frames — and the
  * picture jumped 1.5 s at 1:02; the soundtrack did the same at 17.5 s, 2.8 s
- * wide, in the same session. Judging such a file by whether it decodes says
- * yes, which is how both survived.
+ * wide, in the same session. Both decoded, which is how both reached the viewer.
  *
- * Which file that is comes from the run itself — the last name it wrote after
- * being told to stop — and not from reading the pieces, so there is no span to
- * measure and no tolerance to choose.
+ * So the question asked here is not what the file contains but whether the run
+ * named it while it was still running normally. That is a fact the run holds,
+ * so there is no span to measure and no tolerance to choose.
  *
- * A piece that was genuinely finished a moment before the stop can be named
- * here too, and is then made a second time. That is the cheaper error: the
- * other one is a hole the viewer sees.
+ * A piece finished in the moment between the last such name and the end is
+ * then made a second time. That is the cheaper error: the other is a hole the
+ * viewer sees.
  *
  * @param {string | null | undefined} runDirPath
  * @param {{ isSegmentFileName: (name: string) => boolean, segmentIndexFromName: (name: string) => number }} segmentFormat
  * @param {((raw: Buffer) => boolean) | null} judgeUsable - Whether a non-empty
  *   piece carries what it should. Null where nothing can say, and then only an
  *   empty file is removed.
- * @param {string | null} [flushedName] - The piece the encoder wrote out while
- *   shutting down. Removed whether or not it reads, because reading is not the
- *   question about it.
+ * @param {string | null} [provenName] - The last piece the run named while it
+ *   was running normally. A file beyond it was open when the run ended and goes
+ *   whether or not it reads. Null where the run proved nothing, and then every
+ *   piece it left is unproven.
  * @returns {Promise<number | null>} The segment number removed, or null.
  */
-export async function discardOpenPiece(runDirPath, segmentFormat, within, judgeUsable, flushedName = null) {
+export async function discardOpenPiece(runDirPath, segmentFormat, within, judgeUsable, provenName = null) {
   if (!runDirPath || typeof segmentFormat?.isSegmentFileName !== "function") {
     return null;
   }
@@ -85,11 +87,11 @@ export async function discardOpenPiece(runDirPath, segmentFormat, within, judgeU
     return null;
   }
   const filePath = path.join(runDirPath, highest.name);
-  // The encoder named this one on its way out, so it holds film up to the stop
-  // and no further. Nothing about its contents can say that — it decodes — so
-  // nothing about its contents is asked.
-  const wasFlushedOnTheWayOut = typeof flushedName === "string" && flushedName === highest.name;
-  let unusable = wasFlushedOnTheWayOut;
+  // Proven finished only if the run said so while it was running. Anything
+  // beyond that name was open when the run ended, and its contents cannot say
+  // so — it decodes.
+  const proven = typeof provenName === "string" && provenName === highest.name;
+  let unusable = !proven;
   try {
     const info = await stat(filePath);
     if (info.size === 0) {

package/services/orchestrators/EncodeOrchestrator.js

@@ -474,13 +474,13 @@ export class EncodeOrchestrator {
     this.#costs.note(ended);
     // Exactly one ending is normal — the run reached the end of the stretch it
     // was given and closed its last file. Every other leaves a piece open, and
-    // that file's name is indistinguishable from a finished one's: on SIGTERM
-    // ffmpeg writes the open piece out and names it on the ready channel like
-    // any other, so it is a valid file holding less film than its name
-    // promises. The run says which one that was.
+    // that file looks finished however the run ended: stopped, ffmpeg writes it
+    // out and names it like any other; killed harder, it leaves the bytes it
+    // had. Either way it decodes and holds less film than its number promises.
+    // So what is kept is what the run PROVED it finished, and nothing beyond.
     if (ended.ending !== ENCODE_EXIT.COMPLETE && this.segmentStore) {
       void this.segmentStore
-        .discardOpenPieceOf(ended.address, { from: ended.from, to: ended.to }, null, ended.flushedName)
+        .discardOpenPieceOf(ended.address, { from: ended.from, to: ended.to }, null, ended.provenName)
         .catch(() => {});
     }
     this.coverageOf(ended.address).release(ended.run);

package/test/{flushed-piece.test.js → open-piece.test.js}

@@ -1,18 +1,22 @@
 /**
- * @file The piece an encoder writes out on its way to being stopped.
+ * @file The piece a run had open when it ended, and what proves one whole.
  *
- * `-segment_list pipe:3` was taken as proof that a piece is whole: ffmpeg names
- * a file when it closes it, so a named file is closed. True of the FILE and
- * false of the SPAN. On SIGTERM ffmpeg writes out the piece it had open and
- * names it like any other, so the result is a valid, decodable piece holding
- * film only up to the instant of the stop — under a name whose playlist entry
- * promises the whole span.
+ * `-segment_list pipe:3` was taken as proof: ffmpeg names a file when it closes
+ * it, so a named file is closed. True of the FILE and false of the SPAN. The
+ * highest-numbered file in a run's stretch is the one it had open, and how the
+ * run ended decides what became of it — stopped with SIGTERM, ffmpeg writes it
+ * out and names it exactly as it names a finished one; killed harder, or dying
+ * on its own, it leaves the bytes it had written. All three outcomes decode,
+ * and all three hold film only up to the instant the run ended.
  *
  * Field 2026-09-06, one session, both tracks: `segment-00010.mp4` held 3.92 s
  * of its declared 5.589 s (96 frames), and the picture jumped 1.5 s at 1:02;
  * the soundtrack's own stopped run left the same shape at 17.5 s, 2.8 s wide.
  * Judging such a file by whether it decodes answers yes, which is how both
  * reached the viewer.
+ *
+ * So what is kept is what the run PROVED it finished: the last piece it named
+ * while it was still running normally.
  */
 
 import test from "node:test";
@@ -29,79 +33,79 @@ const format = {
 
 /** A run directory holding pieces 0..last, every one of them readable. */
 async function runDirectory(last) {
-  const dir = await mkdtemp(path.join(os.tmpdir(), "flushed-piece-"));
+  const dir = await mkdtemp(path.join(os.tmpdir(), "open-piece-"));
   for (let index = 0; index <= last; index += 1) {
     await writeFile(path.join(dir, `segment-${String(index).padStart(5, "0")}.mp4`), Buffer.alloc(64, 7));
   }
   return dir;
 }
 
-test("the piece named on the way out goes, though it reads perfectly", async () => {
+test("the piece written out on the way to being stopped goes, though it reads", async () => {
+  // The field case: ffmpeg named #10 while shutting down, so #9 is the last it
+  // proved. Everything decodes, and nothing about #10's contents betrays it.
   const dir = await runDirectory(10);
   try {
     const removed = await discardOpenPiece(
-      dir,
-      format,
-      { from: 0, to: 535 },
-      // Everything decodes. This is the field case exactly: the short piece is
-      // a valid fMP4 and nothing about its contents betrays it.
-      () => true,
-      "segment-00010.mp4"
+      dir, format, { from: 0, to: 535 }, () => true, "segment-00009.mp4"
     );
-    assert.equal(removed, 10, "the flushed piece was kept because it decodes");
+    assert.equal(removed, 10, "the open piece was kept because it decodes");
     const left = await readdir(dir);
     assert.ok(!left.includes("segment-00010.mp4"));
-    assert.ok(left.includes("segment-00009.mp4"), "a piece closed before the stop was taken too");
+    assert.ok(left.includes("segment-00009.mp4"), "a piece the run proved was taken too");
   } finally {
     await rm(dir, { recursive: true, force: true });
   }
 });
 
-test("a run that named nothing on the way out loses no readable piece", async () => {
-  // A run that reached the end of its stretch closed its last file properly.
-  // Removing it would mean encoding it a second time for nothing.
+test("a piece the run never named goes too, however it was killed", async () => {
+  // Killed harder than SIGTERM, or dead on its own: the open piece is left
+  // half-written and unnamed. It still decodes, and it is still short.
   const dir = await runDirectory(10);
   try {
-    const removed = await discardOpenPiece(dir, format, { from: 0, to: 535 }, () => true, null);
-    assert.equal(removed, null);
-    assert.ok((await readdir(dir)).includes("segment-00010.mp4"));
+    const removed = await discardOpenPiece(
+      dir, format, { from: 0, to: 535 }, () => true, "segment-00009.mp4"
+    );
+    assert.equal(removed, 10);
   } finally {
     await rm(dir, { recursive: true, force: true });
   }
 });
 
-test("a piece that does not read still goes, named or not", async () => {
+test("the piece the run proved finished stays", async () => {
+  // A run stopped in the moment after closing #10 and before opening #11
+  // proved #10. Removing it would mean encoding it a second time for nothing.
   const dir = await runDirectory(10);
   try {
-    const removed = await discardOpenPiece(dir, format, { from: 0, to: 535 }, () => false, null);
-    assert.equal(removed, 10, "an unreadable last piece survived");
+    const removed = await discardOpenPiece(
+      dir, format, { from: 0, to: 535 }, () => true, "segment-00010.mp4"
+    );
+    assert.equal(removed, null);
+    assert.ok((await readdir(dir)).includes("segment-00010.mp4"));
   } finally {
     await rm(dir, { recursive: true, force: true });
   }
 });
 
-test("only inside the stretch the ended run was given", async () => {
-  // Several runs write into one directory, kept apart by their intervals. The
-  // highest file overall may belong to a run that is still going.
-  const dir = await runDirectory(20);
+test("a run that proved nothing keeps nothing", async () => {
+  const dir = await runDirectory(3);
   try {
-    const removed = await discardOpenPiece(
-      dir, format, { from: 0, to: 10 }, () => true, "segment-00010.mp4"
-    );
-    assert.equal(removed, 10);
-    assert.ok((await readdir(dir)).includes("segment-00020.mp4"), "another run's piece was taken");
+    const removed = await discardOpenPiece(dir, format, { from: 0, to: 535 }, () => true, null);
+    assert.equal(removed, 3, "a run that named nothing had its last piece believed");
   } finally {
     await rm(dir, { recursive: true, force: true });
   }
 });
 
-test("a name from another run's stretch takes nothing", async () => {
+test("only inside the stretch the ended run was given", async () => {
+  // Several runs write into one directory, kept apart by their intervals. The
+  // highest file overall may belong to a run that is still going.
   const dir = await runDirectory(20);
   try {
     const removed = await discardOpenPiece(
-      dir, format, { from: 0, to: 10 }, () => true, "segment-00020.mp4"
+      dir, format, { from: 0, to: 10 }, () => true, "segment-00009.mp4"
     );
-    assert.equal(removed, null, "a name outside the stretch removed a piece anyway");
+    assert.equal(removed, 10);
+    assert.ok((await readdir(dir)).includes("segment-00020.mp4"), "another run's piece was taken");
   } finally {
     await rm(dir, { recursive: true, force: true });
   }