@torrent-tv/proxy 2.82.0 → 2.83.0

package/CHANGELOG.md

@@ -1,3 +1,12 @@
+## 2.83.0
+
+- **Fix**: THE SPILLED PIECES HAD ONE RULE AND IT NEVER BOUND. The ceiling 2.81.0 gave them is a share of free space, which on the addon host is 52 292 MB against a measured growth of 14 400 MB in one viewing — so nothing was ever removed until the torrent itself went. They have the pair the segments have now: a piece behind every read head has been read and will not be read again unless somebody seeks back, and a seek back re-downloads it, which is the bargain this tier already makes whenever it drops a piece for room. Under pressure the order is the same as the segments’ — behind the earliest reader first, furthest behind first of all — instead of by which piece happened to be touched longest ago, which says nothing about what anybody is about to read.
+- **Fix**: THREE PERIODS FOR ONE UNKNOWN, AND THEY CONTRADICTED EACH OTHER. A torrent and its downloaded bytes went at fifteen minutes, a session lived to thirty, the produced segments to six hours — so between the first two there was a session with no source: a viewer returning at the twentieth minute got a session that could not make a single new segment until the torrent was added again. All three stand for the same unmeasured thing, whether the viewer comes back, so they are ONE number in one place (`services/disk/keep.js`, one hour) and the session now dies first, which is the right order and needs no rule of its own.
+- **New**: The thing those periods stand for is being measured, and the proxy is the only place it can be. A session opened on an output whose segments are still on disk IS a return, and its age is exactly what the store recorded. `returns: 14 session(s) opened on material still held, 3 on material gone; median 12min after the last read, longest 51min — kept for 60min` — said beside the disk figures. The median and the longest are the two the period has to sit between, and a week of ordinary use replaces the hour with what viewers actually do.
+- **Fix**: The benchmark of a device-backed encoder could not have run. VAAPI and QSV take their device in the arguments before the input, and what is there for a session sets up hardware DECODING — which a benchmark fed raw frames must not have. `Encoder.benchmarkInputArgs` states the device and nothing else; without it `h264_vaapi` and `h264_qsv` fail to open and the reading would have said "this host cannot encode" about a host that encodes perfectly well. Found by reviewing 2.82.0 rather than by running it.
+- **Chore**: `docs/disk-architecture.md` — the three things that write to one disk, the two rules that remove material, the order the viewers give it, and what is still not solved. 1009 checks pass, biome clean; the new eviction order was checked by breaking it on purpose.
+- **Chore**: NOT yet seen in the field. What the next session must show: a `returns:` line once material has been reopened, `disk:` with both claimants, and the spill falling behind a viewer rather than only growing.
+
 ## 2.82.0
 
 - **Fix**: THE ENCODER PING-PONGED BECAUSE NOTHING MEASURED WHAT A START COSTS. The plan compares when the wanted pieces appear under each arrangement, and for that it needs how long a fresh encoder takes to produce anything and how long killing one takes. Both were learned only from runs that had ENDED, so at a cold open both were zero — and zero does not read as “not measured”, it reads as “free”. Keeping a warming encoder then cost one piece and moving it cost `0 + 0 + one piece`: the same figure to the millisecond, so the tie fell to position and any advantage however small won. Field 2026-09-08: start at #68, a second later kill and start at #69, half a second later kill and start at #68 again, each dying having produced nothing. Over two days 153 runs were stopped that way and 68 of them made no segment at all.

package/CLAUDE.md

@@ -72,6 +72,17 @@ Linux-only host (e.g. POSIX-only signals must degrade elsewhere).
     wanted (`demand/`) against what the swarm is told (`download/`), why urgency
     is not a number given to the library, and why the speculative levels are
     withdrawn rather than lowered.
+  - `disk/` — one owner of the disk, read by everything that takes any of it.
+    `DiskSpace` reads the free space once and divides it between claimants by
+    the rule memory already uses; `wire.js` says who the claimants are (the
+    produced segments, and the pieces the memory store spills, which live on the
+    torrent thread and are told their share over its channel); `free.js` reads
+    the nearest directory that exists, because the segments' own is made at the
+    first session and removed at a clean stop.
+  - `docs/disk-architecture.md` — the three things that write to one disk, the
+    two rules that remove material (nobody needs it, or there is no room), the
+    order the viewers give that removal, why a spilled piece is a file of its
+    own, and what is still not solved.
   - `docs/encode-architecture.md` — who decides where encoders go, and the
     answer is one authority: `EncodePlan`, from what is made, what is being
     made, what is wanted and what the host can hold. Why no viewer reaches it,

package/docs/disk-architecture.md

@@ -0,0 +1,161 @@
+# Disk architecture — one owner, and what goes first when it is short
+
+Three things on this proxy write to the same disk. Until 2026-09-10 each read
+the free space as though it were the only claimant, so there were three
+ceilings, each standing for the whole disk.
+
+| what | where | what bounded it before |
+|---|---|---|
+| segments an encoder produced | `services/encode/SegmentStore.js` | a quarter of what was free, plus a 2 GB floor — both numbers chosen by hand |
+| pieces the memory store spilled | `services/piece-store/piece-disk-store.js` | **nothing at all** |
+| diagnostics kept on purpose | `/data` — core dumps, heap snapshots, packet captures | a count of files, never a size |
+
+The middle row is what it cost: one fifty-minute viewing wrote **14 400 MB** to
+the spill file (field 2026-08-31) while the store held 312-424 MB, and free
+space on the host fell by every megabyte of it. The bottom row is 2.9 GB of one
+core dump on the addon host, inside a budget of "two dumps".
+
+## One owner
+
+`services/disk/DiskSpace.js` reads the free space once and divides it. The rule
+is the one memory already uses, on the other reading:
+
+```
+allowance = free now + what we already hold - what everything that is not us has been seen to need
+```
+
+Nothing in it is a fraction chosen by hand. The reserve is measured: between two
+readings, how much free space went away beyond what our own consumers took.
+
+`services/disk/wire.js` says who the claimants are. The segments are told their
+share by a call; the spilled pieces live on the torrent thread, so the share
+travels the channel that already carries everything else and the reply says what
+they hold — one exchange, both directions.
+
+The reading is said every pass, in the series beside the memory one:
+
+```
+disk: 104584MB free; segments 0MB of 52292MB, spilled pieces 0MB of 52292MB
+```
+
+## Two rules, answering two questions
+
+They are kept apart because they were briefly proposed as one, and that was
+wrong.
+
+**Time.** Material nobody needs should not sit on the owner's disk merely
+because there is room for it. An output nobody has read for long enough goes
+whole, whatever the free space is.
+
+**Space.** Material everyone needs must still go when there is no room.
+
+A ceiling alone would keep 5 GB on a household disk for six hours because the
+disk is large. An idle rule alone would keep everything until its clock ran out,
+however tight the disk had become.
+
+## What goes first, and it is the viewers who decide
+
+For the segments, the order is the priority map's own read from the other end:
+
+1. outputs nobody is watching at all;
+2. what lies behind the earliest viewer — furthest behind first;
+3. what lies ahead of the furthest viewer — furthest ahead first.
+
+A segment a viewer is standing on is never a victim. It used to be whole outputs
+by when their directory was last read, which says nothing about what anybody is
+about to watch.
+
+## A piece is a file
+
+`DiskTier` wrote every spilled piece into ONE sparse file at
+`index * chunkLength` and answered `forget(index)` by dropping the number from a
+set. The bytes stayed: a sparse file's blocks come back only by hole punching,
+which Node exposes no binding for, so nothing this process could do returned a
+single block before the whole file was removed.
+
+`PieceDiskStore` gives each piece its own file. Removing one returns exactly its
+blocks, needs no binding this runtime lacks, and makes the unit of eviction the
+same as the unit of storage — so the order pieces leave in is the order we
+choose. Over its allowance the least recently used goes, and a piece being read
+is never the victim. A piece thrown away is answered as absent, so the torrent
+fetches it again, which is the same bargain the memory tier makes when it
+spills.
+
+The read this replaced was chosen for its cost — 22.08 ms via `readFile` against
+**7.63 ms** into a buffer we already hold, measured on the field host — and that
+is unchanged: it is still one `read` into the caller's buffer. What it adds is
+an `open` per read, tens of microseconds against those milliseconds.
+
+## A clean exit leaves nothing of ours
+
+The segments' root was removed only when it happened to be empty — from the
+first commit of this repository, never a decision. What it protected against is
+a second proxy sharing the root; what it did was leave every directory alone,
+including this process's own orphans. A directory adopted at startup, owned by
+no session, therefore survived the exit and was adopted again at the next start.
+
+That loop is what made an orphan permanent, and it is why 5.0 GB of segments
+from sessions that had ended hours before were on the addon host on 2026-09-10.
+`SegmentStore.dropAll` now removes everything this process owns, root included,
+which also gives the startup sweep its meaning back: whatever is found then is
+from a kill.
+
+Both kinds have both rules. For the spilled pieces the time rule is the same
+statement one layer down: a piece behind every read head has been read and will
+not be read again unless somebody seeks back, and a seek back re-downloads it —
+the bargain this tier already makes whenever it drops a piece for room.
+`PieceLru.readHeads` says where the readers stand, `PieceDiskStore.forgetBehind`
+acts on it, and the eviction order under pressure is the same: behind the
+earliest reader first, furthest behind first of all. With no reader at all
+nothing is removed — a store between reads is not a store nobody wants, and the
+torrent going idle is what empties it whole.
+
+## How long material nobody is using is kept
+
+One number, in one place — `services/disk/keep.js`, one hour — because
+everything it governs stands for the same unmeasured thing: whether the viewer
+comes back.
+
+It was three, and they contradicted each other:
+
+| what | was | now |
+|---|---|---|
+| a torrent and its downloaded bytes | 15 minutes | one hour |
+| a session | 30 minutes | unchanged — a session is a record, not material |
+| the segments an encoder produced | 6 hours | one hour |
+
+The torrent went at fifteen minutes while the session it feeds lived to thirty,
+so between them there was a session with no source: a viewer returning at the
+twentieth minute got a session that could not make a single new segment. With
+one hour for both kinds of material the session dies first, which is the right
+order and needs no rule of its own to enforce.
+
+Nothing derives the hour. Everything else in the decision is measured — a piece
+comes back from the swarm in ~1430 ms, a segment in its own encode time, and the
+disk has an owner that prices holding it — and only the return is unknown.
+
+**And the return is measurable here.** A session opened on an output whose
+segments are still on disk IS a return, and its age is exactly what the store
+recorded. `services/disk/returns.js` keeps them and says so beside the disk
+figures:
+
+```
+returns: 14 session(s) opened on material still held, 3 on material gone;
+         median 12min after the last read, longest 51min — kept for 60min
+```
+
+The median and the longest are the two the period has to sit between: shorter
+than the median throws away material half the returns wanted, longer than the
+longest keeps material no return has ever reached. A week of ordinary use and
+the hour is replaced by what viewers actually do — and then the two kinds can
+have different numbers, since their costs of coming back differ.
+
+## What is NOT solved
+
+**The measurement that would replace the hour has not been taken yet.** The
+counter is in place and says nothing until a week of ordinary use has produced a
+distribution.
+
+**The diagnostics are not a claimant yet.** They are bounded by a count of files
+and never by a size, and they cannot simply be thrown away when space is short: a
+dump is the only evidence of the death it records. That needs a rule of its own.

package/docs/encode-architecture.md

@@ -252,13 +252,42 @@ a fresh encoder = spawn overhead + the piece at the rate in force
 a moved one     = the kill, and then the same
 ```
 
-With nothing measured the overhead is zero and a fresh encoder owes exactly one
-piece. **That is the floor, and it is derived rather than chosen:** a piece
-cannot appear before it is encoded, and how fast this host encodes is measured
-before any viewer exists. There was an `Infinity` here for the cost of a move,
-on the reasoning that an unmeasured price must not license an irreversible act —
-an exception in a model that needs none, and this is the same statement made by
-arithmetic.
+**Both figures are measured before any viewer exists**, and until 2026-09-10
+neither was. They were learned only from runs that had ENDED, so at a cold open
+both read zero — and zero does not mean "unknown" here, it means "free".
+
+That is not a small bias, it is the whole comparison. Subtract keeping from
+moving and what is left is exactly the killing plus the time the run has already
+lived:
+
+```
+keep a warming run  = firstByteWait - elapsed
+move it             = kill + spawn overhead + one piece
+                    = kill + firstByteWait                (spawn overhead = firstByteWait - one piece)
+move - keep         = kill + elapsed
+```
+
+`elapsed` is the warm-up a move throws away — a process started, an input
+opened, the first bytes fetched, a decoder filled — and it is the term that
+makes moving cost something. Set `firstByteWait` to zero and it cancels out of
+both sides along with the kill: keeping and moving then cost the same figure to
+the millisecond, the tie falls to position, and any advantage however small wins.
+
+Field 2026-09-08, the first fifteen seconds of a session: start at #68, a second
+later kill and start at #69, half a second later kill and start at #68 again,
+each dying having produced nothing. Over two days 153 runs were stopped by the
+plan and 68 of them made no segment at all, median life 9.6 s.
+
+`services/encode/start-stop-cost.js` measures both from **one ffmpeg run at
+startup**: spawn to the first piece the encoder itself announces closed, then
+SIGTERM to exit. 0.68 s and 0.02 s on the developer's desktop. `RunCosts` starts
+from those and replaces them with readings from real runs as they arrive.
+
+There was an `Infinity` here once for the cost of a move, on the reasoning that
+an unmeasured price must not license an irreversible act. It was removed as an
+exception in a model that needs none — correctly, but what replaced it was a
+floor of zero, which licenses the act rather than forbidding it. A measurement
+is what a model like this needs, not an exception and not a floor.
 
 And a run killed before producing anything is a measurement too — a lower bound
 on the first output, and the only reading a thrash can supply, since every run in

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@torrent-tv/proxy",
-  "version": "2.82.0",
+  "version": "2.83.0",
   "description": "Torrent proxy client that exposes webseed-like HTTP stream endpoint.",
   "license": "GPL-3.0-or-later",
   "publishConfig": {

package/services/disk/keep.js

@@ -0,0 +1,48 @@
+/**
+ * @file How long material nobody is using is kept.
+ *
+ * ONE NUMBER, IN ONE PLACE, because everything it governs stands for the same
+ * unmeasured thing: whether the viewer comes back. Everything else in the
+ * decision is measured or measurable — re-downloading a piece from the swarm is
+ * ~1430 ms on the field host, re-making a segment is its own encode time, and
+ * the disk now has an owner that prices holding it. Only the return is unknown,
+ * and a period is what stands in for it.
+ *
+ * IT WAS THREE NUMBERS AND THEY CONTRADICTED EACH OTHER (read 2026-09-10):
+ *
+ *   torrent and its downloaded bytes   15 minutes
+ *   session                            30 minutes
+ *   produced segments                   6 hours
+ *
+ * The torrent therefore went at fifteen minutes while the session it feeds
+ * lived to thirty, so between them there was a session with no source: a viewer
+ * returning at the twentieth minute got a session that could not make a single
+ * new segment until the torrent was added again. That is not two answers to one
+ * question, it is a contradiction — and it is what two independent guesses about
+ * one unknown produce.
+ *
+ * With one hour for both kinds of material the session dies first, which is the
+ * right order and needs no rule of its own to enforce.
+ *
+ * WHY AN HOUR, honestly: nothing derives it. It is a stand-in, chosen to be
+ * long enough that an interruption — a phone call, a meal — does not cost the
+ * film, and short enough that a household disk is not held for a day by
+ * somebody who is not coming back. It is the OWNER'S disk, and holding
+ * gigabytes on it because there happens to be room is taking something that is
+ * not ours.
+ *
+ * WHAT REPLACES IT, and the proxy is already in a position to measure it: every
+ * session opened on an output whose segments are still on disk IS a return, and
+ * its age is known. `services/disk/returns.js` records them. A week of those and
+ * the distribution answers this directly — keep material for as long as returns
+ * actually happen — and then the two kinds can have different numbers, since
+ * their costs of coming back differ.
+ */
+
+/**
+ * How long material nobody has read is kept, in milliseconds.
+ *
+ * Read by the torrent pool for a torrent and its downloaded bytes, and by the
+ * session manager for the segments an encoder produced.
+ */
+export const IDLE_KEEP_MS = 60 * 60 * 1000;

package/services/disk/returns.js

@@ -0,0 +1,103 @@
+/**
+ * @file How long after material stops being read somebody asks for it again.
+ *
+ * The one term of "how long do we keep this" that nothing measures. Everything
+ * else in that decision is a measured quantity — re-downloading a piece from
+ * the swarm is ~1430 ms on the field host, re-making a segment is its own
+ * encode time, and the disk has an owner that prices holding it. Only the
+ * return is unknown, and `IDLE_KEEP_MS` is a guess standing in for it.
+ *
+ * IT IS MEASURABLE HERE AND NOWHERE ELSE. A session opened on an output whose
+ * segments are still on disk IS a return, and its age is known exactly: the
+ * store records when each output was last read. Nothing needs to be inferred.
+ *
+ * This changes no behaviour. It records, and says what it has seen once in a
+ * while, so that after a week of ordinary use the period can be derived from
+ * what viewers actually do instead of from what a period felt like.
+ */
+
+/** How many returns are kept. Enough to see a shape, few enough to say in a line. */
+const KEPT = 200;
+
+export class Returns {
+  /** Ages in milliseconds, newest last. @type {number[]} */
+  #ages = [];
+
+  /** Sessions opened on material this proxy no longer had. */
+  #cold = 0;
+
+  /** Sessions opened on material that was still there. */
+  #warm = 0;
+
+  /**
+   * Note a session being opened on an output.
+   *
+   * @param {object} params
+   * @param {number | null} params.lastReadAt - When that output was last read,
+   *   or null where this proxy has never held it.
+   * @param {number} params.now
+   * @returns {void}
+   */
+  note({ lastReadAt, now }) {
+    if (!Number.isFinite(lastReadAt) || lastReadAt === null || lastReadAt <= 0) {
+      this.#cold += 1;
+      return;
+    }
+    this.#warm += 1;
+    this.#ages.push(Math.max(0, now - /** @type {number} */ (lastReadAt)));
+    while (this.#ages.length > KEPT) {
+      this.#ages.shift();
+    }
+  }
+
+  /**
+   * What the returns look like, or null while there have been none.
+   *
+   * The MEDIAN and the LONGEST, because those are the two the period has to sit
+   * between: shorter than the median throws away material half the returns
+   * wanted, and longer than the longest keeps material no return has ever
+   * reached.
+   *
+   * @returns {{ warm: number, cold: number, medianMs: number, longestMs: number } | null}
+   */
+  shape() {
+    if (this.#ages.length === 0) {
+      return null;
+    }
+    const sorted = [...this.#ages].sort((left, right) => left - right);
+    const middle = Math.floor(sorted.length / 2);
+    return {
+      warm: this.#warm,
+      cold: this.#cold,
+      medianMs: sorted.length % 2 === 0 ? (sorted[middle - 1] + sorted[middle]) / 2 : sorted[middle],
+      longestMs: sorted[sorted.length - 1]
+    };
+  }
+
+  /**
+   * One line, for the log, or null while there is nothing to say.
+   *
+   * @param {number} keepMs - What is being kept for now, so the reading and the
+   *   guess it will replace stand side by side.
+   * @returns {string | null}
+   */
+  describe(keepMs) {
+    const shape = this.shape();
+    if (shape === null) {
+      return null;
+    }
+    return (
+      `returns: ${shape.warm} session(s) opened on material still held, ` +
+      `${shape.cold} on material gone; median ${minutes(shape.medianMs)} after the last read, ` +
+      `longest ${minutes(shape.longestMs)} — kept for ${minutes(keepMs)}`
+    );
+  }
+}
+
+/**
+ * @param {number} ms
+ * @returns {string}
+ */
+function minutes(ms) {
+  return `${Math.round(ms / 60000)}min`;
+}

package/services/encode/Encoder.js

@@ -82,6 +82,21 @@ export class Encoder {
     throw new Error(`${this.name} does not say how to build its video arguments.`);
   }
 
+  /**
+   * What this kind needs BEFORE the input when it is being benchmarked.
+   *
+   * Not `inputArgs`: those set up hardware DECODING, and a benchmark is fed raw
+   * frames — there is nothing to decode. What a device-backed encoder still
+   * needs is the device itself, and without it `h264_vaapi` and `h264_qsv` fail
+   * to open at all, so the benchmark would answer "this host cannot encode"
+   * about a host that encodes perfectly well.
+   *
+   * @returns {string[]}
+   */
+  benchmarkInputArgs() {
+    return [];
+  }
+
   /**
    * How to encode raw frames at one rung of this kind's speed ladder, for the
    * startup benchmark and nothing else.

package/services/encode/QsvEncoder.js

@@ -35,6 +35,11 @@ export class QsvEncoder extends Encoder {
     };
   }
 
+  /** @returns {string[]} */
+  benchmarkInputArgs() {
+    return this.device ? ["-qsv_device", this.device] : [];
+  }
+
   /** @param {string | null} rung @returns {string[]} */
   benchmarkArgs(rung = null) {
     const preset = rung ? ["-preset", rung] : [];

package/services/encode/SegmentStore.js

@@ -481,6 +481,20 @@ export class SegmentStore {
     this.#logger.info(`segment-store dropped ${directoryNameFor(key)} (${because})`);
   }
 
+  /**
+   * When this output was last asked for, or null where it has never been.
+   *
+   * The one reading that makes the keeping period measurable rather than
+   * guessed: a session opened on an output this answers for IS a return, and
+   * this is its age.
+   *
+   * @param {string} key
+   * @returns {number | null}
+   */
+  lastReadAt(key) {
+    return this.#touched.get(key) ?? null;
+  }
+
   /**
    * Throw away everything this store owns, and the root with it.
    *

package/services/encode/VaapiEncoder.js

@@ -40,6 +40,11 @@ export class VaapiEncoder extends Encoder {
 
   // No fps filter: VAAPI inherits the source rate and keeps keyframes on the
   // grid via time-based -force_key_frames, so it already honours source fps.
+  /** @returns {string[]} */
+  benchmarkInputArgs() {
+    return this.device ? ["-vaapi_device", this.device] : [];
+  }
+
   /** @param {string | null} rung @returns {string[]} */
   benchmarkArgs(rung = null) {
     // Raw frames live in this process; VAAPI encodes what is in the device, so

package/services/encode/start-stop-cost.js

@@ -70,6 +70,8 @@ export async function measureStartAndStop({
       "-nostats",
       "-loglevel",
       "error",
+      // The device, where the kind takes one.
+      ...(typeof encoder?.benchmarkInputArgs === "function" ? encoder.benchmarkInputArgs() : []),
       // A generated picture: the reading is of this host's encoder and muxer,
       // and a file would add its own reading and its own download.
       "-f",
@@ -81,8 +83,10 @@ export async function measureStartAndStop({
       // The encoder this proxy has chosen, asked for its own arguments: the
       // reading must be of the thing that will actually run, since what a start
       // costs is mostly the encoder opening.
-      ...(typeof encoder?.buildVideoArgs === "function"
-        ? encoder.buildVideoArgs({ targetWidth: 640, targetHeight: 360, segmentDurationSec, fps: 25 })
+      // The same arguments the throughput benchmark uses, for the same reason:
+      // a start is timed on the encoder itself, not on a scaler in front of it.
+      ...(typeof encoder?.benchmarkArgs === "function"
+        ? encoder.benchmarkArgs(null)
         : ["-c:v", "libx264", "-preset", "ultrafast"]),
       "-an",
       "-f",

package/services/hls-session-manager.js

@@ -94,6 +94,8 @@ import { LiveOutputs } from "./output/LiveOutputs.js";
 import { variantHeightsFor } from "./output/ladder.js";
 import { EncodeOrchestrator } from "./orchestrators/EncodeOrchestrator.js";
 import { wireDiskSpace } from "./disk/wire.js";
+import { IDLE_KEEP_MS } from "./disk/keep.js";
+import { Returns } from "./disk/returns.js";
 import { freeBytesFor } from "./disk/free.js";
 
 /**
@@ -474,7 +476,7 @@ const DEFAULT_SESSION_TTL_MS = 30 * 60 * 1000;
  * not this; this only stops something nobody has touched all day from sitting
  * there for the life of the process.
  */
-const SEGMENT_STORE_IDLE_MS = 6 * 60 * 60 * 1000;
+const SEGMENT_STORE_IDLE_MS = IDLE_KEEP_MS;
 const DEFAULT_STARTUP_WAIT_MS = 5_000;
 // Realtime budget — runtime downswitch (software encoder only). Periodically
 // check each active software-transcode session's ffmpeg `speed`; when it stays
@@ -1605,6 +1607,10 @@ export class HlsSessionManager {
       void this.cleanupExpired();
     }, CLEANUP_INTERVAL_MS);
     this.cleanupTimer.unref();
+    // How long after material stops being read somebody asks for it again — the
+    // one term of the keeping period that is guessed rather than measured, and
+    // the only place it can be measured from.
+    this.returns = new Returns();
     // One owner of the disk, and the list of what takes it lives with the owner.
     this.diskSpace = wireDiskSpace({
       segmentStore: this.segmentStore,
@@ -2257,6 +2263,10 @@ export class HlsSessionManager {
     // session was never registered, and no sweep looks for one. Proxy
     // 2.9.101-2.9.102 failed here on every single request and the leftovers
     // were the only trace of it on disk.
+    // A RETURN, if this output was held before — and its age, which is the one
+    // term of the keeping period that nothing measures. Read BEFORE the
+    // directory is claimed, since claiming it is what marks it read.
+    this.returns.note({ lastReadAt: this.segmentStore.lastReadAt(spec.toKey()), now: Date.now() });
     this.segmentStore.directoryFor(spec.toKey());
     this.segmentStore.useFormat(spec.toKey(), segmentFormat);
 
@@ -9678,6 +9688,12 @@ export class HlsSessionManager {
     // last read, and how much room the disk has for the lot.
     // The room is the disk owner's to divide; this asks what the share is now.
     await this.diskSpace.revise();
+    // What viewers actually do, beside the period that stands in for it. Said
+    // where it can be read against the disk figures rather than on its own.
+    const returns = this.returns.describe(IDLE_KEEP_MS);
+    if (returns !== null) {
+      logger.info(returns);
+    }
     this.segmentStore.enforce({
       idleMs: SEGMENT_STORE_IDLE_MS,
       maxBytes: this.diskSpace.segmentBytes(),

package/services/hwaccel.js

@@ -1434,6 +1434,10 @@ function measureEncodeSlope(ffmpegBin, encoder, rung, rawFramesPath) {
   return new Promise((resolve) => {
     const args = [
       "-hide_banner", "-loglevel", "error", "-nostats",
+      // What a device-backed encoder needs before the input — the device. Not
+      // its decoding setup: this is fed raw frames and there is nothing to
+      // decode, and `-hwaccel vaapi` over rawvideo fails to open.
+      ...(typeof encoder?.benchmarkInputArgs === "function" ? encoder.benchmarkInputArgs() : []),
       "-stream_loop", "-1",
       "-f", "rawvideo", "-pix_fmt", "yuv420p",
       "-s", `${BENCHMARK_REF_W}x${BENCHMARK_REF_H}`, "-r", String(TRANSCODE_FPS),