@torrent-tv/proxy 2.82.0 → 2.83.1

package/services/encode/SegmentStore.js

@@ -481,6 +481,20 @@ export class SegmentStore {
     this.#logger.info(`segment-store dropped ${directoryNameFor(key)} (${because})`);
   }
 
+  /**
+   * When this output was last asked for, or null where it has never been.
+   *
+   * The one reading that makes the keeping period measurable rather than
+   * guessed: a session opened on an output this answers for IS a return, and
+   * this is its age.
+   *
+   * @param {string} key
+   * @returns {number | null}
+   */
+  lastReadAt(key) {
+    return this.#touched.get(key) ?? null;
+  }
+
   /**
    * Throw away everything this store owns, and the root with it.
    *

package/services/encode/VaapiEncoder.js

@@ -40,6 +40,11 @@ export class VaapiEncoder extends Encoder {
 
   // No fps filter: VAAPI inherits the source rate and keeps keyframes on the
   // grid via time-based -force_key_frames, so it already honours source fps.
+  /** @returns {string[]} */
+  benchmarkInputArgs() {
+    return this.device ? ["-vaapi_device", this.device] : [];
+  }
+
   /** @param {string | null} rung @returns {string[]} */
   benchmarkArgs(rung = null) {
     // Raw frames live in this process; VAAPI encodes what is in the device, so

package/services/encode/encode-exit.js

@@ -73,6 +73,11 @@ export const ENCODE_EXIT = Object.freeze({
  *   session has on disk, or null when that could not be read.
  * @param {number | null} [facts.lastSegmentIndex] - Index of the file's last
  *   segment according to the published playlist, or null when unknown.
+ * @param {number | null} [facts.producedCount] - How many segments THIS run
+ *   made. Zero and "could not be read" are different facts and were both `null`
+ *   until 2026-09-11: a run that made nothing exited zero and was recorded as
+ *   having finished, which is how a segment that does not exist came to be
+ *   believed present for forty-six minutes.
  * @param {boolean} [facts.inputUnavailable] - The error names a missing input.
  * @returns {string} One of {@link ENCODE_EXIT}.
  */
@@ -81,12 +86,24 @@ export function classifyEncodeExit({
   code = null,
   producedThrough = null,
   lastSegmentIndex = null,
+  producedCount = null,
   inputUnavailable = false
 } = {}) {
   if (superseded) {
     return ENCODE_EXIT.IGNORED;
   }
   if (code === 0) {
+    // PRODUCING NOTHING IS THE CLEAREST CASE OF NOT FINISHING, and it used to be
+    // the one case that read as success: `producedThrough` is null when the run
+    // made no segment at all, null is "unknown", and unknown fell through to
+    // complete. Field 2026-09-11: a run given #541..#541 was handed a start
+    // later than its own end, wrote 190 bytes that are not a fragment, exited
+    // zero — and was recorded as having reached the end of what it was given.
+    // Nothing asked for that segment again for forty-six minutes, until the
+    // viewer arrived at it and waited 23 s for a 404.
+    if (producedCount === 0 && lastSegmentIndex !== null) {
+      return ENCODE_EXIT.SHORT;
+    }
     const stoppedShort =
       lastSegmentIndex !== null &&
       producedThrough !== null &&

package/services/encode/start-stop-cost.js

@@ -70,6 +70,8 @@ export async function measureStartAndStop({
       "-nostats",
       "-loglevel",
       "error",
+      // The device, where the kind takes one.
+      ...(typeof encoder?.benchmarkInputArgs === "function" ? encoder.benchmarkInputArgs() : []),
       // A generated picture: the reading is of this host's encoder and muxer,
       // and a file would add its own reading and its own download.
       "-f",
@@ -81,8 +83,10 @@ export async function measureStartAndStop({
       // The encoder this proxy has chosen, asked for its own arguments: the
       // reading must be of the thing that will actually run, since what a start
       // costs is mostly the encoder opening.
-      ...(typeof encoder?.buildVideoArgs === "function"
-        ? encoder.buildVideoArgs({ targetWidth: 640, targetHeight: 360, segmentDurationSec, fps: 25 })
+      // The same arguments the throughput benchmark uses, for the same reason:
+      // a start is timed on the encoder itself, not on a scaler in front of it.
+      ...(typeof encoder?.benchmarkArgs === "function"
+        ? encoder.benchmarkArgs(null)
         : ["-c:v", "libx264", "-preset", "ultrafast"]),
       "-an",
       "-f",

package/services/files/CompletedFiles.js

@@ -0,0 +1,276 @@
+/**
+ * @file Files this proxy has downloaded whole, kept as files.
+ *
+ * A torrent is a way of GETTING bytes. Once every byte of a file is here, the
+ * torrent has nothing left to do for it: the file is a file, and reading it is
+ * an ordinary read of an ordinary file — no piece store, no memory ceiling, no
+ * eviction, no revival from a spill, and nothing that can refuse a read for
+ * want of memory.
+ *
+ * WHY THIS EXISTS AT ALL, in the words it was asked for (2026-09-11): as soon
+ * as a torrent is fully downloaded, downloading stops, the torrent is deleted,
+ * and the artefacts — what was downloaded — stay for as long as they are
+ * wanted.
+ *
+ * WHERE THEY LIVE, and it is not beside the torrent's own store. Destroying a
+ * torrent with `destroyStore` removes that directory whole, which is exactly
+ * what the instruction above ends with — so a file kept inside it would be
+ * deleted by the very act it is meant to survive.
+ *
+ * WHAT IS HERE IS ADOPTED AT STARTUP, for the same reason the piece store
+ * adopts its own directory: a proxy that has restarted has these files and must
+ * not fetch them again. A file whose size does not match what the torrent says
+ * is not adopted — it was being written when the process died.
+ */
+
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+
+/**
+ * Where whole files live.
+ *
+ * Beside the torrents' own directories and not inside them: destroying a
+ * torrent with its store removes that directory whole, and these files exist to
+ * survive exactly that.
+ *
+ * @returns {string}
+ */
+export function completedFilesRoot() {
+  return path.join(os.tmpdir(), "torrent-tv-files");
+}
+
+/** How a removal is asked for; Windows needs the retries, POSIX ignores them. */
+const REMOVAL = { force: true, maxRetries: 10, retryDelay: 20 };
+
+/**
+ * One directory of whole files, keyed by the torrent they came from.
+ */
+export class CompletedFiles {
+  #root;
+
+  /** `${infoHash}/${fileIndex}` → what is held. @type {Map<string, { path: string, length: number, name: string }>} */
+  #held = new Map();
+
+  /** Assemblies in flight, so two passes cannot write one file at once. @type {Set<string>} */
+  #writing = new Set();
+
+  /**
+   * @param {object} params
+   * @param {string} params.root - Where whole files live. Outside any torrent's
+   *   own store directory, which is removed with the torrent.
+   */
+  constructor({ root }) {
+    this.#root = root;
+  }
+
+  /** Where these files live, for logging. */
+  get root() {
+    return this.#root;
+  }
+
+  /** How many whole files are held. */
+  get size() {
+    return this.#held.size;
+  }
+
+  /** What they weigh. */
+  get bytes() {
+    let total = 0;
+    for (const file of this.#held.values()) {
+      total += file.length;
+    }
+    return total;
+  }
+
+  /**
+   * @param {string} infoHash
+   * @param {number} fileIndex
+   * @returns {string}
+   */
+  #keyOf(infoHash, fileIndex) {
+    return `${String(infoHash)}/${fileIndex}`;
+  }
+
+  /**
+   * The whole file for this torrent and index, or null.
+   *
+   * @param {string} infoHash
+   * @param {number} fileIndex
+   * @returns {{ path: string, length: number, name: string } | null}
+   */
+  find(infoHash, fileIndex) {
+    return this.#held.get(this.#keyOf(infoHash, fileIndex)) ?? null;
+  }
+
+  /**
+   * Take up whole files a previous life of this proxy left here.
+   *
+   * @param {(infoHash: string, fileIndex: number) => number | null} lengthOf -
+   *   What the torrent says this file weighs, or null when it is not known. A
+   *   file of the wrong size was being written when the process died and is not
+   *   adopted.
+   * @returns {Promise<number>} How many were taken up.
+   */
+  async adopt(lengthOf) {
+    let adopted = 0;
+    let torrents = [];
+    try {
+      torrents = await fs.readdir(this.#root, { withFileTypes: true });
+    } catch {
+      return 0;
+    }
+    for (const entry of torrents) {
+      if (!entry.isDirectory()) {
+        continue;
+      }
+      const infoHash = entry.name;
+      let files = [];
+      try {
+        files = await fs.readdir(path.join(this.#root, infoHash), { withFileTypes: true });
+      } catch {
+        continue;
+      }
+      let manifest = {};
+      try {
+        manifest = JSON.parse(
+          await fs.readFile(path.join(this.#root, infoHash, "manifest.json"), "utf8")
+        );
+      } catch {
+        // No manifest, or an unreadable one: the bytes are still servable, and
+        // a file named by its number is better than a file thrown away.
+      }
+      for (const held of files) {
+        const fileIndex = Number.parseInt(held.name, 10);
+        if (!held.isFile() || !Number.isInteger(fileIndex) || fileIndex < 0) {
+          continue;
+        }
+        const where = path.join(this.#root, infoHash, held.name);
+        try {
+          const { size } = await fs.stat(where);
+          const expected = lengthOf(infoHash, fileIndex);
+          if (expected !== null && size !== expected) {
+            await fs.rm(where, REMOVAL);
+            continue;
+          }
+          this.#held.set(this.#keyOf(infoHash, fileIndex), {
+            path: where,
+            length: size,
+            name: String(manifest?.[String(fileIndex)]?.name ?? fileIndex)
+          });
+          adopted += 1;
+        } catch {
+          // Gone between the listing and the reading: not ours to worry about.
+        }
+      }
+    }
+    return adopted;
+  }
+
+  /**
+   * Write one whole file out of whatever the torrent can read it from.
+   *
+   * Written under a name nothing serves and renamed when it is closed, so a
+   * process killed halfway leaves no file that looks complete. The rename is
+   * the one moment at which the file becomes servable, which is also why
+   * nothing has to be locked against readers.
+   *
+   * @param {object} params
+   * @param {string} params.infoHash
+   * @param {number} params.fileIndex
+   * @param {number} params.length - What the torrent says the file weighs.
+   * @param {string} params.name - What the torrent calls it. Kept because the
+   *   torrent is what is about to be deleted, and a file with no name can only
+   *   be served as a number.
+   * @param {() => NodeJS.ReadableStream} params.open - The torrent's own read of
+   *   the whole file.
+   * @returns {Promise<{ path: string, length: number } | null>} Null when
+   *   another pass is already writing it, or when what was read does not weigh
+   *   what the torrent said.
+   */
+  async keep({ infoHash, fileIndex, length, name, open }) {
+    const key = this.#keyOf(infoHash, fileIndex);
+    const held = this.#held.get(key);
+    if (held) {
+      return held;
+    }
+    if (this.#writing.has(key)) {
+      return null;
+    }
+    this.#writing.add(key);
+    const directory = path.join(this.#root, String(infoHash));
+    const where = path.join(directory, String(fileIndex));
+    const partial = `${where}.partial`;
+    try {
+      await fs.mkdir(directory, { recursive: true });
+      await fs.rm(partial, REMOVAL);
+      const source = open();
+      const handle = await fs.open(partial, "w");
+      let written = 0;
+      try {
+        for await (const chunk of source) {
+          await handle.write(chunk);
+          written += chunk.length;
+        }
+      } finally {
+        await handle.close();
+      }
+      if (written !== length) {
+        // The read ended early — the data went away mid-write, which over a
+        // torrent is ordinary. What must not happen is a short file under a
+        // name that says it is whole.
+        await fs.rm(partial, REMOVAL);
+        return null;
+      }
+      await fs.rename(partial, where);
+      const file = { path: where, length, name: String(name ?? fileIndex) };
+      this.#held.set(key, file);
+      await this.#writeManifest(infoHash);
+      return file;
+    } catch {
+      await fs.rm(partial, REMOVAL).catch(() => undefined);
+      return null;
+    } finally {
+      this.#writing.delete(key);
+    }
+  }
+
+  /**
+   * Write down what each file of one torrent is called and weighs.
+   *
+   * The torrent is what is about to be deleted, and it is the only thing that
+   * knows either. A number on disk is enough to serve the bytes and not enough
+   * to say what they are.
+   *
+   * @param {string} infoHash
+   * @returns {Promise<void>}
+   */
+  async #writeManifest(infoHash) {
+    const named = {};
+    for (const [key, file] of this.#held) {
+      if (key.startsWith(`${infoHash}/`)) {
+        named[key.slice(infoHash.length + 1)] = { length: file.length, name: file.name };
+      }
+    }
+    await fs
+      .writeFile(path.join(this.#root, String(infoHash), "manifest.json"), JSON.stringify(named))
+      .catch(() => undefined);
+  }
+
+  /**
+   * Forget and remove every whole file of one torrent.
+   *
+   * @param {string} infoHash
+   * @returns {Promise<void>}
+   */
+  async forget(infoHash) {
+    for (const key of [...this.#held.keys()]) {
+      if (key.startsWith(`${infoHash}/`)) {
+        this.#held.delete(key);
+      }
+    }
+    await fs.rm(path.join(this.#root, String(infoHash)), { ...REMOVAL, recursive: true }).catch(
+      () => undefined
+    );
+  }
+}

package/services/files/piece-from-whole-file.js

@@ -0,0 +1,118 @@
+/**
+ * @file Reading one piece of a torrent out of the files it has already been
+ * assembled into.
+ *
+ * THE KEYSTONE OF KEEPING WHOLE FILES AT ALL. Without it a whole file is a
+ * second copy of bytes the piece store is also holding, and neither copy can be
+ * dropped: the store cannot drop its own because it is what every piece read
+ * goes to, and the file cannot be dropped because it is what a torrent-free read
+ * goes to. With it the store has a place to fall back to, so
+ *
+ *   1. the spilled copy of a whole file is redundant and can go — the film stops
+ *      being on the disk twice, which on the field host of 2026-09-11 was
+ *      1417 MB of segments plus 1424 MB of spilled pieces for one episode;
+ *   2. the torrent can be destroyed with its store and added again later
+ *      without fetching a byte: what it verifies, it reads from here.
+ *
+ * A piece is a byte range of the torrent, and the torrent's files are laid end
+ * to end in that same space — so a piece belongs to one file, or straddles the
+ * boundary between two. Both cases are the same walk.
+ */
+
+import fs from "node:fs/promises";
+
+/**
+ * Read one piece out of whole files, or answer null.
+ *
+ * Null when any part of the piece is in a file this proxy does not hold whole:
+ * a piece half read is worse than a piece not read, because the layer above
+ * would hash it and mark the piece bad.
+ *
+ * @param {object} params
+ * @param {number} params.index - The piece.
+ * @param {number} params.pieceLength - Every piece but the last is this long.
+ * @param {number} params.length - What the whole torrent weighs.
+ * @param {Array<{ offset: number, length: number }>} params.files - The
+ *   torrent's files in order, as it lays them out.
+ * @param {(fileIndex: number) => { path: string, length: number } | null} params.wholeFileAt
+ * @returns {Promise<Buffer | null>}
+ */
+export async function pieceFromWholeFiles({ index, pieceLength, length, files, wholeFileAt }) {
+  if (!Array.isArray(files) || files.length === 0 || !(pieceLength > 0)) {
+    return null;
+  }
+  const pieceStart = index * pieceLength;
+  const pieceEnd = Math.min(pieceStart + pieceLength, length) - 1;
+  if (pieceStart > pieceEnd) {
+    return null;
+  }
+  const piece = Buffer.allocUnsafe(pieceEnd - pieceStart + 1);
+  let filled = 0;
+  for (const [fileIndex, file] of files.entries()) {
+    const fileStart = Number(file?.offset ?? 0);
+    const fileEnd = fileStart + Number(file?.length ?? 0) - 1;
+    const from = Math.max(pieceStart, fileStart);
+    const to = Math.min(pieceEnd, fileEnd);
+    if (from > to) {
+      continue;
+    }
+    const whole = wholeFileAt(fileIndex);
+    if (!whole) {
+      // Part of this piece is in a file this proxy does not hold whole.
+      return null;
+    }
+    let handle = null;
+    try {
+      handle = await fs.open(whole.path, "r");
+      const { bytesRead } = await handle.read(piece, from - pieceStart, to - from + 1, from - fileStart);
+      if (bytesRead !== to - from + 1) {
+        return null;
+      }
+      filled += bytesRead;
+    } catch {
+      return null;
+    } finally {
+      await handle?.close().catch(() => undefined);
+    }
+  }
+  return filled === piece.length ? piece : null;
+}
+
+/**
+ * Whether every byte of one piece is in files this proxy holds whole.
+ *
+ * Asked before dropping a spilled copy, and answered without reading anything.
+ *
+ * @param {object} params
+ * @param {number} params.index
+ * @param {number} params.pieceLength
+ * @param {number} params.length
+ * @param {Array<{ offset: number, length: number }>} params.files
+ * @param {(fileIndex: number) => { path: string, length: number } | null} params.wholeFileAt
+ * @returns {boolean}
+ */
+export function pieceIsInWholeFiles({ index, pieceLength, length, files, wholeFileAt }) {
+  if (!Array.isArray(files) || files.length === 0 || !(pieceLength > 0)) {
+    return false;
+  }
+  const pieceStart = index * pieceLength;
+  const pieceEnd = Math.min(pieceStart + pieceLength, length) - 1;
+  if (pieceStart > pieceEnd) {
+    return false;
+  }
+  let covered = 0;
+  for (const [fileIndex, file] of files.entries()) {
+    const fileStart = Number(file?.offset ?? 0);
+    const fileEnd = fileStart + Number(file?.length ?? 0) - 1;
+    const from = Math.max(pieceStart, fileStart);
+    const to = Math.min(pieceEnd, fileEnd);
+    if (from > to) {
+      continue;
+    }
+    if (!wholeFileAt(fileIndex)) {
+      return false;
+    }
+    covered += to - from + 1;
+  }
+  return covered === pieceEnd - pieceStart + 1;
+}

package/services/hls-session-manager.js

@@ -94,6 +94,8 @@ import { LiveOutputs } from "./output/LiveOutputs.js";
 import { variantHeightsFor } from "./output/ladder.js";
 import { EncodeOrchestrator } from "./orchestrators/EncodeOrchestrator.js";
 import { wireDiskSpace } from "./disk/wire.js";
+import { IDLE_KEEP_MS } from "./disk/keep.js";
+import { Returns } from "./disk/returns.js";
 import { freeBytesFor } from "./disk/free.js";
 
 /**
@@ -474,7 +476,7 @@ const DEFAULT_SESSION_TTL_MS = 30 * 60 * 1000;
  * not this; this only stops something nobody has touched all day from sitting
  * there for the life of the process.
  */
-const SEGMENT_STORE_IDLE_MS = 6 * 60 * 60 * 1000;
+const SEGMENT_STORE_IDLE_MS = IDLE_KEEP_MS;
 const DEFAULT_STARTUP_WAIT_MS = 5_000;
 // Realtime budget — runtime downswitch (software encoder only). Periodically
 // check each active software-transcode session's ffmpeg `speed`; when it stays
@@ -1605,6 +1607,10 @@ export class HlsSessionManager {
       void this.cleanupExpired();
     }, CLEANUP_INTERVAL_MS);
     this.cleanupTimer.unref();
+    // How long after material stops being read somebody asks for it again — the
+    // one term of the keeping period that is guessed rather than measured, and
+    // the only place it can be measured from.
+    this.returns = new Returns();
     // One owner of the disk, and the list of what takes it lives with the owner.
     this.diskSpace = wireDiskSpace({
       segmentStore: this.segmentStore,
@@ -2257,6 +2263,10 @@ export class HlsSessionManager {
     // session was never registered, and no sweep looks for one. Proxy
     // 2.9.101-2.9.102 failed here on every single request and the leftovers
     // were the only trace of it on disk.
+    // A RETURN, if this output was held before — and its age, which is the one
+    // term of the keeping period that nothing measures. Read BEFORE the
+    // directory is claimed, since claiming it is what marks it read.
+    this.returns.note({ lastReadAt: this.segmentStore.lastReadAt(spec.toKey()), now: Date.now() });
     this.segmentStore.directoryFor(spec.toKey());
     this.segmentStore.useFormat(spec.toKey(), segmentFormat);
 
@@ -9678,6 +9688,12 @@ export class HlsSessionManager {
     // last read, and how much room the disk has for the lot.
     // The room is the disk owner's to divide; this asks what the share is now.
     await this.diskSpace.revise();
+    // What viewers actually do, beside the period that stands in for it. Said
+    // where it can be read against the disk figures rather than on its own.
+    const returns = this.returns.describe(IDLE_KEEP_MS);
+    if (returns !== null) {
+      logger.info(returns);
+    }
     this.segmentStore.enforce({
       idleMs: SEGMENT_STORE_IDLE_MS,
       maxBytes: this.diskSpace.segmentBytes(),

package/services/hwaccel.js

@@ -1434,6 +1434,10 @@ function measureEncodeSlope(ffmpegBin, encoder, rung, rawFramesPath) {
   return new Promise((resolve) => {
     const args = [
       "-hide_banner", "-loglevel", "error", "-nostats",
+      // What a device-backed encoder needs before the input — the device. Not
+      // its decoding setup: this is fed raw frames and there is nothing to
+      // decode, and `-hwaccel vaapi` over rawvideo fails to open.
+      ...(typeof encoder?.benchmarkInputArgs === "function" ? encoder.benchmarkInputArgs() : []),
       "-stream_loop", "-1",
       "-f", "rawvideo", "-pix_fmt", "yuv420p",
       "-s", `${BENCHMARK_REF_W}x${BENCHMARK_REF_H}`, "-r", String(TRANSCODE_FPS),

package/services/output/cut-grid.js

@@ -60,8 +60,8 @@ export function computeCutGrid({ useKeyframeGrid, durationSeconds, segDur, keyfr
   const base = Number.isFinite(startTime) ? startTime : 0;
   const uniform = () => {
     const boundaries = [];
-    for (let t = 0; t < total - 0.001; t += step) {
-      boundaries.push(Number(t.toFixed(6)));
+    for (let cutAt = 0; cutAt < total - 0.001; cutAt += step) {
+      boundaries.push(Number(cutAt.toFixed(6)));
     }
     boundaries.push(total);
     // One clock: nothing here is a keyframe of the source, so nothing is owed
@@ -74,7 +74,17 @@ export function computeCutGrid({ useKeyframeGrid, durationSeconds, segDur, keyfr
   const kept = keyframeTimes
     .filter((time) => Number.isFinite(time))
     .map((time) => ({ source: time, published: time - base }))
-    .filter((cut) => cut.published >= -0.001 && cut.published < total - 0.05)
+    // THE END IS MEASURED THE SAME WAY AS EVERY OTHER CUT. A keyframe nearer to
+    // the end than one segment leaves a tail too short to be a segment, and the
+    // rule below — no cut closer than a step to the one before it — never looks
+    // at the end at all. It used to be guarded by fifty milliseconds, a number
+    // from nowhere: field 2026-09-11, a keyframe 160 ms before the end of a
+    // 54-minute film passed it and left segment #541 lasting 0.16 s. The sound
+    // has no data in such a tail, so its run made 541 segments where the picture
+    // made 542, was marked short, and the repair that followed was handed a
+    // start later than its own end — 190 bytes that are not a fragment, and a
+    // viewer held 23 s at the last minute of the film for a 404.
+    .filter((cut) => cut.published >= -0.001 && cut.published < total - step)
     .sort((left, right) => left.published - right.published);
   // The first cut is the start of the file, whatever the container's own clock
   // says that is; the last is its end. Neither is a keyframe, and a run never