@torrent-tv/proxy 2.83.3 → 2.83.5

package/services/orchestrators/EncodeOrchestrator.js

@@ -33,6 +33,20 @@ import { contentionPenalty } from "../encode/contention.js";
 import { waits } from "../priority/WaitLedger.js";
 import { SegmentDemand } from "../encode/SegmentDemand.js";
 
+/**
+ * How long nothing is placed on an output whose input has just gone, and the
+ * ceiling that doubling reaches.
+ *
+ * Both are chosen, and are named here as chosen rather than dressed as
+ * measurements: what they bound is not how long the data takes to come back —
+ * that is the swarm's business and nobody here can know it — but how often it
+ * is worth asking. They replace the same two figures, with the same values,
+ * that lived in the session manager and governed only the dead run's own retry
+ * while the plan placed fresh runs beside it every half second.
+ */
+const INPUT_QUIET_BASE_MS = 2_000;
+const INPUT_QUIET_MAX_MS = 15_000;
+
 export class EncodeOrchestrator {
   /** Output address to what has been made of it. @type {Map<string, CoverageMap>} */
   #coverage = new Map();
@@ -47,6 +61,20 @@ export class EncodeOrchestrator {
   /** How runs have ended, by cause. @type {Map<string, number>} */
   #endings = new Map();
 
+  /**
+   * How many times in a row an output's run has died because its input was not
+   * there. Cleared by any other ending, which is the input answering.
+   *
+   * @type {Map<string, number>}
+   */
+  #inputLostAttempts = new Map();
+
+  /** Output address to the time before which nothing is placed on it. @type {Map<string, number>} */
+  #quietUntil = new Map();
+
+  /** The wake-up per output, so a quiet output is reconsidered. @type {Map<string, NodeJS.Timeout>} */
+  #quietTimers = new Map();
+
   /** The last state said out loud, so an unchanged state is not repeated. */
   #lastDescribed = "";
 
@@ -97,6 +125,7 @@ export class EncodeOrchestrator {
     refetchSecPerFilmSecond = () => 0,
     startingSpeedFor = () => 0,
     segmentStore = null,
+    planSoon = null,
     logger,
     now
   }) {
@@ -124,6 +153,9 @@ export class EncodeOrchestrator {
     this.segmentSeconds = segmentSeconds;
     this.logger = logger;
     this.now = typeof now === "function" ? now : Date.now;
+    // Asked for, not commanded: this class decides, and something else owns the
+    // loop that calls it. Absent in a test, where the clock is the test's own.
+    this.planSoon = typeof planSoon === "function" ? planSoon : () => undefined;
   }
 
   /**
@@ -366,6 +398,20 @@ export class EncodeOrchestrator {
         });
       }
     }
+    // ITS INPUT WAS NOT THERE A MOMENT AGO, so nothing is placed yet. The sweep
+    // above still runs — a claim left by a dead run must be released whatever
+    // the reason — and only the placing waits. This is the one thing that makes
+    // the delay bind: it used to be timed against the dead run, which the plan
+    // does not consult, so a fresh run went to the same place as fast as ffmpeg
+    // could fail there.
+    //
+    // AND ONLY WHILE NOTHING IS PRODUCING THERE. A run still alive on this
+    // output is proof the input can be read, whatever a run beside it met, so
+    // the wait must not silence an output that is working.
+    const quietMs = this.#quietFor(address);
+    if (quietMs > 0 && this.runsOn(address).every((run) => !run.isAlive)) {
+      return;
+    }
     // ONE MAP, NOT ONE WINDOW PER VIEWER PER ZONE.
     //
     // Two viewers a few seconds apart state stretches that overlap, and the plan
@@ -696,6 +742,93 @@ export class EncodeOrchestrator {
       this.#runs.set(ended.address, remaining);
     }
     this.#endings.set(ended.ending, (this.#endings.get(ended.ending) ?? 0) + 1);
+    this.#noteInputAvailability(ended);
+  }
+
+  /**
+   * Remember, per output, that its input was not there — and until when nothing
+   * is to be placed on it.
+   *
+   * **Why the plan has to hold this.** A run whose input has gone is not alive,
+   * so the plan sees the stretch it held as free and places another run there at
+   * once — and the next one dies the same way, because nothing about the state
+   * has changed. There WAS a delay for exactly this, doubling from 2 s to 15 s,
+   * and it governed only the dead run's own retry while the plan went on placing
+   * fresh ones beside it. The comment beside that timer predicted this in as
+   * many words and the code did not prevent it. Field 2026-09-12: 2432 ffmpeg
+   * starts in 23 minutes, one every 0.57 s, for 61 minutes, against a delay that
+   * had long since reached its 15 s cap.
+   *
+   * So the delay lives where the decision is taken. It is not a cure for the
+   * input being away — that is the store's claim being withdrawn and the piece
+   * being fetched again — it is what stops one absent input from costing a
+   * thousand processes and a quarter of a million log lines while it is away.
+   *
+   * @param {{ address: string, ending: string }} ended
+   * @returns {void}
+   */
+  #noteInputAvailability(ended) {
+    if (ended.ending !== ENCODE_EXIT.INPUT_LOST) {
+      // CLEARED ONLY BY PROOF THAT THE INPUT WAS THERE, which is a segment
+      // having come out of it. Any other ending was nearly the rule here and is
+      // wrong: at the moment of failure several runs end at once, and one of
+      // them ending `gone` or `stopped` without producing a thing says nothing
+      // about the input — it would have lifted the wait the one beside it had
+      // just set, which is the storm again with an extra step.
+      const produced =
+        ended.firstOutputMs !== null && ended.firstOutputMs !== undefined
+          ? true
+          : Number.isFinite(ended.reached) && Number.isFinite(ended.from) && ended.reached >= ended.from;
+      if (produced) {
+        this.#inputLostAttempts.delete(ended.address);
+        this.#quietUntil.delete(ended.address);
+      }
+      return;
+    }
+    const attempts = (this.#inputLostAttempts.get(ended.address) ?? 0) + 1;
+    this.#inputLostAttempts.set(ended.address, attempts);
+    const delayMs = Math.min(
+      INPUT_QUIET_MAX_MS,
+      INPUT_QUIET_BASE_MS * 2 ** Math.min(attempts - 1, 6)
+    );
+    this.#quietUntil.set(ended.address, this.now() + delayMs);
+    this.logger.info(
+      `encode-plan on ${ended.address}: its input was not there (attempt ${attempts}) — ` +
+      `placing nothing for ${Math.round(delayMs / 1000)}s`
+    );
+    // THE WAKE-UP, because a plan that refuses to act needs something to ask it
+    // again: nothing about the state changes while the data is away, so no event
+    // would arrive to reconsider it.
+    const timer = setTimeout(() => {
+      this.#quietTimers.delete(ended.address);
+      this.planSoon();
+    }, delayMs);
+    timer.unref?.();
+    const previous = this.#quietTimers.get(ended.address);
+    if (previous) {
+      clearTimeout(previous);
+    }
+    this.#quietTimers.set(ended.address, timer);
+  }
+
+  /**
+   * How long this output still has to wait before anything is placed on it, in
+   * milliseconds; zero when it may be planned now.
+   *
+   * @param {string} address
+   * @returns {number}
+   */
+  #quietFor(address) {
+    const until = this.#quietUntil.get(address);
+    if (!Number.isFinite(until)) {
+      return 0;
+    }
+    const left = until - this.now();
+    if (left <= 0) {
+      this.#quietUntil.delete(address);
+      return 0;
+    }
+    return left;
   }
 
   /**

package/services/piece-store/piece-disk-store.js

@@ -83,6 +83,17 @@ export class PieceDiskStore {
   /** Where the live readers stand, from whoever holds that fact. @type {() => number[]} */
   #readHeads;
 
+  /**
+   * Said whenever this tier stops holding a piece, whatever the reason.
+   *
+   * It states THIS tier's own fact and nothing more — not whether the bytes can
+   * still be had elsewhere, which this class has no way of knowing. Whoever
+   * listens decides what the loss means.
+   *
+   * @type {(index: number) => void}
+   */
+  #onForgotten;
+
   /**
    * @param {object} params
    * @param {string} params.directory - Where this torrent's pieces live.
@@ -95,12 +106,21 @@ export class PieceDiskStore {
    *   means nobody has said yet, and nothing is evicted until somebody does.
    * @param {() => number} [params.now]
    */
-  constructor({ directory, name, chunkLength, allowanceBytes = null, now = Date.now, readHeads = () => [] }) {
+  constructor({
+    directory,
+    name,
+    chunkLength,
+    allowanceBytes = null,
+    now = Date.now,
+    readHeads = () => [],
+    onForgotten = () => undefined
+  }) {
     this.#directory = path.join(directory, name);
     this.#chunkLength = chunkLength;
     this.#allowanceBytes = Number.isFinite(allowanceBytes) && allowanceBytes >= 0 ? allowanceBytes : null;
     this.#now = now;
     this.#readHeads = typeof readHeads === "function" ? readHeads : () => [];
+    this.#onForgotten = typeof onForgotten === "function" ? onForgotten : () => undefined;
     this.#adoptWhatIsAlreadyHere();
   }
 
@@ -345,6 +365,9 @@ export class PieceDiskStore {
         }
       });
     this.#removing.set(index, removal);
+    // SAID AFTER THE FACT IS TRUE, so a listener that asks this tier whether it
+    // holds the piece is told the same thing this method has just made so.
+    this.#onForgotten(index);
   }
 
   /**

package/services/piece-store/shared-piece-store.js

@@ -321,6 +321,11 @@ export class SharedPieceStore {
     admittedWithoutSlot: 0,
     evictedOnRevise: 0,
     spillFailures: 0,
+    // Claims withdrawn: pieces this store stopped being able to produce at all,
+    // and said so. It is the figure that says whether the bargain the eviction
+    // states — "a seek back re-downloads it" — is being honoured, and before
+    // 2026-09-12 it was not honoured once, because nothing was ever said.
+    withdrawn: 0,
     // Whether the store is doing its job or being asked to hold more than it
     // has room for. An eviction that had to take a piece a reader declared it
     // wants is the second, and it comes back from disk moments later
@@ -413,6 +418,31 @@ export class SharedPieceStore {
    */
   #isElsewhere = null;
 
+  /**
+   * Said when this store can no longer produce a piece AT ALL — not resident,
+   * not on disk, and not inside a file held whole.
+   *
+   * **Why it has to exist.** This store holds the bytes, so it owns the fact
+   * "this proxy has piece N". Something else kept a second copy of that fact —
+   * the torrent's own completion bitfield — and nothing reconciled them: the
+   * disk tier drops a piece behind every read head, correctly, and the bitfield
+   * goes on saying the piece is verified. A read then concludes the piece is
+   * had, asks for it, is told it is absent, and fails; and it is never
+   * re-downloaded either, because the library does not fetch what it believes
+   * it already owns. Field 2026-09-12: a film played 80 seconds, the encoder
+   * ran on to 725 s, `forgetBehind` dropped some 565 spilled pieces including
+   * piece 0, the encoder restarted and re-opened its input at byte 0, and
+   * `/stream` answered `0 of 2363497962 bytes: Piece 0 is verified but absent
+   * from the store` for 92 minutes while the browser retried one segment.
+   *
+   * So the bitfield becomes a projection of this fact, maintained by this
+   * announcement. This store does not know what a torrent is, who listens, or
+   * what they do about it — the same shape as `readPieceElsewhere` above.
+   *
+   * @type {((what: object) => void) | null}
+   */
+  #onPieceGone = null;
+
   /** Whether the last revision had to exceed the machine's share. */
   #beyondTheMachine = false;
   /**
@@ -477,6 +507,9 @@ export class SharedPieceStore {
     this.#isElsewhere = typeof options.isPieceElsewhere === "function"
       ? options.isPieceElsewhere
       : null;
+    this.#onPieceGone = typeof options.onPieceGone === "function"
+      ? options.onPieceGone
+      : null;
     // Plain data the layer above needs to answer those two, and which this
     // store is handed anyway: where each file of the torrent begins and how
     // long the whole of it is.
@@ -496,7 +529,12 @@ export class SharedPieceStore {
       allowanceBytes: null,
       // Where the live readers stand, so what goes first is decided by them and
       // not by which piece happened to be touched longest ago.
-      readHeads: () => this.#lru.readHeads()
+      readHeads: () => this.#lru.readHeads(),
+      // EVERY WAY A PIECE LEAVES THE DISK COMES THROUGH HERE — behind the read
+      // heads, over the allowance, dropped as a duplicate, or forgotten while a
+      // spill finished. One listener instead of a list of call sites to
+      // remember, which is what let the announcement be missed at three of them.
+      onForgotten: (index) => this.#announceGoneIfNowhere(index)
     });
     liveStores.add(this);
   }
@@ -1131,6 +1169,38 @@ export class SharedPieceStore {
       : null;
   }
 
+  /**
+   * Say a piece has gone, but only once it has gone from everywhere.
+   *
+   * The disk tier announces its own loss, which is not the same statement: a
+   * piece dropped as a duplicate of a file held whole has not been lost at all,
+   * and one still resident is about to be spilled again rather than gone. Only
+   * the third case — neither tier, no whole file — is a withdrawal of the claim
+   * that this proxy has those bytes.
+   *
+   * Nothing is said while the store is closing: the torrent it belongs to is
+   * being torn down, and a claim withdrawn against a dying torrent reaches
+   * either a destroyed object or, worse, one that has already been added back.
+   *
+   * @param {number} index
+   * @returns {void}
+   */
+  #announceGoneIfNowhere(index) {
+    if (this.#closed || this.#onPieceGone === null) {
+      return;
+    }
+    if (this.#buffers.has(index) || this.#disk.has(index) || this.isInWholeFiles(index)) {
+      return;
+    }
+    this.#counters.withdrawn += 1;
+    try {
+      this.#onPieceGone({ index, files: this.#files, name: this.#name });
+    } catch {
+      // silent-ok: whoever listens is diagnosing or bookkeeping, and a listener
+      // that throws must not be what fails an eviction the store needs to make.
+    }
+  }
+
   /**
    * Whether a spilled piece is now a duplicate of bytes held elsewhere.
    *

package/services/playback-planner.js

@@ -10,7 +10,7 @@ import { spawn } from "node:child_process";
 import { logger } from "../utils/logger.js";
 import { Container } from "./container/Container.js";
 import { buildAudioInventory } from "./audio-inventory.js";
-import { countVideoFiles, matchSidecarFiles } from "./torrent/files.js";
+import { contentsOf } from "./torrent/Contents.js";
 import {
   parseFfmpegDurationSeconds,
   parseFfmpegStartTimeSeconds,
@@ -339,22 +339,18 @@ export function createPlaybackPlanner({
   /**
    * The files beside this picture that belong to it, in three groups.
    *
-   * One call site's worth of arguments, spelled once: the file list, the
-   * torrent's own name (which WebTorrent prefixes to every path) and how many
-   * pictures the torrent holds, which is what decides whether a sidecar with a
-   * name in common with nothing can still belong to the only video there is.
+   * Asked of what the torrent says about itself, which works the grouping out
+   * once and keeps it. It used to be worked out here on every call, and again
+   * on the warm-up's own path over the same list, so one opened film paired the
+   * same files several times and neither side could be sure of the other's
+   * answer.
    *
    * @param {object} torrent
    * @param {number} fileIndex
    * @returns {{ audio: object[], subtitles: object[], images: object[] }}
    */
   function sidecarsOf(torrent, fileIndex) {
-    return matchSidecarFiles({
-      files: torrent?.files ?? [],
-      videoIndex: fileIndex,
-      torrentName: typeof torrent?.name === "string" ? torrent.name : "",
-      videoCount: countVideoFiles(torrent?.files ?? [])
-    });
+    return contentsOf(torrent ?? {}).sidecarsOf(fileIndex);
   }
 
   async function withContainerDefaults(torrent, fileIndex, subtitleTracks) {
@@ -630,7 +626,10 @@ export function createPlaybackPlanner({
       // codecs. A transient empty probe must NOT be cached: otherwise the wrong
       // plan (file treated as directly playable) sticks permanently for this
       // file, and an unsupported codec like xvid gets copied → black video.
-      await torrentPool.prefetchFileEdges(torrent, fileIndex);
+      // Awaited in the literal sense: this answer cannot be given until the
+      // file has said what is in it, and a person is watching a loading screen
+      // for as long as that takes.
+      await torrentPool.prefetchFileEdges(torrent, fileIndex, { awaited: true });
       edgesReadyMs = Date.now() - planEntryMs;
       // The keyframe index reads the tail of the file, which the probe has just
       // waited for as well. Started here it overlaps the probe instead of
@@ -653,7 +652,7 @@ export function createPlaybackPlanner({
       ) {
         attempt += 1;
         await delay(Math.min(3_000, 500 + attempt * 250));
-        await torrentPool.prefetchFileEdges(torrent, fileIndex);
+        await torrentPool.prefetchFileEdges(torrent, fileIndex, { awaited: true });
         probe = await probeStreamCodecs({ ffmpegBin, inputUrl: directUrl, userAgent });
       }
       const { audioCodec, videoCodec, container, durationSeconds, videoWidth, videoHeight, audioTracks, subtitleTracks } = probe;

package/services/priority/PriorityOrchestrator.js

@@ -22,7 +22,13 @@ export class PriorityOrchestrator {
   /** Where the map goes once it is built. @type {(published: object) => void} */
   #publish;
 
-  /** The last map published per film and file, so an unchanged one is not resent. */
+  /**
+   * The last map published per film and file, so an unchanged one is not
+   * resent — and what it was about, so that a file everybody has left can be
+   * published as wanting nothing.
+   *
+   * @type {Map<string, { shape: string, sourceKey: string, fileIndex: number, durationSeconds: number }>}
+   */
   #last = new Map();
 
   /** The last map BUILT per film and file, for whoever reads instead of being
@@ -138,13 +144,33 @@ export class PriorityOrchestrator {
     // second by second, which is the same comparison over far fewer values.
     const zones = runsOf(map);
     const shape = JSON.stringify(zones);
-    if (this.#last.get(key) !== shape) {
-      this.#last.set(key, shape);
+    if (this.#last.get(key)?.shape !== shape) {
+      // The length is remembered with the shape, so that a file whose viewers
+      // have all gone can still be spoken for: what is published then is the
+      // same statement with nothing in it, and it has to name the file it is
+      // about.
+      this.#last.set(key, { shape, sourceKey, fileIndex, durationSeconds });
       this.#publish({ sourceKey, fileIndex, durationSeconds, zones });
     }
     return map;
   }
 
+  /**
+   * NOBODY WANTS ANYTHING OF THIS FILE ANY MORE — said, rather than left to be
+   * inferred from silence.
+   *
+   * The map used to be deleted from this class's memory and published nowhere,
+   * so what had been stated about that file on the swarm's behalf stood until
+   * the torrent itself was removed. Read from the register, a film nobody had
+   * watched for an hour was indistinguishable from one being watched now.
+   *
+   * @param {{ sourceKey: string, fileIndex: number, durationSeconds: number }} what
+   * @returns {void}
+   */
+  #publishNothingFor({ sourceKey, fileIndex, durationSeconds }) {
+    this.#publish({ sourceKey, fileIndex, durationSeconds, zones: [] });
+  }
+
   /**
    * Build and publish the map for every file anybody is watching.
    *
@@ -222,8 +248,12 @@ export class PriorityOrchestrator {
     // for it and called from nowhere.
     for (const key of [...this.#maps.keys()]) {
       if (!byFile.has(key)) {
+        const last = this.#last.get(key);
         this.#maps.delete(key);
         this.#last.delete(key);
+        if (last) {
+          this.#publishNothingFor(last);
+        }
       }
     }
     for (const address of [...this.#byOutput.keys()]) {
@@ -232,9 +262,13 @@ export class PriorityOrchestrator {
       }
     }
     for (const one of byFile.values()) {
-      // A file of unknown length cannot be divided into zones, and a file
-      // nobody is watching has nothing to be urgent about.
-      if (one.durationSeconds > 0 && one.viewers.length > 0) {
+      // A file of unknown length cannot be divided into zones at all. A file
+      // whose viewers have all gone CAN be spoken for, and must be: `build`
+      // with nobody watching produces a map with nothing in it, which is the
+      // truth and is what withdraws what was stated for them. Skipped, as it
+      // was, the last thing said about that file stood for as long as the
+      // torrent did.
+      if (one.durationSeconds > 0) {
         this.build(one);
       }
     }