@torrent-tv/proxy 2.86.0 → 2.87.1

package/test/encode-orchestrator.test.js

@@ -14,7 +14,7 @@ import { EventEmitter } from "node:events";
 import { EncodeRun } from "../services/encode/EncodeRun.js";
 import { ENCODE_EXIT } from "../services/encode/encode-exit.js";
 import { SoftwareEncoder } from "../services/encode/SoftwareEncoder.js";
-import { EncodeOrchestrator } from "../services/orchestrators/EncodeOrchestrator.js";
+import { EncodeOrchestrator } from "../services/encode/EncodeOrchestrator.js";
 import { penaltiesFrom } from "../services/encode/contention.js";
 
 // WHAT A SECOND ENCODER COSTS THE FIRST — measured, never a formula.
@@ -155,6 +155,44 @@ function orchestrator({ maxRuns = 2 } = {}) {
   return { made, lines, processes, buildRun };
 }
 
+test("how many encoders are running is answered by the one thing that makes them", () => {
+  // ONE FACT, ONE OWNER. The session manager answered this twice by walking its
+  // own registry — once per SESSION and once per RUN — and the two agreed only
+  // while a session held at most one run. It has held several since the plan was
+  // allowed to place them, and what a second encoder costs the first was
+  // measured between ffmpeg PROCESSES, so the per-session count was the wrong
+  // one of the two exactly where they differed.
+  const { made, buildRun, processes } = orchestrator();
+  assert.equal(made.runningCount(), 0, "nothing is running before anything is made");
+
+  const first = buildRun({ from: 0, to: 99 });
+  const second = buildRun({ from: 100, to: 199 });
+  made.adopt(PICTURE, first);
+  made.adopt(PICTURE, second);
+  assert.equal(made.runningCount(), 2, "two processes on one output are two encoders, not one");
+
+  // And a run that has ended is forgotten as it ends, not at the next pass.
+  processes.get(first).emit("exit", 0, null);
+  assert.equal(made.runningCount(), 1);
+
+  // A SUSPENDED run is stopped where it stands and is using nothing, so a cost
+  // measured beside it is a cost measured alone.
+  //
+  // Stated as a run-shaped value rather than by suspending a real one: `pause`
+  // sends SIGSTOP by pid, which this platform does not have — so a check that
+  // went through it would pass or fail by the machine it ran on, and this
+  // project would rather have no check than one of those.
+  made.adopt(PICTURE, { id: "parked", from: 300, to: 399, head: 300, speedX: 1, isAlive: true, isSuspended: true, stop() {} });
+  assert.equal(made.runningCount(), 1, "a parked encoder is not one that is running");
+
+  // Nor is one on its way out. A run told to stop is still here — its exit
+  // arrives a turn or two later — and counting it makes whoever is deciding
+  // whether to start an encoder decide not to, on the strength of a process
+  // that is leaving.
+  made.adopt(PICTURE, { id: "leaving", from: 400, to: 499, head: 400, speedX: 1, isAlive: false, isSuspended: false, stop() {} });
+  assert.equal(made.runningCount(), 1);
+});
+
 test("a viewer waiting gets an encoder at what they are waiting for", () => {
   const { made } = orchestrator();
   wants(made, [{ from: 100, to: 130 }]);

package/test/encode-plan-viewers.test.js

@@ -29,8 +29,8 @@ import assert from "node:assert/strict";
 import { EventEmitter } from "node:events";
 import { EncodeRun } from "../services/encode/EncodeRun.js";
 import { SoftwareEncoder } from "../services/encode/SoftwareEncoder.js";
-import { EncodeOrchestrator } from "../services/orchestrators/EncodeOrchestrator.js";
-import { mapForViewer, mergeMaps, runsOf } from "../services/priority/PriorityMap.js";
+import { EncodeOrchestrator } from "../services/encode/EncodeOrchestrator.js";
+import { mapForViewer, mergeMaps, runsOf } from "../services/viewer/PriorityMap.js";
 import { penaltiesFrom } from "../services/encode/contention.js";
 
 // WHAT A SECOND ENCODER COSTS THE FIRST — measured, never a formula.

package/test/encode-run.test.js

@@ -41,7 +41,7 @@ function makeRun(span = {}) {
   const ends = [];
   const process_ = new FakeProcess();
   const run = new EncodeRun({
-    address: "torrent:abc:fmt=fmp4:grid=kf@0:video-only:v=0/enc:854x480:auto",
+    address: "torrent:abc:fmt=fmp4:grid=kf@0:video-only:v=0/enc/libx264/854x480@24/veryfast/none/vbv=-",
     encoder: new SoftwareEncoder(),
     from: span.from ?? 10,
     to: span.to ?? 14,
@@ -135,7 +135,7 @@ test("an ending reports the stretch, how far it got and how long it lived", () =
   assert.equal(ended.to, 14);
   assert.equal(ended.reached, 10);
   assert.equal(ended.livedMs, 0, "the clock is injected, so this is exact");
-  assert.equal(ended.address.includes("enc:854x480"), true);
+  assert.equal(ended.address.includes("854x480"), true);
 });
 
 test("a process that could not be started ends like any other failure", () => {

package/test/encode-slope.test.js

@@ -10,7 +10,7 @@
 import assert from "node:assert/strict";
 import test from "node:test";
 
-import { slopeOf } from "../services/hwaccel.js";
+import { slopeOf } from "../services/encode/hwaccel.js";
 
 const at = (wallSec, outSec) => ({ wallSec, outSec });
 

package/test/encoded-output.test.js

@@ -0,0 +1,39 @@
+/**
+ * @file An output holds what is born with it, and not what is produced.
+ *
+ * Decided with the user 2026-09-16: which pieces are made is the segment
+ * store's, and which encoders run is the encoding orchestrator's. A second
+ * holder of either is how the stale second owner stopped playback outright.
+ */
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import { EncodedOutput } from "../services/encode/output/EncodedOutput.js";
+import { outputSpec } from "./helpers/output-spec.js";
+
+function made() {
+  return new EncodedOutput({
+    id: "aaaaaaaabbbbcccc",
+    spec: outputSpec({ transcodeVideo: true, width: 1280, height: 720 }),
+    file: { key: "source-1:0" },
+    keyframes: null,
+    timeline: null,
+    segmentFormat: null,
+    output: null,
+    useSyntheticPlaylist: true,
+    playlistText: "#EXTM3U\n",
+    variantHeight: 720
+  });
+}
+
+test("its address is its format, read from the spec and kept nowhere else", () => {
+  const output = made();
+  assert.equal(output.outputKey, output.spec.toKey());
+});
+
+test("it keeps no statement of what has been produced or what is running", () => {
+  const output = made();
+  for (const field of ["runs", "runState", "progress", "produced", "ready", "state", "lastError", "failedStartCount"]) {
+    assert.equal(field in output, false, `${field} belongs to the store or the encoding orchestrator`);
+  }
+});

package/test/encoder-readings.test.js

@@ -12,7 +12,7 @@
 import assert from "node:assert/strict";
 import test from "node:test";
 
-import { speedFromReadings } from "../services/encoder-readings.js";
+import { speedFromReadings } from "../services/encode/encoder-readings.js";
 
 const at = (seconds, processedSeconds) => ({ takenAt: seconds * 1000, processedSeconds });
 

package/test/every-claimant-is-told-its-share.test.js

@@ -0,0 +1,152 @@
+/**
+ * @file Everything that holds bytes is told how many it may hold.
+ *
+ * Measured 2026-09-14, by reading every file outside the storage layer that
+ * touches the filesystem: three claimants had no share at all, and one held a
+ * ceiling over bytes it did not own.
+ *
+ * - whole files: NO BOUND OF ANY KIND. A 2.8 GB film kept whole on a host whose
+ *   disk is often a 32 GB card;
+ * - diagnostics: bounded by a COUNT and never by a size. Two core dumps and
+ *   five heap snapshots came to 3.2 GB on the addon host, and one wedge was
+ *   captured thirteen times in six hours;
+ * - the torrent pool's "disk cap" of 10 GB: a sum over WebTorrent's downloaded
+ *   bitfield, so a piece held purely in MEMORY told against a ceiling called
+ *   disk, while the bytes it meant to bound belong to the spill and to the
+ *   whole files, which have owners of their own. It owned nothing and is gone.
+ */
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { CompletedFiles } from "../services/storage/files/CompletedFiles.js";
+import { Diagnostics } from "../services/storage/Diagnostics.js";
+
+const KILOBYTE = 1024;
+
+/**
+ * @param {number} length
+ * @returns {() => AsyncGenerator<Buffer>}
+ */
+function bytesOf(length) {
+  return async function* source() {
+    yield Buffer.alloc(length, 7);
+  };
+}
+
+/**
+ * @returns {Promise<{ files: CompletedFiles, root: string }>}
+ */
+async function filesInATempRoot() {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), "whole-files-"));
+  return { files: new CompletedFiles({ root }), root };
+}
+
+test("a whole file is kept only while there is room for it", async () => {
+  const { files, root } = await filesInATempRoot();
+  try {
+    files.allow(4 * KILOBYTE);
+    const kept = await files.keep({
+      infoHash: "a".repeat(40), fileIndex: 0, length: 3 * KILOBYTE, name: "one.mkv", open: bytesOf(3 * KILOBYTE)
+    });
+    assert.ok(kept, "it fits, so it is kept");
+
+    const refused = await files.keep({
+      infoHash: "b".repeat(40), fileIndex: 0, length: 3 * KILOBYTE, name: "two.mkv", open: bytesOf(3 * KILOBYTE)
+    });
+    assert.equal(refused, null, "it does not fit, so it is not assembled at all");
+    assert.equal(files.size, 1, "and nothing already held was taken to make room during a write");
+  } finally {
+    await fs.rm(root, { recursive: true, force: true, maxRetries: 10, retryDelay: 20 });
+  }
+});
+
+test("over its share, the whole file nobody has read for longest goes", async () => {
+  const { files, root } = await filesInATempRoot();
+  try {
+    files.allow(Number.MAX_SAFE_INTEGER);
+    for (const [index, hash] of [["0", "a"], ["1", "b"], ["2", "c"]]) {
+      await files.keep({
+        infoHash: hash.repeat(40), fileIndex: Number(index), length: KILOBYTE, name: `${index}.mkv`, open: bytesOf(KILOBYTE)
+      });
+    }
+    // The first two are asked for; the third is not, so it is the one nobody
+    // wants. Losing it is not losing data — the torrent can fetch it again, and
+    // until it does the read falls back to the pieces.
+    files.find("a".repeat(40), 0);
+    files.find("b".repeat(40), 1);
+
+    const after = await files.allow(2 * KILOBYTE);
+
+    assert.equal(after.removed, 1);
+    assert.ok(files.find("a".repeat(40), 0), "a file just read was taken");
+    assert.ok(files.find("b".repeat(40), 1), "a file just read was taken");
+    assert.equal(files.find("c".repeat(40), 2), null, "the longest-unread should have gone");
+  } finally {
+    await fs.rm(root, { recursive: true, force: true, maxRetries: 10, retryDelay: 20 });
+  }
+});
+
+test("told nothing, whole files keep what they have — a share is not assumed", async () => {
+  const { files, root } = await filesInATempRoot();
+  try {
+    const kept = await files.keep({
+      infoHash: "a".repeat(40), fileIndex: 0, length: KILOBYTE, name: "one.mkv", open: bytesOf(KILOBYTE)
+    });
+    assert.ok(kept, "before the owner has divided anything there is nothing to refuse against");
+  } finally {
+    await fs.rm(root, { recursive: true, force: true, maxRetries: 10, retryDelay: 20 });
+  }
+});
+
+test("over its share the evidence stops being collected, and nothing recorded is deleted", async () => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), "diagnostics-"));
+  try {
+    await fs.writeFile(path.join(root, "core.MainThread.1.2"), Buffer.alloc(4 * KILOBYTE));
+    await fs.writeFile(path.join(root, "heap-x-1-2.heapsnapshot"), Buffer.alloc(2 * KILOBYTE));
+    // Not evidence: the proxy's own state lives in the same directory.
+    await fs.writeFile(path.join(root, "host-timings.json"), Buffer.alloc(KILOBYTE));
+
+    const said = [];
+    const diagnostics = new Diagnostics({
+      logger: { info: () => {}, warn: (line) => said.push(line) },
+      kinds: [
+        { name: "core dumps", directory: () => root, matches: (name) => name.startsWith("core.") },
+        { name: "heap snapshots", directory: () => root, matches: (name) => name.endsWith(".heapsnapshot") }
+      ]
+    });
+
+    assert.equal(await diagnostics.measure(), 6 * KILOBYTE, "the proxy's own state is not evidence");
+    assert.equal(
+      diagnostics.wanted(),
+      10 * KILOBYTE,
+      "what it holds plus one more of the largest kind seen — measured, not a fraction"
+    );
+
+    diagnostics.allow(7 * KILOBYTE);
+    assert.equal(diagnostics.mayKeep({ what: "a heap snapshot", bytes: KILOBYTE }), true, "there is room for a small one");
+    assert.equal(diagnostics.mayKeep({ what: "a heap snapshot", bytes: 4 * KILOBYTE }), false, "there is not for a large one");
+
+    assert.equal(said.length, 1, "a refusal is a line, never a silence");
+    assert.match(said[0], /was NOT kept/);
+    const left = (await fs.readdir(root)).sort();
+    assert.deepEqual(
+      left,
+      ["core.MainThread.1.2", "heap-x-1-2.heapsnapshot", "host-timings.json"],
+      "nothing already recorded may be removed to make room for more"
+    );
+  } finally {
+    await fs.rm(root, { recursive: true, force: true, maxRetries: 10, retryDelay: 20 });
+  }
+});
+
+test("before the owner has divided anything, the evidence is not refused", async () => {
+  const diagnostics = new Diagnostics({ kinds: [], logger: { info: () => {}, warn: () => {} } });
+  assert.equal(
+    diagnostics.mayKeep({ what: "a core dump", bytes: Number.MAX_SAFE_INTEGER }),
+    true,
+    "null is what a claimant that has not been told looks like, and it does not license growth by itself"
+  );
+});

package/test/failed-encoder-still-serves-what-exists.test.js

@@ -0,0 +1,354 @@
+/**
+ * @file A failed encoder explains what is MISSING, and takes nothing away.
+ *
+ * Whether production failed used to be asked at the door, before the request
+ * had even been looked at, so an output whose encoding ended in an error
+ * answered 500 to every request — including requests for segments it had
+ * already finished and which were lying on disk under their served names. The
+ * viewer lost what was made as well as what was not, and a seek back into the
+ * finished stretch could not be served either.
+ *
+ * A piece under its served name is whole by construction, whoever wrote it and
+ * whatever has become of the encoder since. The failure belongs where a file is
+ * absent: there it is the truthful answer, and holding the request instead only
+ * spends the viewer's patience.
+ */
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import { rm, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { wireOutputs } from "../services/server/wire-outputs.js";
+import { SourceFile } from "../services/media/SourceFile.js";
+import { Timeline } from "../services/encode/output/Timeline.js";
+import { Output } from "../services/encode/output/Output.js";
+import { KeyframeTable } from "../services/media/container/KeyframeTable.js";
+import { ENCODE_RUN_STATE } from "../services/encode/encode-run-state.js";
+import { fmp4Format } from "../services/encode/segment-formats/fmp4.js";
+import { EncodeRun } from "../services/encode/EncodeRun.js";
+import { fakeProcess, silentLogger } from "./helpers/encode-run.js";
+import { waitForSessionFile } from "../routes/transcode/session-file/get.js";
+import { outputSpec } from "./helpers/output-spec.js";
+
+const SESSION_ID = "3333333344445555";
+const OUTPUT_KEY = "failed-serves:fmt=fmp4:grid=uniform:video-only:v=0/copy";
+// The other branch: a picture cut at the source's own keyframes, where the
+// muxer is handed the cut times and writes each piece self-contained. It has no
+// init FILE at all — the header is lifted out of the first piece — which is the
+// case `#initFromFirstSegment` answers `null` for instead of throwing `ENOENT`.
+const KEYFRAME_OUTPUT_KEY = "failed-serves-kf:fmt=fmp4:grid=kf@0:video-only:v=0/copy";
+
+/**
+ * One output with segment #0 finished on disk and its encoder dead.
+ *
+ * @returns {Promise<{ manager: object, dirPath: string, outputKey: string }>}
+ */
+async function outputWhoseEncoderDied({ failed = true, segments = [0], cutsAtGivenTimes = false } = {}) {
+  const manager = wireOutputs({
+    enabled: true,
+    ffmpegBin: "ffmpeg",
+    localBindHost: "127.0.0.1",
+    localPort: 9090
+  });
+  manager.encodeRuns.planEncodersNow = () => {};
+  manager.encodeRuns.planEncodersSoon = () => {};
+  const outputKey = cutsAtGivenTimes ? KEYFRAME_OUTPUT_KEY : OUTPUT_KEY;
+  manager.segmentStore.useFormat(outputKey, fmp4Format);
+  const dirPath = manager.segmentStore.directoryFor(outputKey);
+  // On the even grid — the branch that writes finished files outright, so their
+  // existence is the proof and the fixture needs no header. The other branch
+  // writes no init file at all.
+  for (const index of segments) {
+    await writeFile(path.join(dirPath, fmp4Format.segmentFileName(index)), Buffer.alloc(256, 0x5a));
+  }
+
+  const session = {
+    id: SESSION_ID,
+    spec: cutsAtGivenTimes
+      ? outputSpec({ transcodeVideo: false, cutGrid: "keyframe" })
+      : outputSpec({ transcodeVideo: true, cutGrid: "uniform" }),
+    outputKey,
+    dirPath,
+    timeline: new Timeline({
+      boundaries: [0, 12.5, 25, 37.5, 50, 62.5],
+      cutGrid: cutsAtGivenTimes ? "keyframe" : "uniform"
+    }),
+    state: "ready",
+    file: new SourceFile({ sourceKey: "source-1", fileIndex: 0, name: "video.mkv" }).learn({ durationSeconds: 62.5 }),
+    get inputFile() { return this.file; },
+    get audioFile() { return this.file; },
+    lastAloneSpeed: 2,
+    startedAt: Date.now(),
+    lastAccessedAt: Date.now(),
+    runs: new Set(),
+    lastError: "",
+    consumers: new Set(),
+    viewers: new Map(),
+    segmentCount: 5,
+    segmentFormat: fmp4Format,
+    useSyntheticPlaylist: true,
+    playlistText: "#EXTM3U\n",
+    output: new Output({ encodeWidth: 0, encodeHeight: 0, outputFps: 25, softwarePreset: null, applyTonemap: false }),
+    keyframes: new KeyframeTable().learn({ times: [0, 12.5, 25, 37.5, 50], format: "matroska" }),
+    audioOnly: false,
+    waitEpoch: 0
+  };
+  manager.outputs.set(SESSION_ID, session);
+  manager.viewers.of(session, "viewer-a").moveTo(0);
+  // The encoder ended for good, which is what every request below is asked
+  // against.
+  if (failed) {
+    manager.encodeOrchestrator.noteEnded({
+      address: outputKey,
+      run: { state: ENCODE_RUN_STATE.ENDED_FAILED },
+      lastError: "ffmpeg exited with code 255"
+    });
+    assert.equal(manager.encodeRuns.hasFailed(session), true, "the fixture must describe a failed output");
+  }
+  return { manager, dirPath, outputKey };
+}
+
+/**
+ * Wait until the store really holds a wait for this output.
+ *
+ * A check that ends a wait it has not yet registered proves nothing: it passes
+ * on the code that answers a request AFTER the event just as well as on the code
+ * that answers one already standing. The deadline is a backstop, never the
+ * measurement.
+ *
+ * @param {object} store
+ * @param {string} key
+ * @param {number} [howMany]
+ * @returns {Promise<void>}
+ */
+async function untilWaitsAreRegistered(store, key, howMany = 1) {
+  const giveUpAt = Date.now() + 5_000;
+  while (store.waitingFor(key) < howMany) {
+    if (Date.now() > giveUpAt) {
+      throw new Error(`no wait registered on ${key} after 5s — the check would prove nothing`);
+    }
+    await new Promise((resolve) => setImmediate(resolve));
+  }
+}
+
+test("a segment that is on disk is served although the encoder failed", async (t) => {
+  const { manager, dirPath } = await outputWhoseEncoderDied();
+  t.after(async () => {
+    await manager.lifecycle.disposeAll();
+    await rm(dirPath, { recursive: true, force: true });
+  });
+
+  const answer = await manager.serving.getFileStream(SESSION_ID, "segment-00000.mp4", { consumerId: "viewer-a" });
+
+  assert.equal(answer.kind, "file", `what is made is made — the answer was ${answer.kind}`);
+  assert.equal(answer.contentType, fmp4Format.segmentContentType);
+});
+
+test("a segment that is not there says the encoder failed, instead of being held", async (t) => {
+  const { manager, dirPath } = await outputWhoseEncoderDied();
+  t.after(async () => {
+    await manager.lifecycle.disposeAll();
+    await rm(dirPath, { recursive: true, force: true });
+  });
+
+  const answer = await manager.serving.getFileStream(SESSION_ID, "segment-00003.mp4", { consumerId: "viewer-a" });
+
+  assert.equal(answer.kind, "failed", "nothing is going to write it, and the viewer is owed the reason");
+  assert.match(answer.message, /255/);
+});
+
+test("the playlist is a fact of the timeline and outlives the encoder", async (t) => {
+  const { manager, dirPath } = await outputWhoseEncoderDied();
+  t.after(async () => {
+    await manager.lifecycle.disposeAll();
+    await rm(dirPath, { recursive: true, force: true });
+  });
+
+  const answer = await manager.serving.getFileStream(SESSION_ID, "index.m3u8", { consumerId: "viewer-a" });
+
+  assert.equal(answer.kind, "file");
+  assert.equal(answer.isPlaylist, true);
+});
+
+test("a failure reaches a request that was ALREADY waiting", async (t) => {
+  // The case the other checks in this file do not reach: they set the failure
+  // and then ask. A wait that began BEFORE it is ended by the publication, by a
+  // wake, by the requester going or by its own deadline — and a failure is none
+  // of those, so it sat out the whole deadline for a piece nothing was going to
+  // make, and where the page states no deadline, until the viewer disconnected.
+  const { manager, dirPath } = await outputWhoseEncoderDied({ failed: false });
+  t.after(async () => {
+    await manager.lifecycle.disposeAll();
+    await rm(dirPath, { recursive: true, force: true });
+  });
+  const session = manager.outputs.get(SESSION_ID);
+  const child = fakeProcess();
+  const run = new EncodeRun({
+    address: OUTPUT_KEY,
+    encoder: { name: "libx264", kind: "software" },
+    from: 3,
+    to: 4,
+    buildArgs: () => [],
+    spawn: () => child,
+    logger: silentLogger,
+    lastSegmentIndex: () => 4,
+    because: "a check asked for it",
+    onEnded: (ended) => manager.encodeRuns.noteRunEnded(session, run, ended)
+  });
+  manager.encodeOrchestrator.adopt(OUTPUT_KEY, run);
+
+  // Held with a deadline long enough that running it out IS the failure.
+  const held = waitForSessionFile(manager.serving, SESSION_ID, "segment-00003.mp4", {
+    holdMs: 30_000,
+    consumerId: "viewer-a"
+  });
+  // The wait must EXIST before it can be said to have been woken.
+  await untilWaitsAreRegistered(manager.segmentStore, OUTPUT_KEY);
+
+  child.exit(255);
+
+  // Bounded, because a regression here would otherwise HANG for the whole
+  // thirty-second hold and take the rest of the file down with it.
+  const answer = await settledWithin(held, 5_000);
+
+  assert.notEqual(answer, STILL_WAITING, "it was left to sit out its whole hold");
+  assert.equal(answer.kind, "failed", "a wait nothing will satisfy must be told");
+});
+
+/** What a race answers when the promise did not settle in time. */
+const STILL_WAITING = Symbol("still waiting");
+
+/**
+ * The promise's answer, or {@link STILL_WAITING} if it has not settled yet.
+ *
+ * Used for BOTH directions, and the direction decides what the bound means. On
+ * "it must be told", the bound is a backstop that turns a regression into a
+ * failure in seconds instead of a test that hangs until the hold runs out — and
+ * a hanging test is worse than an absent one, because it takes the rest of the
+ * file down with it (measured here: three checks cancelled by one hang). On
+ * "it must go on waiting", the bound IS the grace, and it cannot fail red — it
+ * can only pass too easily.
+ *
+ * @param {Promise<unknown>} promise
+ * @param {number} withinMs
+ * @returns {Promise<unknown>}
+ */
+async function settledWithin(promise, withinMs) {
+  return await Promise.race([
+    promise,
+    new Promise((resolve) => setTimeout(() => resolve(STILL_WAITING), withinMs))
+  ]);
+}
+
+test("a run that exits 0 having produced less than promised also reaches a waiting request", async (t) => {
+  // ffmpeg exits 0 both at the end of the file and when its input stops
+  // delivering, so a run that stopped short claims success. That ending is
+  // terminal all the same — and it was the one branch of the exit handler that
+  // returned before anybody waiting was told.
+  const { manager, dirPath } = await outputWhoseEncoderDied({ failed: false });
+  t.after(async () => {
+    await manager.lifecycle.disposeAll();
+    await rm(dirPath, { recursive: true, force: true });
+  });
+  const session = manager.outputs.get(SESSION_ID);
+  const child = fakeProcess();
+  const run = new EncodeRun({
+    address: OUTPUT_KEY,
+    encoder: { name: "libx264", kind: "software" },
+    from: 3,
+    to: 4,
+    buildArgs: () => [],
+    spawn: () => child,
+    logger: silentLogger,
+    lastSegmentIndex: () => 4,
+    because: "a check asked for it",
+    onEnded: (ended) => manager.encodeRuns.noteRunEnded(session, run, ended)
+  });
+  manager.encodeOrchestrator.adopt(OUTPUT_KEY, run);
+
+  const held = waitForSessionFile(manager.serving, SESSION_ID, "segment-00003.mp4", {
+    holdMs: 30_000,
+    consumerId: "viewer-a"
+  });
+  await untilWaitsAreRegistered(manager.segmentStore, OUTPUT_KEY);
+
+  // Zero, having made none of the two segments it was given.
+  child.exit(0);
+
+  const answer = await settledWithin(held, 5_000);
+
+  assert.equal(manager.encodeRuns.hasFailed(session), true, "stopping short is a failure, not a finished file");
+  assert.notEqual(answer, STILL_WAITING, "it was left to sit out its whole hold");
+  assert.equal(answer.kind, "failed", "a wait nothing will satisfy must be told");
+});
+
+test("one run of two ending in failure tells nobody — the other is still making it", async (t) => {
+  // The condition is the OUTPUT's state, not this run's ending. A run that
+  // failed while another is alive on the same output has not made the segment
+  // unobtainable, so a request for it goes on waiting rather than being handed
+  // an error by the run that lost.
+  const { manager, dirPath } = await outputWhoseEncoderDied({ failed: false });
+  t.after(async () => {
+    await manager.lifecycle.disposeAll();
+    await rm(dirPath, { recursive: true, force: true });
+  });
+  const session = manager.outputs.get(SESSION_ID);
+  const runOf = (from, to, child) => {
+    const run = new EncodeRun({
+      address: OUTPUT_KEY,
+      encoder: { name: "libx264", kind: "software" },
+      from,
+      to,
+      buildArgs: () => [],
+      spawn: () => child,
+      logger: silentLogger,
+      lastSegmentIndex: () => 4,
+      because: "a check asked for it",
+      onEnded: (ended) => manager.encodeRuns.noteRunEnded(session, run, ended)
+    });
+    manager.encodeOrchestrator.adopt(OUTPUT_KEY, run);
+    return run;
+  };
+  const dying = fakeProcess();
+  const working = fakeProcess();
+  runOf(3, 3, dying);
+  runOf(4, 4, working);
+
+  const held = waitForSessionFile(manager.serving, SESSION_ID, "segment-00003.mp4", {
+    holdMs: 30_000,
+    consumerId: "viewer-a"
+  });
+  await untilWaitsAreRegistered(manager.segmentStore, OUTPUT_KEY);
+
+  dying.exit(255);
+
+  assert.equal(
+    manager.encodeRuns.hasFailed(session),
+    false,
+    "the output has not failed while a run is alive on it"
+  );
+  assert.equal(await settledWithin(held, 300), STILL_WAITING, "the request must go on waiting");
+});
+
+test("an init that will never be made says so instead of warming up for ever", async (t) => {
+  // On the branch that lifts the header out of the first piece there is no file
+  // to be missing: `#initFromFirstSegment` answers null rather than throwing, so
+  // the catch that names a failure is never reached and the answer was always
+  // "still warming up".
+  //
+  // THE FIXTURE MUST BE ON THAT BRANCH, and it was not: with a re-encode on the
+  // even grid `cutsAtGivenTimes` is false, so the check read a missing init
+  // FILE and exercised the `ENOENT` path instead — the one that was never
+  // broken. A copy cut at the source's own keyframes is the configuration that
+  // writes no init file at all.
+  const { manager, dirPath } = await outputWhoseEncoderDied({ segments: [], cutsAtGivenTimes: true });
+  t.after(async () => {
+    await manager.lifecycle.disposeAll();
+    await rm(dirPath, { recursive: true, force: true });
+  });
+
+  const answer = await manager.serving.getFileStream(SESSION_ID, "init.mp4", { consumerId: "viewer-a" });
+
+  assert.equal(answer.kind, "failed", "nothing is going to produce the header it would come from");
+  assert.match(answer.message, /255/);
+});