@torrent-tv/proxy 2.9.91 → 2.9.93

package/CHANGELOG.md

@@ -1,3 +1,14 @@
+## 2.9.93
+
+- **Fix**: A seek could kill playback outright. Restarting at a position that lands exactly on a keyframe leaves a floating-point residue — `seekSeconds - snappedKeyframe` came out as `3.3333333249174757e-7` — and `String()` renders anything below 1e-6 in exponential notation, which ffmpeg's duration parser rejects: `Invalid duration for option ss`. The run died on startup, and from then on every segment request answered 500. Time arguments are now formatted in fixed notation, and a residue under a millisecond is dropped rather than passed on, because it is not a real offset.
+- **Fix**: A session could never recover from a dead encoder. The "already covered by the running encode, not restarting" shortcut did not check that the run was alive, so once one had died `session.ffmpeg` still pointed at the corpse and every later seek was waved through as already covered. One ffmpeg failure therefore became a session that answered 500 for as long as the viewer kept trying.
+- **Fix**: The look-ahead bound held the encoder back but did not keep it there. Any segment request released it, including a request for something produced ten minutes earlier, so it sawtoothed between suspended and running and drifted from 155 s to 922 s ahead of the viewer over three minutes. A request now re-evaluates the same condition the monitor uses instead of resuming outright.
+
+## 2.9.92
+
+- **Fix**: A seek acts on what the viewer asked for, instead of waiting out guards built for a signal that no longer exists. Three delays sat in front of every seek, all of them there because a far segment REQUEST used to steer the encoder and the player's playlist scan produced dozens of them. Requests stopped steering anything when the position became explicit, so what arrives now is only ever a position the viewer stated. The settle window drops from 1.2 s to 300 ms (the browser already collapses a drag into one report at 300 ms — this was a second debounce on an already-debounced signal, and it cost 1.2 s of every measured seek). The floor between restarts drops from 4 s to 500 ms, now a guard against a client spamming the endpoint rather than a policy about noise. And a run in progress is no longer protected for up to 30 s while it reaches its first segment: finishing a segment for a position the viewer has left is work nobody wants, and the hold could delay a genuine second seek by the whole grace. Measured cost of the old behaviour, 2026-08-04: two seeks 1.3 s apart produced two restarts 4.4 s apart, the first encoding 119.5 s of content before the second killed it.
+- **Chore**: Removed `ENCODER_STALL_MS`, declared with a paragraph describing a watchdog that was never wired to anything.
+
 ## 2.9.91
 
 - **Fix**: The encoder no longer runs away from the viewer. Nothing bounded how far ahead it produced: measured 2026-08-04, three minutes after a film was opened the encode had reached 00:39:24 of a 01:26:51 source at 12.8x while the viewer was still at the start, and the torrent had pulled 80% of 4.7 GB to feed it — the pool owner's bandwidth and disk spent on a viewer who may watch two minutes, the pieces being read evicted from memory by pieces forty minutes ahead, and the swarm busy with anything but the segment being waited for. An encoder more than two minutes of content ahead of the last segment its viewer asked for is now **suspended**, and released once the viewer is within a minute of it — or at once when a segment is requested. Suspended rather than killed on purpose: restarting costs about nine seconds on this hardware, so a viewer reaching the end of the produced range would stall every time, while suspending keeps the process, its input and its position. POSIX only; where `SIGSTOP` does not exist the attempt fails once, is logged, and that session keeps the old behaviour. Every path that terminates an encoder now releases it first — a suspended process does not act on `SIGTERM` until it is continued, which would have hung the wait a seek performs before starting its replacement.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@torrent-tv/proxy",
-  "version": "2.9.91",
+  "version": "2.9.93",
   "description": "Torrent proxy client that exposes webseed-like HTTP stream endpoint.",
   "license": "GPL-3.0-or-later",
   "publishConfig": {

package/services/hls-session-manager.js

@@ -43,26 +43,15 @@ const DEFAULT_SEGMENT_DURATION_SEC = 4;
 // is allowed to be before we restart ffmpeg at that position (server-side seek).
 // Requests within the window are served by waiting for the running encode.
 const MAX_LOOKAHEAD_SEGMENTS = 8;
-// After a seek-restart, ignore competing restart requests for this long. The
-// synthetic VOD playlist lets the player request distant segments in quick
-// succession (stall-recovery seeks); without a cooldown ffmpeg ping-pongs
-// between positions, restarting endlessly and producing nothing.
-const RESTART_COOLDOWN_MS = 4_000;
-// How long a seek restart waits for the CURRENT run to produce its first
-// segment before it is allowed to pre-empt it anyway. Generous, because the
-// first segment after a seek is the slowest thing this pipeline does (ffmpeg
-// restart + torrent pieces for a fresh position); still bounded so a wedged
-// run cannot block seeking forever. See #fireSettledSeek.
-const RUN_FIRST_SEGMENT_GRACE_MS = 30_000;
-// Encoder stall watchdog. A running ffmpeg emits `-progress` output on stdout
-// continuously while it encodes; when it hangs mid-file (alive, but producing
-// no output and no stderr — a deadlock, e.g. a stalled input read), that output
-// stops and `progress.updatedAt` freezes. If a segment INSIDE the look-ahead
-// window is being demanded but progress has not advanced for this long, the
-// encoder is wedged (observed: the segment 503s forever). Treat it like a seek
-// and restart ffmpeg at the demanded segment. Conservative — a slow-but-moving
-// encode keeps advancing `updatedAt`, so this only fires on a true freeze.
-const ENCODER_STALL_MS = 12_000;
+// Floor between actual restarts. It used to be 4 s, from when a far segment
+// REQUEST could steer the encoder and a playlist scan produced a burst of them.
+// Requests no longer steer anything (see #ensureEncodingFor) — every restart
+// now comes from a position the viewer stated — so this is no longer a policy
+// about noise, only a guard against a client that spams the seek endpoint.
+// Measured cost of the old value 2026-08-04: two seeks 1.3 s apart produced two
+// restarts 4.4 s apart, the first encoding 119.5 s of content nobody wanted
+// before the second killed it.
+const RESTART_COOLDOWN_MS = 500;
 // How far ahead of the viewer the encoder may run before it is stopped, and how
 // far it must fall back to before it is let go again.
 //
@@ -101,10 +90,17 @@ const LOOKAHEAD_RESUME_SECONDS = 60;
 // encoding 125 s of content before reaching the viewer's position. Field
 // 2026-08-02: a seek took 56 s, of which ~50 s was this backoff.
 const SEEK_BACKOFF_SEGMENTS = 1;
-const SEEK_SETTLE_MS = 1_200;
-// Hard cap on the total settle wait, measured from the first far request of a
+// How long to wait for a scrub to stop moving before acting on it. Small,
+// because the browser already collapses a drag into ONE report
+// (`SEEK_REPORT_DEBOUNCE_MS`, 300 ms) and only reports where it settled — this
+// is a second debounce on an already-debounced signal, and every millisecond of
+// it is dead time in front of the viewer. It was 1.2 s when the encoder was
+// also steered by segment requests, which arrive in bursts of dozens; measured
+// 2026-08-04, that cost 1.2 s of every seek.
+const SEEK_SETTLE_MS = 300;
+// Hard cap on the total settle wait, measured from the first request of a
 // burst, so a still-moving scrubber cannot delay a genuine seek forever.
-const SEEK_SETTLE_MAX_MS = 2_500;
+const SEEK_SETTLE_MAX_MS = 1_000;
 // Grace period to wait for the PREVIOUS ffmpeg process to exit (per signal
 // escalation step: SIGTERM, then SIGKILL) before spawning its replacement into
 // the same session directory. See #startEncodeRun.
@@ -577,6 +573,28 @@ async function probeVideoKeyframeTimes(ffmpegBin, inputUrl, timeoutMs = 25_000)
   });
 }
 
+/**
+ * A number of seconds as ffmpeg will accept it.
+ *
+ * `String(n)` switches to exponential notation below 1e-6, and ffmpeg's
+ * duration parser rejects that outright: a field session died on
+ * `Invalid duration for option ss: 3.3333333249174757e-7`, after which the
+ * transcode was in state `failed` and every segment request answered 500 for
+ * as long as the viewer kept trying. Anything under a millisecond is also not a
+ * real offset — it is the residue of subtracting two nearly equal floats — so
+ * it is dropped rather than passed on.
+ *
+ * @param {number} value
+ * @returns {string}
+ */
+export function ffmpegSeconds(value) {
+  if (!Number.isFinite(value) || Math.abs(value) < 0.001) {
+    return "0";
+  }
+  // Microsecond resolution, fixed notation, no trailing zero noise.
+  return value.toFixed(6).replace(/\.?0+$/, "");
+}
+
 /**
  * Compute segment START times (a 0-based timeline) for a session.
  *
@@ -1592,24 +1610,41 @@ export class HlsSessionManager {
    */
   #enforceLookAhead() {
     for (const session of this.sessionsById.values()) {
-      if (!session || session.state === "disposed" || !session.ffmpeg) {
-        continue;
-      }
-      const encodedTo = Number(session.progress?.processedSeconds);
-      if (!Number.isFinite(encodedTo)) {
-        continue;
-      }
-      // Where the viewer is. Before the first segment request, the position the
-      // run started at — so a session nobody has read from yet is bounded too.
-      const viewerAt = Number.isInteger(session.lastRequestedSegment)
-        ? this.#segmentStartTime(session, session.lastRequestedSegment)
-        : this.#segmentStartTime(session, session.encodeStartIndex ?? 0);
-      const ahead = encodedTo - viewerAt;
-      if (!session.encoderPaused && ahead > LOOKAHEAD_PAUSE_SECONDS) {
-        this.#pauseEncoder(session, `${Math.round(ahead)}s ahead of the viewer`);
-      } else if (session.encoderPaused && ahead <= LOOKAHEAD_RESUME_SECONDS) {
-        this.#resumeEncoder(session, `${Math.round(ahead)}s ahead of the viewer`);
-      }
+      this.#enforceLookAheadFor(session);
+    }
+  }
+
+  /**
+   * Decide whether one session's encoder should be running right now.
+   *
+   * Called both on the monitor's interval and the moment a segment is
+   * requested. It must be the SAME decision in both places: an earlier version
+   * simply resumed on any request, which meant a request for a segment produced
+   * ten minutes ago released an encoder that had nothing left to do — measured
+   * 2026-08-04, the encoder sawtoothed between suspended and running and drifted
+   * from 135 s to 702 s ahead of the viewer while doing it.
+   *
+   * @param {HlsSession} session
+   * @returns {void}
+   */
+  #enforceLookAheadFor(session) {
+    if (!session || session.state === "disposed" || !session.ffmpeg) {
+      return;
+    }
+    const encodedTo = Number(session.progress?.processedSeconds);
+    if (!Number.isFinite(encodedTo)) {
+      return;
+    }
+    // Where the viewer is. Before the first segment request, the position the
+    // run started at — so a session nobody has read from yet is bounded too.
+    const viewerAt = Number.isInteger(session.lastRequestedSegment)
+      ? this.#segmentStartTime(session, session.lastRequestedSegment)
+      : this.#segmentStartTime(session, session.encodeStartIndex ?? 0);
+    const ahead = encodedTo - viewerAt;
+    if (!session.encoderPaused && ahead > LOOKAHEAD_PAUSE_SECONDS) {
+      this.#pauseEncoder(session, `${Math.round(ahead)}s ahead of the viewer`);
+    } else if (session.encoderPaused && ahead <= LOOKAHEAD_RESUME_SECONDS) {
+      this.#resumeEncoder(session, `${Math.round(ahead)}s ahead of the viewer`);
     }
   }
 
@@ -1937,17 +1972,17 @@ export class HlsSessionManager {
     if (snappedKeyframe !== null) {
       const residualSeconds = Math.max(0, seekSeconds - snappedKeyframe);
       if (snappedKeyframe > 0) {
-        args.push("-ss", String(snappedKeyframe));
+        args.push("-ss", ffmpegSeconds(snappedKeyframe));
       }
       args.push("-i", session.inputUrl);
       if (residualSeconds > 0) {
-        args.push("-ss", String(residualSeconds));
+        args.push("-ss", ffmpegSeconds(residualSeconds));
       }
     } else {
       if (seekSeconds > 0) {
         // No keyframe map (probe failed/timed out) — fall back to the previous
         // behaviour: trust the container's own accurate seek.
-        args.push("-accurate_seek", "-ss", String(seekSeconds));
+        args.push("-accurate_seek", "-ss", ffmpegSeconds(seekSeconds));
       }
       args.push("-i", session.inputUrl);
     }
@@ -1956,7 +1991,7 @@ export class HlsSessionManager {
       // segment grid; relabel output onto the original timeline so segment N
       // carries PTS = N × segmentDuration.
       if (startSeconds > 0) {
-        args.push("-output_ts_offset", String(startSeconds));
+        args.push("-output_ts_offset", ffmpegSeconds(startSeconds));
       }
     } else {
       // Branch B (video copied — only audio is transcoded): we cannot insert
@@ -1968,7 +2003,7 @@ export class HlsSessionManager {
       // beginning and desyncs audio/video). Audio is transcoded on this timeline.
       args.push("-copyts");
       if (sourceStartTime !== 0) {
-        args.push("-output_ts_offset", String(-sourceStartTime));
+        args.push("-output_ts_offset", ffmpegSeconds(-sourceStartTime));
       }
     }
     args.push(
@@ -2393,8 +2428,14 @@ export class HlsSessionManager {
       : this.#segmentStartTime(session, head);
     const currentSeg = Math.max(head, this.#segmentIndexForTime(session, processed));
     // Already covered by the running encode — the data is on its way, so
-    // restarting would only destroy work the viewer is waiting for.
-    if (index >= head && index <= currentSeg + MAX_LOOKAHEAD_SEGMENTS) {
+    // restarting would only destroy work the viewer is waiting for. The run has
+    // to be ALIVE for that to hold: after a run died, `session.ffmpeg` still
+    // pointed at the dead process and every later seek was waved through as
+    // "already covered", so nothing could ever restart it. Measured 2026-08-04:
+    // one ffmpeg failure turned into a session that answered 500 to every
+    // segment for as long as the viewer kept trying.
+    const runIsAlive = session.ffmpeg != null && !hasChildExited(session.ffmpeg);
+    if (runIsAlive && index >= head && index <= currentSeg + MAX_LOOKAHEAD_SEGMENTS) {
       logger.info(
         `transcode ${session.id} seek to ${positionSeconds.toFixed(1)}s (#${index}) ` +
           `already within the running encode (#${head}..#${currentSeg}) — not restarting`
@@ -2464,48 +2505,21 @@ export class HlsSessionManager {
       session.seekSettleTimer.unref?.();
       return;
     }
-    // Let the CURRENT run finish what it started. Restarting a run that has not
-    // yet produced a single segment destroys all its work and starts the wait
-    // over — and after a seek the first segment is always the slowest, so this
-    // is self-perpetuating: field log (2026-08-02, one user seek) shows
-    // restarts at #617 → #717 → #732 → #732 every 5-7 s, none of which ever
-    // produced anything, leaving the viewer with a flickering loading pill and
-    // no playback at all.
-    //
-    // These extra targets are NOT further user seeks: when the player cannot
-    // get its segment it SCANS the playlist (every segment is listed in our
-    // synthetic VOD playlist, so from its point of view they all exist), and
-    // each far-enough probe looked like a fresh seek to us. Waiting for the
-    // first segment makes the scan harmless — it can no longer steer the
-    // encoder — and one genuine seek now reliably completes.
-    //
-    // Bounded by RUN_FIRST_SEGMENT_GRACE_MS so a wedged run cannot block seeks
-    // forever; the encoder-stall watchdog and the exit handler cover a run that
-    // dies outright.
+    // A run in progress is NOT protected any more. It used to be: a restart was
+    // held for up to 30 s while the current run reached its first segment,
+    // because a far segment REQUEST could steer the encoder and the player's
+    // playlist scan produced dozens of them — restarts at #617 → #717 → #732 →
+    // #732 every 5-7 s, none producing anything (field 2026-08-02). Requests
+    // stopped steering anything when the position became explicit, so the only
+    // thing that can arrive here is a position the viewer has stated, and
+    // finishing a segment for where they no longer are is work nobody wants.
+    // Holding it was also expensive in the other direction: a genuine second
+    // seek could be delayed by the whole grace.
     const producedThisRun = this.#producedSecondsThisRun(session);
     const runIsAlive = session.ffmpeg != null && !hasChildExited(session.ffmpeg);
-    if (
-      runIsAlive &&
-      producedThisRun < this.segmentDurationSec &&
-      sinceLastRestart < RUN_FIRST_SEGMENT_GRACE_MS
-    ) {
-      logger.info(
-        `transcode ${session.id} seek #${target} HELD — current run has produced ` +
-          `${producedThisRun.toFixed(1)}s of the ${this.segmentDurationSec}s first segment ` +
-          `(${(sinceLastRestart / 1000).toFixed(1)}s into a ${RUN_FIRST_SEGMENT_GRACE_MS / 1000}s grace)`
-      );
-      session.seekSettleTimer = setTimeout(() => this.#fireSettledSeek(session), SEEK_SETTLE_MS);
-      session.seekSettleTimer.unref?.();
-      return;
-    }
-    // Why the restart was allowed — the counterpart of the HELD line above.
-    // Without it a restart is indistinguishable from the runaway ping-pong this
-    // guard exists to stop, and diagnosing a field report becomes guesswork.
     const allowedBecause = !runIsAlive
       ? "run is dead"
-      : producedThisRun >= this.segmentDurationSec
-        ? `run produced ${producedThisRun.toFixed(1)}s (first segment done)`
-        : `grace of ${RUN_FIRST_SEGMENT_GRACE_MS / 1000}s expired`;
+      : `viewer moved; run had produced ${producedThisRun.toFixed(1)}s`;
     // The start is exactly what requestSeek computed — one segment before the
     // viewer's position — and nothing else may move it.
     //
@@ -2709,8 +2723,10 @@ export class HlsSessionManager {
       const requested = session.segmentFormat.segmentIndexFromName(fileName);
       if (requested >= 0) {
         session.lastRequestedSegment = requested;
-        // A viewer who has caught up must not wait out the monitor's interval.
-        this.#resumeEncoder(session, "a segment was requested");
+        // A viewer who has caught up must not wait out the monitor's interval —
+        // but only if they HAVE caught up, which is why this re-evaluates the
+        // same condition instead of resuming outright.
+        this.#enforceLookAheadFor(session);
       }
     }
     try {