@torrent-tv/proxy 2.97.5 → 2.97.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@torrent-tv/proxy",
-  "version": "2.97.5",
+  "version": "2.97.7",
   "description": "Torrent proxy client that exposes webseed-like HTTP stream endpoint.",
   "license": "GPL-3.0-or-later",
   "repository": {

package/server.js

@@ -802,6 +802,7 @@ export async function startProxyServer({
     // thread, so the map crosses the worker channel; what it does with it —
     // seconds into bytes, what to ask the swarm for, what to keep in memory —
     // is its own business.
+    setDownloadRate: (bytesPerSecond, because) => torrentPool.setDownloadRate?.(bytesPerSecond, because),
     setPriorityMap: async ({ sourceKey, fileIndex, durationSeconds, zones }) => {
       void sourcePreparation?.refresh();
       const record = sourceRegistry.get(sourceKey);

package/services/encode/EncodeInputs.js

@@ -25,6 +25,8 @@ function keep(readings, value) {
 /** Event-driven preparation; a synchronous run request can take only ready input. */
 export class EncodeInputs {
   #requests = new Map();
+  /** Whether an output's last resolved input was its original file. @type {WeakMap<object, boolean>} */
+  #original = new WeakMap();
   #revision = 0;
   #memoryRevision = 0;
   #held = 0;
@@ -130,6 +132,17 @@ export class EncodeInputs {
     }
   }
 
+  /**
+   * Whether this output reads its original file, as its last resolved input
+   * did, or undefined before any was resolved.
+   *
+   * @param {object} output
+   * @returns {boolean | undefined}
+   */
+  readsOriginal(output) {
+    return this.#original.get(output);
+  }
+
   failureOf(output) {
     for (const request of this.#requests.values()) {
       if (request.output === output && request.result?.kind === "terminal") return request.result;
@@ -262,6 +275,7 @@ export class EncodeInputs {
     request.timing.attempts += 1;
     request.promise = (async () => {
       const resolved = await this.#resolveTimed(request.timing, request.output, request.from, request.from);
+      if (resolved.kind === "result") this.#original.set(request.output, resolved.sources?.every(source => source.input.original === true) === true);
       if (this.#requests.get(request.key) !== request) return;
       let result;
       if (resolved.kind !== "result") {

package/services/encode/EncodeRun.js

@@ -116,6 +116,12 @@ export class EncodeRun {
   /** Half a name left over from the last chunk of the encoder's own channel. */
   #closedTail = "";
   #pendingClosed = null;
+  /**
+   * The last closed piece when this run was stopped, published once the file
+   * the muxer flushes after it is named — the file that says where the next
+   * keyframe's leading pictures end it — or at the exit when none is.
+   */
+  #pendingAtStop = null;
   #closedTimings = new Map();
   #publicationError = null;
   #publicationCode = null;
@@ -226,6 +232,9 @@ export class EncodeRun {
    *   encoder itself names it on its own channel, and answers with the name that
    *   piece is served under — because making it servable is a rename, and only
    *   whoever owns the disk can perform one.
+   * @param {(name: string) => void} [params.onTail] - Called with the working
+   *   name of a file this run closed but will not publish: past its last cut, or
+   *   flushed when it was stopped. It begins with the next keyframe.
    * @param {(index: number) => void} [params.onProduced] - Called with every
    *   segment number this run has closed, as it closes it.
    * @param {(progress: object) => void} [params.onProgress] - Called with this
@@ -262,6 +271,7 @@ export class EncodeRun {
     onEnded,
     onSpeedMeasured,
     onClosed,
+    onTail,
     onProgress,
     onProduced,
     lastSegmentIndex,
@@ -292,6 +302,7 @@ export class EncodeRun {
     // Told the NAME of every piece the encoder has closed. The name is the
     // proof it is whole; nothing else here can prove that.
     this.onClosed = typeof onClosed === "function" ? onClosed : (name) => name;
+    this.onTail = typeof onTail === "function" ? onTail : () => {};
     this.lastSegmentIndex = typeof lastSegmentIndex === "function" ? lastSegmentIndex : () => null;
     this.inputUnavailable = typeof inputUnavailable === "function" ? inputUnavailable : () => false;
     this.argsDescribed = argsDescribed;
@@ -605,7 +616,18 @@ export class EncodeRun {
       if (name.length === 0) {
         continue;
       }
-      if (this.#stopping || this.#publicationError) continue;
+      if (this.#publicationError) continue;
+      if (this.#stopping) {
+        // Flushed by our stop. Never published; it tells where the piece closed
+        // before the stop ends, and it begins with the next keyframe.
+        if (this.#pendingAtStop !== null) {
+          const pending = this.#pendingAtStop;
+          this.#pendingAtStop = null;
+          this.#publishClosed(pending, name, { quiet: true });
+        }
+        this.onTail(name);
+        continue;
+      }
       if (csv) {
         this.#closedTimings.set(name, {
           endMicros: BigInt(Math.round(Number(csv[3]) * 1_000_000))
@@ -626,6 +648,7 @@ export class EncodeRun {
       // A packet crossing the final cut can flush a following file. It may
       // complete its predecessor, but no unadmitted interval can be published.
       if (Number.isInteger(index) && Number.isInteger(endOfWork) && index > endOfWork) {
+        this.onTail(name);
         this.#closedTimings.delete(name);
         this.#pendingClosed = null;
         continue;
@@ -634,7 +657,7 @@ export class EncodeRun {
     }
   }
 
-  #publishClosed(name, following = null) {
+  #publishClosed(name, following = null, { quiet = false } = {}) {
       this.#measureSpeed();
       // ITS SERVED NAME, which is what whoever owns the disk gives it in answer.
       // ffmpeg writes a piece under a working name and reports that; the piece
@@ -644,6 +667,14 @@ export class EncodeRun {
       try {
         served = this.onClosed(name, following, this.#closedTimings.get(name) ?? null);
       } catch (error) {
+        if (quiet) {
+          // A piece closed before our stop that cannot be proved whole is not
+          // published, and it is not a failure of the run: it is made again
+          // where it is wanted.
+          this.logger?.warn?.(`encode-run #${this.from}..#${this.to} on ${this.address}: ${name} closed before the stop is not published: ` +
+            `${error instanceof Error ? error.message : String(error)}`);
+          return false;
+        }
         this.#publicationError = error instanceof Error ? error.message : String(error);
         this.#publicationCode = error?.code ?? null;
         this.lastError = this.#publicationError;
@@ -713,9 +744,11 @@ export class EncodeRun {
       return;
     }
     // A cut closed before our stop stays complete; the file flushed by the
-    // subsequent signal must never be published as that same proof.
+    // subsequent signal must never be published as that same proof. It is
+    // waited for all the same: it says where the next keyframe's leading
+    // pictures end the piece before it (torrent-tv/meta#178).
     if (this.#pendingClosed !== null && !this.#processExited && !this.#inputTruncated) {
-      this.#publishClosed(this.#pendingClosed);
+      this.#pendingAtStop = this.#pendingClosed;
       this.#pendingClosed = null;
     }
     this.#stopping = true;
@@ -845,6 +878,11 @@ export class EncodeRun {
       return;
     }
     if (this.#stopping) {
+      if (this.#pendingAtStop !== null) {
+        const pending = this.#pendingAtStop;
+        this.#pendingAtStop = null;
+        this.#publishClosed(pending, null, { quiet: true });
+      }
       this.#finish(ENCODE_EXIT.STOPPED, this.#stopReason, code, signal);
       return;
     }

package/services/encode/EncodeRuns.js

@@ -12,13 +12,13 @@ import { spawn } from "node:child_process";
 import { contentionPenalty } from "./contention.js";
 import { ENCODE_RUN_STATE, liveRunsOf, runStateOf, wireState } from "./encode-run-state.js";
 import { ENCODE_EXIT } from "./encode-exit.js";
-import { EncodeRun } from "./EncodeRun.js";
+import { EncodeRun, endOfRun } from "./EncodeRun.js";
 import { computeOutputDimensions } from "./args.js";
 import { buildAdmittedCommand } from "./admitted-command.js";
 import { buildOriginalCommand } from "./source-command.js";
 import { writeAdmittedInput } from "./AdmittedInput.js";
-import { cutOf, cutShiftOf, judgeNeighbors, judgePiece, onItsCutClock } from "./piece-completeness.js";
-import { presentationSegment } from "./segment-formats/presentation-segment.js";
+import { cutOf, cutShiftOf, judgeNeighbors, judgePiece, leadingSecondsOf, lacksOnlyItsLeadingPictures } from "./piece-completeness.js";
+import { leadingPictures, presentationSegment } from "./segment-formats/presentation-segment.js";
 import { InputFailures, failedAdmittedInput } from "./InputFailures.js";
 import { readProcessCpuSeconds } from "./host-load.js";
 
@@ -174,6 +174,18 @@ export class EncodeRuns {
 
   #lastInputToken = 0;
   #inputFailures = new InputFailures();
+  /**
+   * The leading pictures of a keyframe as a run that had the group before it
+   * in hand made them, by output and the number of the piece that keyframe
+   * opens: taken from the file a run closes past its last cut, and given to
+   * the run that starts at that keyframe, which cannot make them
+   * (torrent-tv/meta#178). Null where that file said the keyframe has none,
+   * which is as much an answer; an entry goes when that piece is published or
+   * the output is gone.
+   *
+   * @type {Map<string, Map<number, Buffer | null>>}
+   */
+  #leadingByOutput = new Map();
   /** What this reads and asks of the rest of the proxy, and nothing else. @type {object} */
   #host;
 
@@ -371,18 +383,16 @@ export class EncodeRuns {
    * @param {Buffer | null} [bytes]
    * @param {EncodeRun | null} [run] - The run that closed it, which keeps where its muxer counts cuts from.
    * @param {{ endMicros: bigint } | null} [timing] - The piece's end in the muxer's clock, from its segment list.
+   * @param {string | null} [following] - The working name of the file the muxer closed after it.
    * @returns {object | null | false}
    */
-  #wholeClosedPiece(session, name, index, admitted = false, bytes = null, run = null, timing = null) {
+  #wholeClosedPiece(session, name, index, admitted = false, bytes = null, run = null, timing = null, following = null) {
 
     const format = session.segmentFormat;
     if (!format?.readMediaRanges || !Number.isInteger(index) || index < 0) {
       return null;
     }
     const address = session.outputKey ?? "";
-    // `bytes` is the piece the proxy cut again by presentation time at the
-    // published grid; without it the piece is as the muxer cut it.
-    const cutByProxy = bytes !== null;
     try {
       const mediaRanges = format.readMediaRanges(bytes ?? this.#host.segmentFiles.closedBytesOf(address, name));
 
@@ -394,32 +404,35 @@ export class EncodeRuns {
             .map(input => [input.track.type === "video" ? "vide" : "soun", input.sourceEndSeconds])) } : {}),
         requiredKinds: [session.spec.carries !== "audio-only" ? "vide" : null,
           session.spec.audio && !this.#host.servesAudioSeparately(session) ? "soun" : null].filter(Boolean) } : undefined;
+      // THE NEXT KEYFRAME'S LEADING PICTURES end this piece before its cut. The
+      // muxer cut where that keyframe is, and the file it closed next begins
+      // with it: its pictures shown before it are the span (torrent-tv/meta#178).
+      if (mediaRanges && following && session.spec.carries !== "audio-only") {
+        mediaRanges.nextLeadingSeconds = leadingSecondsOf(format.readMediaRanges(this.#host.segmentFiles.closedBytesOf(address, following)));
+      }
       if (run) {
         // Where the muxer counts this run's cuts from is known once its first
         // piece has closed, and holds for every piece after it. It is a fact
         // of each piece the run makes, so it travels with the piece.
         if (run.cutShiftSeconds === null && index === run.from) {
-          // Read from the piece as the muxer closed it: a piece cut again by
-          // the proxy starts where the grid says, whatever the muxer did.
-          const asMuxed = cutByProxy ? format.readMediaRanges(this.#host.segmentFiles.closedBytesOf(address, name)) : mediaRanges;
-          run.cutShiftSeconds = cutShiftOf(asMuxed, grid?.[run.from], session.spec.carries !== "audio-only" ? "vide" : "soun",
+          run.cutShiftSeconds = cutShiftOf(mediaRanges, grid?.[run.from], session.spec.carries !== "audio-only" ? "vide" : "soun",
             timing?.endMicros ?? null);
           // Said once per run: a piece judged on the wrong clock is refused by
           // a millisecond, and nothing else in the log says which clock it was
           // judged on (torrent-tv/meta#178).
           this.#host.logger.info(`encode-run #${run.from}..#${run.to} on ${address}: its muxer counts cuts ` +
             (run.cutShiftSeconds === null ? "from a first packet more than a frame away from its start (shift unknown)"
-              : `${run.cutShiftSeconds.toFixed(6)}s from its start at ${grid?.[run.from]}s`) +
-            (cutByProxy ? "; its pieces are cut again by the proxy at the published grid, so the shift does not apply to them" : ""));
+              : `${run.cutShiftSeconds.toFixed(6)}s from its start at ${grid?.[run.from]}s`));
         }
-        onItsCutClock(mediaRanges, run.cutShiftSeconds, cutByProxy);
+        if (mediaRanges && run.cutShiftSeconds !== null) mediaRanges.cutShiftSeconds = run.cutShiftSeconds;
       }
       const { whole, throughSeconds, reason } = judgePiece(format, mediaRanges, cut, interval);
       if (!whole) {
         this.#host.logger.warn(
           `encode: not publishing piece ${index} of ${address.slice(0, 60)}: ` +
             (reason ?? (throughSeconds === null ? "it holds no playable media" : `produced through ${throughSeconds}s, cut ${cut}s`)) +
-            ` cutBy=${cutByProxy ? "proxy" : "muxer"} shift=${Number.isFinite(mediaRanges?.cutShiftSeconds) ? mediaRanges.cutShiftSeconds : "none"}` +
+            ` shift=${Number.isFinite(mediaRanges?.cutShiftSeconds) ? mediaRanges.cutShiftSeconds : "none"}` +
+            ` nextLeading=${mediaRanges?.nextLeadingSeconds ?? "none"}` +
             (interval ? ` expected=${interval.from}..${interval.to} tracks=${JSON.stringify(mediaRanges.tracks.map(track => ({
               kind: track.kind, timescale: track.timescale, frame: track.productionFrame,
               first: track.ranges[0], last: track.ranges.at(-1), count: track.ranges.length })),
@@ -434,7 +447,18 @@ export class EncodeRuns {
           const ranges = this.#host.segmentFiles.mediaRangesOf(address, neighbor,
             { startSeconds: grid[neighbor] });
           if (!ranges) continue;
-          const judged = neighbor < index ? judgeNeighbors(ranges, mediaRanges) : judgeNeighbors(mediaRanges, ranges);
+          const [left, right] = neighbor < index ? [ranges, mediaRanges] : [mediaRanges, ranges];
+          const judged = judgeNeighbors(left, right);
+          // The one discontinuity that is known and not a fault of either
+          // piece: the right one's leading pictures, which a run starting at
+          // its keyframe cannot make and no run before it left. The gap is
+          // exactly the span the left one states it ends short by, and the
+          // right one begins at its keyframe.
+          if (!judged.whole && judged.reason?.startsWith("neighbor-discontinuity") && lacksOnlyItsLeadingPictures(left, right)) {
+            this.#host.logger.warn(`encode: publishing piece ${index} of ${address} beside a piece without its leading ` +
+              `pictures (${left.nextLeadingSeconds}s): the picture stands that long at #${Math.max(index, neighbor)}`);
+            continue;
+          }
           if (!judged.whole) {
             this.#host.logger.warn(`encode: not publishing piece ${index} of ${address}: ${judged.reason}`);
             return false;
@@ -450,30 +474,25 @@ export class EncodeRuns {
   }
 
   /**
-   * The media intervals of a stored piece of this output that holds the whole
-   * of its stretch, or undefined. A stored piece short of its cut — left by an
-   * earlier process — is taken off the disk here, where its cut is known.
+   * The media intervals of a stored piece of this output, or undefined.
+   *
+   * A piece is stored under its served name only once it was judged whole,
+   * when it was published — by this process, or by the one before it, whose
+   * pieces are adopted on that ground (`SegmentStore.adoptWhatSurvived`). So
+   * this only reads. It used to judge every piece again on every progress
+   * report and delete what it found short: a second place for one verdict,
+   * with a read that removed files, and a rule that could not know a piece
+   * ends before its cut by the next keyframe's leading pictures
+   * (torrent-tv/meta#178).
    *
    * @param {HlsSession} output
    * @param {number} index
    * @returns {object | undefined}
    */
   finishedMediaRangesOf(output, index) {
-    const address = output.outputKey ?? "";
-    const timeline = output.timeline;
-    const ranges = this.#host.segmentFiles.mediaRangesOf(address, index, {
-      startSeconds: timeline.publishedStartOf(index)
+    return this.#host.segmentFiles.mediaRangesOf(output.outputKey ?? "", index, {
+      startSeconds: output.timeline.publishedStartOf(index)
     });
-    if (!ranges || !output.segmentFormat?.producedThroughSeconds) {
-      return ranges;
-    }
-    const cut = cutOf(timeline, index);
-    const { whole, throughSeconds } = judgePiece(output.segmentFormat, ranges, cut);
-    if (whole || throughSeconds === null) {
-      return ranges;
-    }
-    this.#host.segmentFiles.remove(address, index, `produced through ${throughSeconds}s, short of its cut at ${cut}s`);
-    return undefined;
   }
 
   progressOf(output, index = null) {
@@ -598,10 +617,49 @@ export class EncodeRuns {
     return byOutput;
   }
 
+  /** Whether a run copies the picture from the original file it reads. */
+  #copiesOriginalPicture(session, admittedInput) {
+    return Boolean(admittedInput?.original) && !session.spec.transcodesVideo && session.spec.carries !== "audio-only";
+  }
+
+  /**
+   * Whether a run placed at `startIndex` reads from the keyframe before it:
+   * a copied picture read from its original file, the piece before made or
+   * being made — so a viewer goes on from it into this one — and nothing
+   * known of the leading pictures of the keyframe at the start.
+   */
+  #startsAtKeyframeBefore(session, startIndex) {
+    if (!(startIndex > 0) || session.spec.transcodesVideo || session.spec.carries === "audio-only" ||
+      session.segmentFormat?.id !== "fmp4" || this.#host.encodeInputs?.readsOriginal?.(session) !== true) return false;
+    if (this.#leadingByOutput.get(session.outputKey ?? "")?.has(startIndex)) return false;
+    const before = startIndex - 1;
+    return this.#host.producedNumbers(session).includes(before) ||
+      this.liveRunsOf(session).some(run => run.from <= before && endOfRun(run) >= before);
+  }
+
+  /**
+   * Keep what a run's unpublished file says of the keyframe it begins with:
+   * its leading pictures, or that it has none. Only for a piece not made yet.
+   */
+  #keepLeadingPictures(session, admittedInput, name) {
+    if (!this.#copiesOriginalPicture(session, admittedInput) || session.segmentFormat?.id !== "fmp4") return;
+    const address = session.outputKey ?? "";
+    const index = session.segmentFormat.segmentIndexFromName(session.segmentFormat.servedNameOf?.(name) ?? name);
+    if (!Number.isInteger(index) || this.#host.producedNumbers(session).includes(index)) return;
+    try {
+      const byIndex = this.#leadingByOutput.get(address) ?? new Map();
+      byIndex.set(index, leadingPictures(this.#host.segmentFiles.closedBytesOf(address, name)));
+      this.#leadingByOutput.set(address, byIndex);
+    } catch (error) {
+      this.#host.logger.warn(`encode: could not read the leading pictures of ${name}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+  }
+
   forgetEncodingOfGone(output) {
     this.#host.encodeInputs?.forget(output);
     if (this.#host.outputs.outputsOn(output.outputKey).length === 0) {
       this.#inputFailures.forget(output.outputKey);
+      this.#leadingByOutput.delete(output.outputKey);
       this.#host.encodeOrchestrator.forgetOpens?.(output.outputKey);
       this.#host.encodeOrchestrator.forgetOutput(output.outputKey);
     }
@@ -821,10 +879,17 @@ export class EncodeRuns {
     if (!this.isLive(session)) {
       return null;
     }
+    // A COPIED PICTURE STARTED AT ITS KEYFRAME cannot make that keyframe's
+    // leading pictures: they reference the group before. Where the piece
+    // before is made and nothing is known of this keyframe's leading pictures,
+    // the run starts one keyframe earlier and publishes from its start, so the
+    // group before is in hand (torrent-tv/meta#178).
+    const fromKeyframeBefore = this.#startsAtKeyframeBefore(session, startIndex);
+    const inputStart = fromKeyframeBefore ? startIndex - 1 : startIndex;
     // A copy held for a start that no live run ends before and that is not
     // being started now goes back (torrent-tv/meta#184).
     this.#host.encodeInputs?.retain(session, this.#host.encodeOrchestrator.wantedSegmentsOn(session.outputKey),
-      new Set([startIndex, ...this.liveRunsOf(session).map((run) => run.to + 1)]));
+      new Set([inputStart, ...this.liveRunsOf(session).map((run) => run.to + 1)]));
     // THE LAST NUMBER THIS RUN MAY REACH is the plan's; how far its input
     // really reaches is the input's answer. An original input is one copied
     // stretch, and the run is given exactly that stretch (torrent-tv/meta#158).
@@ -834,7 +899,7 @@ export class EncodeRuns {
     const mayReach = this.#inputFailures.boundFor(session.outputKey, startIndex,
       Number.isInteger(ordered?.to) && ordered.to >= startIndex ? ordered.to
         : segmentCount > startIndex ? segmentCount - 1 : startIndex);
-    const admittedInput = this.#host.encodeInputs?.take(session, startIndex, mayReach) ?? null;
+    const admittedInput = this.#host.encodeInputs?.take(session, inputStart, mayReach) ?? null;
     if (!admittedInput) return null;
     const inputEnd = admittedInput.original ? admittedInput.to : startIndex;
     // The stretch is part of an original input's identity: two stretches from
@@ -929,7 +994,7 @@ export class EncodeRuns {
     const inputToken = this.#lastInputToken;
     if (admittedInput) admittedInput.runTag = `${startIndex}r${inputToken}`;
     const buildCommand = admittedInput.original ? buildOriginalCommand : buildAdmittedCommand;
-    const { args, safeIndex, startSeconds, cutTimes } = buildCommand({
+    const built = buildCommand({
       admittedInput,
       inputToken,
       baseUrl: this.#host.localBaseUrl,
@@ -944,12 +1009,18 @@ export class EncodeRuns {
       audioSeparate: this.#host.servesAudioSeparately(session),
       audioSourceTrackIndex: session.spec.audioSourceTrackIndex,
       rateControl: session.spec.video?.encode?.rateControl ?? null,
-      startIndex,
+      startIndex: inputStart,
       endIndex: admittedInput.original ? inputEnd
         : Number.isInteger(ordered?.to) ? ordered.to : runEnd >= startIndex ? runEnd : session.timeline.segmentCount - 1,
       videoEncoder: this.#host.videoEncoder,
       segmentDurationSec: this.#host.segmentDurationSec
     });
+    const { args, cutTimes } = built;
+    // The piece before the start, made only to have its group in hand, is
+    // closed under a number below the run's and never published; the run
+    // itself begins where it publishes.
+    const safeIndex = fromKeyframeBefore ? startIndex : built.safeIndex;
+    const startSeconds = fromKeyframeBefore ? session.timeline.publishedStartOf(startIndex) : built.startSeconds;
 
     // The exact command, every run. An encode failure is otherwise reported
     // with ffmpeg's message and nothing about what it was asked to do, and the
@@ -1020,27 +1091,39 @@ export class EncodeRuns {
         // complete input or overwrite a neighboring run's segment.
         if (Number.isInteger(index) && (index < safeIndex || index > run.to)) return null;
         let bytes = null;
-        if (admittedInput && session.segmentFormat.id === "fmp4" && session.spec.carries !== "audio-only" &&
-          (admittedInput.original || session.spec.audio && !this.#host.servesAudioSeparately(session))) {
+        const address = session.outputKey ?? "";
+        const fmp4 = admittedInput && session.segmentFormat.id === "fmp4" && session.spec.carries !== "audio-only";
+        // The first piece of a run that read the picture from its keyframe:
+        // its leading pictures are the ones the run before made, or none.
+        const firstOfRun = fmp4 && this.#copiesOriginalPicture(session, admittedInput) &&
+          index === run.from && index > 0 && !fromKeyframeBefore;
+        const soundInPiece = fmp4 && session.spec.audio && !this.#host.servesAudioSeparately(session);
+        if (firstOfRun || soundInPiece) {
           try {
-            const address = session.outputKey ?? "";
             const grid = session.timeline.published ?? session.timeline.boundaries;
-            bytes = presentationSegment(this.#host.segmentFiles.closedBytesOf(address, name),
-              following ? this.#host.segmentFiles.closedBytesOf(address, following) : null,
-              { from: grid[index], to: grid[index + 1] });
+            const raw = this.#host.segmentFiles.closedBytesOf(address, name);
+            const leading = firstOfRun ? this.#leadingByOutput.get(address)?.get(index) ?? null : null;
+            bytes = presentationSegment(raw, soundInPiece && following ? this.#host.segmentFiles.closedBytesOf(address, following) : null,
+              { from: grid[index], to: grid[index + 1] }, { firstOfRun, leading });
           } catch (error) {
-            this.#host.logger.warn(`encode: could not partition closed segment ${index}: ${error.message}`);
+            this.#host.logger.warn(`encode: could not prepare closed segment ${index}: ${error.message}`);
             throw error;
           }
         }
-        const mediaRanges = this.#wholeClosedPiece(session, name, index, admittedInput, bytes, run, timing);
+        const mediaRanges = this.#wholeClosedPiece(session, name, index, admittedInput, bytes, run, timing, following);
         if (mediaRanges === false) throw Object.assign(new Error(`Closed piece #${index} has incomplete media.`),
           { code: "ERR_INCOMPLETE_MEDIA" });
-        const published = this.#host.segmentFiles.publish(session.outputKey ?? "", name, session.segmentFormat, { mediaRanges, bytes });
+        const published = this.#host.segmentFiles.publish(address, name, session.segmentFormat, { mediaRanges, bytes });
         if (!published) throw new Error(`Closed piece #${index} could not be stored.`);
+        this.#leadingByOutput.get(address)?.delete(index);
         return published;
 
       },
+      // A file closed past the run's last cut, or flushed when it was stopped:
+      // never published, but it begins with the next keyframe, made with the
+      // group before it in hand — the leading pictures the run that starts
+      // there cannot make.
+      onTail: (name) => this.#keepLeadingPictures(session, admittedInput, name),
       onSpeedMeasured: () => this.#host.noteRunSpeedMeasured?.(session, run),
       onEnded: (ended) => {
         this.#runsByInputToken.delete(inputToken);

package/services/encode/piece-completeness.js

@@ -53,14 +53,15 @@ export function judgePiece(format, ranges, cutSeconds, interval) {
   }
   const shift = Number.isFinite(ranges?.cutShiftSeconds) ? ranges.cutShiftSeconds : 0;
   if (interval) {
-    const reason = intervalFailure(ranges, { ...interval, shift });
+    const reason = intervalFailure(ranges, { ...interval, shift, nextLeadingSeconds: leadingOfNext(ranges) });
     return reason ? { whole: false, throughSeconds, reason } : { whole: true, throughSeconds };
   }
   const cutMicros = Number.isFinite(cutSeconds) ? BigInt(Math.round((cutSeconds + shift) * 1_000_000)) : null;
   if (cutMicros !== null && ranges?.tracks?.length) {
-    const whole = ranges.tracks.every(({ timescale, ranges: held, positionErrorTicks = 0n }) => {
+    const leadMicros = BigInt(Math.round(leadingOfNext(ranges) * 1_000_000));
+    const whole = ranges.tracks.every(({ kind, timescale, ranges: held, positionErrorTicks = 0n }) => {
       const end = held.at(-1)?.end;
-      return end !== undefined && (end + positionErrorTicks) * 1_000_000n >= cutMicros * timescale;
+      return end !== undefined && (end + positionErrorTicks) * 1_000_000n >= (cutMicros - (kind === "vide" ? leadMicros : 0n)) * timescale;
     });
     return { whole, throughSeconds };
   }
@@ -71,26 +72,51 @@ export function judgePiece(format, ranges, cutSeconds, interval) {
 }
 
 /**
- * Put a piece on the clock it was cut by, for {@link judgePiece}.
+ * How long a picture's leading pictures are shown before it: the span from the
+ * first presented picture of a piece to its first decoded one, which for a
+ * copied picture is its keyframe. Zero without a picture or leading pictures.
  *
- * The run's cut shift ({@link cutShiftOf}) says where the segment MUXER counts
- * its cuts from, so it belongs only to a piece the muxer cut. A copied picture
- * read from the original file is cut again by the proxy, by presentation time
- * at the published grid (`presentationSegment`), and that piece is judged on
- * the grid as published. Field 2026-10-11, torrent-tv/meta#178: an open-GOP
- * HEVC piece cut again at 2511.676..2521.686 holds the next keyframe, which its
- * leading pictures need, and so ends one frame (672 of 16 000 ticks) past the
- * cut, as it must; moved by the muxer's shift of −0.001 s the allowance ended
- * one millisecond before that frame, the piece was refused and playback ended.
+ * In an open GOP the pictures decoded right after a keyframe can be shown
+ * before it. They belong to the piece of their keyframe, so the piece before
+ * ends that much before its cut and this piece begins that much before it
+ * (torrent-tv/meta#178). A piece states the next keyframe's span as
+ * `nextLeadingSeconds`, read from the piece the muxer closed after it.
  *
- * @param {object | null | undefined} ranges - The piece's media intervals.
- * @param {number | null} shift - The run's cut shift, or null when not known.
- * @param {boolean} cutByProxy - Whether the proxy cut the piece again.
- * @returns {object | null | undefined} The same intervals.
+ * @param {object | null | undefined} ranges - A piece's media intervals.
+ * @returns {number}
  */
-export function onItsCutClock(ranges, shift, cutByProxy) {
-  if (ranges && !cutByProxy && Number.isFinite(shift)) ranges.cutShiftSeconds = shift;
-  return ranges;
+export function leadingSecondsOf(ranges) {
+  const track = ranges?.tracks?.find(candidate => candidate.kind === "vide");
+  const first = track?.ranges?.[0];
+  if (!first || track.firstSampleStart === undefined || !(track.timescale > 0n)) return 0;
+  const lead = track.firstSampleStart - first.start;
+  return lead > 0n ? Number(lead) / Number(track.timescale) : 0;
+}
+
+/**
+ * Whether the only gap between two adjacent pieces is the right one's leading
+ * pictures, which it lacks: it begins at its keyframe, and the gap is the span
+ * the left one states it ends short by, within a frame. A run that starts at a
+ * keyframe cannot make those pictures and none was left by a run before it, so
+ * the picture stands that long — known, and no fault of either piece.
+ *
+ * @param {object} left
+ * @param {object} right
+ * @returns {boolean}
+ */
+export function lacksOnlyItsLeadingPictures(left, right) {
+  const before = left?.tracks?.find(track => track.kind === "vide");
+  const after = right?.tracks?.find(track => track.kind === "vide");
+  if (!before?.ranges?.length || !after?.ranges?.length || before.timescale !== after.timescale || leadingSecondsOf(right) !== 0) return false;
+  const lead = BigInt(Math.round(leadingOfNext(left) * Number(before.timescale)));
+  const gap = after.ranges[0].start - before.ranges.at(-1).end;
+  const frame = before.productionFrame ?? before.ranges.at(-1).frame;
+  return lead > 0n && gap > 0n && gap - lead <= frame && lead - gap <= frame;
+}
+
+/** The span a piece ends before its cut: the next keyframe's leading pictures. */
+function leadingOfNext(ranges) {
+  return Number.isFinite(ranges?.nextLeadingSeconds) && ranges.nextLeadingSeconds > 0 ? ranges.nextLeadingSeconds : 0;
 }
 
 /**
@@ -166,13 +192,14 @@ export function judgeNeighbors(left, right) {
  * soundtrack's at 1419.904 s against a final cut of 1419.993 s, and both last
  * pieces were refused, so no viewer could reach the end of the episode.
  */
-function intervalFailure(coverage, { from, to, requiredKinds, sourceEnds = {}, shift = 0, endsWithSource = false }) {
+function intervalFailure(coverage, { from, to, requiredKinds, sourceEnds = {}, shift = 0, endsWithSource = false, nextLeadingSeconds = 0 }) {
   if (!Number.isFinite(from) || !Number.isFinite(to) || !(to > from) || !requiredKinds?.length) return "segment-interval-is-not-declared";
   for (const kind of requiredKinds) {
     const track = coverage?.tracks?.find(track => track.kind === kind);
     if (!track?.ranges?.length || !(track.timescale > 0n)) return `segment-missing-${kind}`;
     const start = BigInt(Math.round((from + shift) * Number(track.timescale)));
-    const through = Number.isFinite(sourceEnds[kind]) ? Math.min(to + shift, sourceEnds[kind]) : to + shift;
+    const cutAt = to + shift - (kind === "vide" && !endsWithSource ? nextLeadingSeconds : 0);
+    const through = Number.isFinite(sourceEnds[kind]) ? Math.min(cutAt, sourceEnds[kind]) : cutAt;
     if (!(through > from + shift)) return `segment-interval-is-empty-${kind}`;
     const end = BigInt(Math.round(through * Number(track.timescale)));
     const first = track.ranges[0];
@@ -181,7 +208,11 @@ function intervalFailure(coverage, { from, to, requiredKinds, sourceEnds = {}, s
     // cadence. Account for that recorded position uncertainty at the boundary,
     // without admitting another missing frame or widening internal gaps.
     const positionError = track.positionErrorTicks ?? 0n;
-    if (first.start > start + frame + positionError || first.start < start - frame - positionError) return `segment-start-outside-interval-${kind}`;
+    // A piece starts at its first DECODED sample — a copied picture's keyframe;
+    // pictures shown before it are its leading pictures, and the walk below
+    // holds them to the same continuity as every other range.
+    const anchor = track.firstSampleStart ?? first.start;
+    if (anchor > start + frame + positionError || anchor < start - frame - positionError) return `segment-start-outside-interval-${kind}`;
     // The first sample's cadence already bounds the interval start. A shorter
     // final sample must not replace that bound when this range is traversed.
     let reached = first.start;

package/services/encode/quality/HostLoad.js

@@ -89,6 +89,11 @@ export class HostLoad {
   /**
    * @param {object} host - `liveRunsOf`, `runStateOf`, the readings of `encode/host-load.js` (`readMachineState`, `readProcessCpuSeconds`, `readProxyCpuSeconds`, `readSystemCpu`, `shareOfMachine`), `getSourceStats`, `getTorrentTotals`, `outputs`
    */
+  /** The share of one core this process draws doing nothing priced; zero until measured. */
+  get baseDraw() {
+    return this.#observedBaseDraw ?? 0;
+  }
+
   constructor(host) {
     this.#host = host;
   }

package/services/encode/segment-formats/presentation-segment.js

@@ -1,48 +1,165 @@
 import { readTrackEdits, walkBoxes } from "./mp4-boxes.js";
 
-/** Repartition closed muxer output by presentation interval, preserving decode order. */
-export function presentationSegment(current, following, { from, to }) {
+/**
+ * A closed piece as it is served.
+ *
+ * THE PICTURE STAYS CUT WHERE THE MUXER CUT IT: from its keyframe to the next,
+ * in decode order. In an open GOP the pictures decoded right after a keyframe
+ * can be shown before it — its leading pictures — and they reference the
+ * group before; they belong to the piece of their keyframe and are shown a
+ * little before its cut. Moving them into the previous piece with a copy of
+ * the keyframe (torrent-tv/meta#154) left a hole on every such cut: appending
+ * the next piece replaces that copy, and Media Source coded frame processing
+ * then removes every frame decoded after it up to the next random access point
+ * — the leading pictures. Measured in Chrome Canary 2026-10-11 on the pieces
+ * of a 1036p HEVC film: a hole of 0.292 s at 74.283 s; with the muxer's cut the
+ * buffer is continuous (torrent-tv/meta#178).
+ *
+ * A SOUNDTRACK carried in the same piece is cut by presentation time at the
+ * published grid, taking from the following piece what belongs before the cut.
+ *
+ * THE FIRST PIECE OF A RUN that started at its keyframe has leading pictures
+ * the run could not make: their references lie before the start, and FFmpeg,
+ * having no earlier packets, gives them presentation times at its own decode
+ * clock (74.2000 s for pictures shown at 73.991-74.241 s). They are removed,
+ * and where `leading` — the same keyframe's leading pictures from the run that
+ * made the piece before, which FFmpeg closes past that run's last cut — is
+ * given, those are put in their place on that run's decode clock.
+ *
+ * @param {Buffer} current - The closed piece, with its own init.
+ * @param {Buffer | null} following - The piece the muxer closed after it.
+ * @param {{ from: number, to: number }} interval - The piece's published stretch.
+ * @param {{ firstOfRun?: boolean, leading?: Buffer | null }} [options]
+ * @returns {Buffer}
+ */
+export function presentationSegment(current, following, { from, to }, { firstOfRun = false, leading = null } = {}) {
   const own = packetsOf(current);
   const next = following ? packetsOf(following) : null;
+  const before = leading ? packetsOf(leading) : null;
+  // A piece given the leading pictures of the run before is written on that
+  // run's clock, under its init: that run decoded the group before the
+  // keyframe, so its decode times lie earlier than this run's, and a decode
+  // time cannot lie before the clock's origin. Every track moves by the
+  // difference of the two inits' positions.
+  const spliced = firstOfRun && before ? splicedPicture(own, before) : null;
+  const clock = spliced ? before : own;
   const tracks = [];
   for (const [id, track] of own.tracks) {
     const edit = own.edits.get(id);
     if (!edit) throw new Error("A segment track has no declared clock.");
-    const samples = [...track.samples];
+    const move = spliced ? edit.offset - clock.edits.get(id).offset : 0n;
+    if (track.kind === "vide") {
+      const samples = spliced?.id === id ? spliced.samples : firstOfRun ? withoutLeading(track.samples, edit) : track.samples;
+      tracks.push({ id, samples: spliced?.id === id ? samples : samples.map(sample => ({ ...sample, dts: sample.dts + move })),
+        timedByDecode: firstOfRun });
+      continue;
+    }
+    const samples = [...track.samples].map(sample => ({ ...sample, dts: sample.dts + move }));
     if (next?.tracks.has(id)) {
       const nextEdit = next.edits.get(id);
       if (!nextEdit || nextEdit.timescale !== edit.timescale) throw new Error("Adjacent segment clocks differ.");
       for (const sample of next.tracks.get(id).samples) {
-        samples.push({ ...sample, dts: sample.dts + nextEdit.offset - edit.offset });
+        samples.push({ ...sample, dts: sample.dts + nextEdit.offset - edit.offset + move });
       }
     }
     const start = BigInt(Math.round(from * Number(edit.timescale)));
     const end = BigInt(Math.round(to * Number(edit.timescale)));
-    const wanted = samples.filter(sample => {
-      const pts = sample.dts + sample.composition + edit.offset;
-      return pts < end && (track.kind === "vide" ? pts >= start : pts + sample.duration > start);
+    const offset = clock.edits.get(id).offset;
+    const selected = samples.filter(sample => {
+      const pts = sample.dts + sample.composition + offset;
+      return pts < end && pts + sample.duration > start;
     });
-    if (!wanted.length) throw new Error("A presentation segment lacks required media.");
-    // An open-GOP picture before the cut can follow the next CRA in decode
-    // order. Retain the reference pictures through its last required DTS;
-    // dropping the CRA would make the recovered leading pictures undecodable.
-    const lastDecode = wanted.reduce((last, sample) => sample.dts > last ? sample.dts : last, -1n);
-    const firstDecode = wanted.reduce((first, sample) => first === null || sample.dts < first ? sample.dts : first, null);
-    const selected = track.kind === "vide" ? samples.filter(sample =>
-      sample.dts >= firstDecode && sample.dts <= lastDecode && sample.dts + sample.composition + edit.offset >= start) : wanted;
+    if (!selected.length) throw new Error("A presentation segment lacks required media.");
     selected.sort((left, right) => left.dts < right.dts ? -1 : left.dts > right.dts ? 1 : 0);
     tracks.push({ id, samples: selected });
   }
+  return writePiece(clock.init, tracks);
+}
+
+/**
+ * The leading pictures of a piece's keyframe, as a piece of their own (the
+ * keyframe and the pictures decoded right after it that are shown before it),
+ * or null when the keyframe has none. Kept from a run's flushed file past its
+ * last cut for the run that starts at that keyframe.
+ *
+ * @param {Buffer} piece - A closed file, with its own init.
+ * @returns {Buffer | null}
+ */
+export function leadingPictures(piece) {
+  const own = packetsOf(piece);
+  const tracks = [];
+  for (const [id, track] of own.tracks) {
+    if (track.kind !== "vide") continue;
+    const edit = own.edits.get(id);
+    const count = leadingCount(track.samples, edit);
+    if (count > 0) tracks.push({ id, samples: track.samples.slice(0, count + 1) });
+  }
+  return tracks.length ? writePiece(own.init, tracks) : null;
+}
+
+/** How many pictures decoded right after the first one are shown before it. */
+function leadingCount(samples, edit) {
+  const first = samples[0];
+  if (!first || (first.flags & SAMPLE_IS_NON_SYNC) !== 0) return 0;
+  const shown = first.dts + first.composition + edit.offset;
+  let count = 0;
+  while (count + 1 < samples.length) {
+    const sample = samples[count + 1];
+    if (sample.dts + sample.composition + edit.offset >= shown) break;
+    count += 1;
+  }
+  return count;
+}
+
+/** A run's first picture samples without the leading pictures it could not make. */
+function withoutLeading(samples, edit) {
+  return [samples[0], ...samples.slice(1 + leadingCount(samples, edit))];
+}
+
+/**
+ * The picture of a run's first piece with its own leading pictures replaced by
+ * the run before's, on the run before's clock: its keyframe and leading
+ * pictures as that run decoded them, then this run's pictures from the first
+ * one after them. Null — and the leading pictures are only removed — where the
+ * two do not begin with the same keyframe, the clocks differ, any track has no
+ * position in the other init, or the decode order would not move forward.
+ */
+function splicedPicture(own, before) {
+  for (const [id, track] of own.tracks) {
+    if (track.kind !== "vide") continue;
+    const edit = own.edits.get(id);
+    const theirs = before.tracks.get(id)?.samples;
+    const theirEdit = before.edits.get(id);
+    if (!edit || !theirs || theirs.length < 2 || !theirEdit || theirEdit.timescale !== edit.timescale) return null;
+    if ([...own.tracks.keys()].some(other => !before.edits.has(other))) return null;
+    const keyframe = track.samples[0];
+    if (keyframe.dts + keyframe.composition + edit.offset !== theirs[0].dts + theirs[0].composition + theirEdit.offset ||
+      !keyframe.bytes.equals(theirs[0].bytes)) return null;
+    const move = edit.offset - theirEdit.offset;
+    const rest = track.samples.slice(1 + leadingCount(track.samples, edit)).map(sample => ({ ...sample, dts: sample.dts + move }));
+    if (rest.length && theirs.at(-1).dts >= rest[0].dts) return null;
+    return { id, samples: [...theirs, ...rest] };
+  }
+  return null;
+}
+
+/** `sample_is_non_sync_sample` in the sample flags of ISO/IEC 14496-12. */
+const SAMPLE_IS_NON_SYNC = 0x10000;
+
+function writePiece(init, tracks) {
   const makeMoof = offset => box("moof", full("mfhd", 0, 0, u32(1)), ...tracks.map(track => {
     let decodeTime = track.samples[0].dts;
-    const entries = track.samples.map(sample => {
-      // Removing leading pictures can leave a gap in decode timestamps.
-      // trun advances by durations only; retain each original presentation
-      // timestamp relative to the decode clock actually written here.
+    const entries = track.samples.map((sample, index) => {
+      // A picture taken from another run's decode clock keeps that clock, so
+      // its duration in decode order is the step to the next decode time. Any
+      // other sample keeps its own duration, and its presentation time is kept
+      // relative to the decode clock actually written here.
+      const following = track.samples[index + 1];
+      const duration = track.timedByDecode && following ? following.dts - sample.dts : sample.duration;
       const composition = sample.dts + sample.composition - decodeTime;
-      decodeTime += sample.duration;
+      decodeTime += duration;
       return Buffer.concat([
-        u32(Number(sample.duration)), u32(sample.bytes.length), u32(sample.flags), i32(Number(composition))
+        u32(Number(duration)), u32(sample.bytes.length), u32(sample.flags), i32(Number(composition))
       ]);
     });
     const payload = Buffer.concat([u32(track.samples.length), i32(offset), ...entries]);
@@ -52,7 +169,7 @@ export function presentationSegment(current, following, { from, to }) {
     return box("traf", full("tfhd", 0, 0x20000, u32(track.id)), full("tfdt", 1, 0, clock), full("trun", 1, 0xf01, payload));
   }));
   const size = makeMoof(0).length;
-  return Buffer.concat([own.init, makeMoof(size + 8), box("mdat", ...tracks.flatMap(track => track.samples.map(sample => sample.bytes)))]);
+  return Buffer.concat([init, makeMoof(size + 8), box("mdat", ...tracks.flatMap(track => track.samples.map(sample => sample.bytes)))]);
 }
 
 function packetsOf(raw) {

package/services/server/wire-outputs.js

@@ -97,6 +97,9 @@ import path from "node:path";
 import { contentOf, LocalObservations, PROXY_ROOT } from "../encode/LocalObservations.js";
 import { configurationKeyOf } from "../encode/fingerprint.js";
 import { qualityStateOf } from "../encode/quality/OutputQualityState.js";
+import os from "node:os";
+import { downloadShare } from "../storage/processor-share.js";
+import { ENCODE_RUN_STATE, processCanBeSignalled } from "../encode/encode-run-state.js";
 
 // Where a variant and an audio rendition live under a session — `v/<height>/…`
 // and `a/<track>/…` — is stated in `encode/output/playlists.js`, beside the lines that
@@ -193,6 +196,7 @@ export function wireOutputs({
     decodeCostModel = null,
     getSourceStats = null,
     setPriorityMap = null,
+    setDownloadRate = null,
     // What a second job costs on this host, measured at startup. Null when it
     // could not be measured, and then nothing is corrected — the alternative
     // is inventing a penalty, which is the same fault as inventing a fill rate.
@@ -342,7 +346,7 @@ export function wireOutputs({
     get encoders() { return parts.encoders; },
     invalidateWaits: (output) => parts.serving.invalidateWaits(output),
     productionFailed: (output) => parts.renditions.noteProductionFailed(output),
-    encodersChanged: () => onEncodersChanged?.(),
+    encodersChanged: () => { parts.applyDownloadShare?.(); onEncodersChanged?.(); },
   });
   // How much film is ready in front of the viewers, said; and the spare soundtracks fetched once it is full.
   parts.cushion = new CushionReport({
@@ -648,6 +652,31 @@ export function wireOutputs({
   // (sourceKey, fileIndex) => Promise<{ downloadSpeed, fileLength, fileProgress } | null>.
   parts.getSourceStats = typeof getSourceStats === "function" ? getSourceStats : null;
   parts.setPriorityMap = typeof setPriorityMap === "function" ? setPriorityMap : null;
+  parts.setDownloadRate = typeof setDownloadRate === "function" ? setDownloadRate : null;
+  // HOW FAST THE TORRENTS MAY DOWNLOAD: the processor the encoders leave
+  // (`storage/processor-share.js`, torrent-tv/meta#178). Worked out again
+  // when the machine is read and when an encoder starts or ends, over every
+  // watched file of every torrent.
+  parts.applyDownloadShare = () => {
+    if (!parts.setDownloadRate || !parts.hostLoad || !parts.encodeCost) return;
+    const files = new Map();
+    for (const output of parts.outputs.values()) {
+      if (!(parts.viewers?.forOutput(output)?.size > 0)) continue;
+      const key = output.file.key;
+      const length = Number(output.file.lengthBytes ?? parts.hostLoad.fileLengthByKey.get(key));
+      const file = files.get(key) ?? { bytesPerFilmSecond: length / Number(output.file.durationSeconds), encodeCostSec: 0 };
+      const state = parts.encodeRuns.runStateOf(output);
+      if (processCanBeSignalled(state) && state !== ENCODE_RUN_STATE.SUSPENDED) {
+        file.encodeCostSec += parts.encodeCost.loadOfOutput(output.outputKey)?.costSec ?? 0;
+      }
+      files.set(key, file);
+    }
+    const watched = [...files.values()].filter((file) => Number.isFinite(file.bytesPerFilmSecond) && file.bytesPerFilmSecond > 0);
+    const share = downloadShare({ cores: os.cpus().length, availableShare: parts.hostLoad.hostAvailability?.share ?? 1,
+      baseDraw: parts.hostLoad.baseDraw, costPerMegabyte: parts.hostLoad.observedTorrentCostPerMegabyte, files: watched });
+    void Promise.resolve(parts.setDownloadRate(share.bytesPerSecond, `film speed ${share.filmSpeed.toFixed(2)}x ` +
+      `over ${watched.length} file(s), ${share.capacity.toFixed(2)} core(s) for the proxy`)).catch(() => {});
+  };
   parts.contentionPenalties = contentionPenalties instanceof Map ? contentionPenalties : null;
   // Seconds of film per second when the picture is COPIED, measured at
   // startup. Nothing else prices that branch: the other benchmarks measure
@@ -1060,7 +1089,7 @@ export function wireOutputs({
     liveConsumers: (...args) => parts.renditions.liveConsumers(...args),
     liveRunsOf: (...args) => parts.encodeRuns.liveRunsOf(...args),
     producedNumbers: (...args) => parts.serving.producedNumbers(...args),
-    reportHostLoad: (...args) => parts.hostLoad.reportHostLoad(...args),
+    reportHostLoad: async (...args) => { await parts.hostLoad.reportHostLoad(...args); parts.applyDownloadShare?.(); },
     runStateOf: (...args) => parts.encodeRuns.runStateOf(...args),
     sampleDownloadRates: (...args) => parts.hostLoad.sampleDownloadRates(...args),
     get encodeCost() { return parts.encodeCost; },

package/services/storage/processor-share.js

@@ -0,0 +1,52 @@
+/**
+ * @file How fast the torrents may download, so that downloading does not take
+ * the processor the encoders need (torrent-tv/meta#178).
+ *
+ * Field 2026-10-11, Home Assistant: an AVI re-encoded at 720x400 needs 2.3 s
+ * of processor per second of film. While the torrent downloaded 4.5-9.8 MB/s —
+ * mostly far ahead of the viewer — its thread took 56-63 % of a core, ffmpeg
+ * got 176-182 %, below real time, and the viewer saw the spinner; once the
+ * download stopped ffmpeg got 216-261 % and there were no stops.
+ *
+ * THE MODEL. The processor the proxy has, `C`, is what other processes leave
+ * of every core, less what the proxy draws doing nothing priced. Every watched
+ * file `f` of every torrent advances at a film speed `s`: its encoders take
+ * `s·k_f` (seconds of processor per second of film, as measured for the
+ * encoders running now) and its download `s·w_f·c` (`w_f` its bytes per second
+ * of film, `c` the measured processor per byte moved). One speed for all is
+ * the division under which the slowest file is as fast as it can be:
+ *
+ *     s* = C / Σ_f (k_f + w_f·c),    download rate = max(s*, 1) · Σ_f w_f
+ *
+ * Downloading faster than `s*·w` only piles bytes ahead while the encoders
+ * starve; what is fetched first within the rate is the priority map's order.
+ * The rate never falls below the films' own byte rate, `Σ w`, because below it
+ * the viewer stops whatever the encoders get. Where `s* < 1` or the swarm
+ * gives less than the rate, stops cannot be avoided, and the start forecast,
+ * reading the speeds measured under this rate, waits for them at the start
+ * and after a seek. With nothing encoding `k` is zero and the download has the
+ * processor. A term nobody has measured contributes nothing: an unmeasured
+ * price of a byte leaves the download unlimited.
+ */
+
+/**
+ * @param {object} params
+ * @param {number} params.cores
+ * @param {number} params.availableShare - The share of the machine other processes leave, 0..1.
+ * @param {number} params.baseDraw - Processor the proxy draws doing nothing priced, in cores.
+ * @param {number | null} params.costPerMegabyte - Processor seconds per megabyte the torrent moves.
+ * @param {{ bytesPerFilmSecond: number, encodeCostSec: number }[]} params.files - Watched files.
+ * @returns {{ filmSpeed: number, bytesPerSecond: number, capacity: number }}
+ *   `bytesPerSecond` is Infinity where the download is not limited.
+ */
+export function downloadShare({ cores, availableShare, baseDraw, costPerMegabyte, files }) {
+  const capacity = Math.max(0, cores * availableShare - baseDraw);
+  // A byte whose price is not measured, or costs nothing, takes nothing from
+  // the encoders: there is then no share to keep the download to.
+  const perByte = Number.isFinite(costPerMegabyte) && costPerMegabyte > 0 ? costPerMegabyte / 1e6 : 0;
+  const bytes = files.reduce((sum, file) => sum + file.bytesPerFilmSecond, 0);
+  const demand = files.reduce((sum, file) => sum + file.encodeCostSec + file.bytesPerFilmSecond * perByte, 0);
+  const filmSpeed = capacity / demand;
+  const bytesPerSecond = perByte > 0 ? Math.max(filmSpeed, 1) * bytes : Infinity;
+  return { filmSpeed, capacity, bytesPerSecond: Number.isFinite(bytesPerSecond) && bytes > 0 ? bytesPerSecond : Infinity };
+}

package/services/torrent/torrent-pool.js

@@ -1261,6 +1261,35 @@ export class TorrentPool {
    *   film against a number, highest first in urgency.
    * @param {number} durationSeconds
    */
+  /**
+   * How fast every torrent may download in all: the share of the processor
+   * the encoders leave (`storage/processor-share.js`, torrent-tv/meta#178).
+   * Within it the swarm is asked for what the priority map puts first.
+   *
+   * @param {number | null} bytesPerSecond - Infinity or null for no limit.
+   * @param {string} [because]
+   */
+  setDownloadRate(bytesPerSecond, because = "") {
+    if (!this.client || this.client.destroyed || typeof this.client.throttleDownload !== "function") return;
+    const rate = Number.isFinite(bytesPerSecond) ? Math.max(1, Math.round(bytesPerSecond)) : -1;
+    if (rate === this.#downloadLimit) return;
+    this.client.throttleDownload(rate);
+    // Said when the limit is set or lifted, and when it moves by a factor of
+    // two either way — the scale on which a limit changes what the swarm gives.
+    const scale = rate < 0 ? null : Math.round(Math.log2(rate));
+    if (scale !== this.#downloadLimitScale) {
+      this.#downloadLimitScale = scale;
+      logger.info(`torrent-pool: download limit -> ${rate < 0 ? "none" : `${Math.round(rate / 1024)} KB/s`}${because ? ` (${because})` : ""}`);
+    }
+    this.#downloadLimit = rate;
+  }
+
+  /** The download limit in force, -1 for none. */
+  #downloadLimit = -1;
+
+  /** The power of two the last limit said was nearest, null for none. */
+  #downloadLimitScale = null;
+
   applyPriorityMap(torrent, fileIndex, zones, durationSeconds) {
     // A MAP WITH NOTHING IN IT IS A STATEMENT, and it is answered before
     // anything else is looked at. It says nobody wants any of this file, and

package/services/torrent/worker/client.js

@@ -475,6 +475,17 @@ export class TorrentWorkerClient {
    * @param {{ sourceKey: string, fileIndex: number, durationSeconds: number, zones: { from: number, to: number, priority: number }[] }} params
    * @returns {Promise<void>}
    */
+  /**
+   * How fast the torrents may download in all (`Command.DOWNLOAD_RATE`).
+   *
+   * @param {number} bytesPerSecond - Infinity for no limit.
+   * @param {string} [because]
+   * @returns {Promise<void>}
+   */
+  async setDownloadRate(bytesPerSecond, because = "") {
+    return this.#caller.call(Command.DOWNLOAD_RATE, { bytesPerSecond: Number.isFinite(bytesPerSecond) ? bytesPerSecond : null, because });
+  }
+
   async setPriorityMap({ sourceKey, fileIndex, zones, durationSeconds, postedAt }) {
     return this.#caller.call(Command.PRIORITY_MAP, {
       sourceKey,

package/services/torrent/worker/pool-adapter.js

@@ -164,6 +164,17 @@ export class WorkerTorrentPool {
    * @param {{ sourceKey: string, fileIndex: number, durationSeconds: number, zones: object[] }} params
    * @returns {Promise<void>}
    */
+  /**
+   * How fast the torrents may download in all, Infinity for no limit.
+   *
+   * @param {number} bytesPerSecond
+   * @param {string} [because]
+   * @returns {Promise<void>}
+   */
+  async setDownloadRate(bytesPerSecond, because = "") {
+    return this.#client.setDownloadRate(bytesPerSecond, because);
+  }
+
   async setPriorityMap({ sourceKey, fileIndex, durationSeconds, zones, postedAt }) {
     if (!sourceKey) {
       return;

package/services/torrent/worker/protocol.js

@@ -66,6 +66,12 @@ export const Command = {
    * sixteen pieces is what tore a film apart on 2026-09-05.
    */
   PRIORITY_MAP: "priority-map",
+  /**
+   * How fast the torrents may download in all, in bytes per second, or
+   * Infinity for no limit: the share of the processor the encoders leave
+   * (`storage/processor-share.js`, torrent-tv/meta#178).
+   */
+  DOWNLOAD_RATE: "download-rate",
   /** Read a byte range; the body arrives as CHUNK messages. */
   READ_RANGE: "read-range",
   /** Abandon an in-flight READ_RANGE (viewer gone, seek superseded). */

package/services/torrent/worker/worker.js

@@ -476,6 +476,11 @@ async function runCommand(command, params, id) {
       return { appliedMs: performance.now() - startedAt, receivedAt, repliedAt: performance.timeOrigin + performance.now() };
     }
 
+    case Command.DOWNLOAD_RATE: {
+      pool.setDownloadRate(params.bytesPerSecond, params.because);
+      return true;
+    }
+
     case Command.READ_RANGE: {
       // Streams its own reply; the caller's promise resolves once the body has
       // been fully sent, which is what lets the client await completion.