fix(downloads): an upload's conversion is guarded, counted, named and cleaned up

- Every ffmpeg/ffprobe over a library file names the demuxers it may use (edit.INPUT_GUARD; a downloaded thumbnail edit.THUMB_GUARD): a playlist-type demuxer would read local paths named inside a user's upload. - A re-encode ends on an even frame (edit.EVEN_FRAME): an odd 4:4:4/RGB source failed its conversion; a clip stores the frame its file has. - An upload counts against its owner's cap from the moment it lands (queued, or kept after a failed conversion) — the footprint, the GC's cap and the admin view read one ON_DISK predicate — and a conversion that outgrows the cap is refused, keeping the original. - The converted name keeps _a{id} (a dotted bare name once lost it and two uploads shared a file); a converted file placed but not committed is removed, and the orphan sweep enters .uploads; the LRU cap never evicts an upload. - Ingest judges the extension the file is stored under; a failed conversion is convert_failed / upload_missing, reports the "converting" phase, and notifies as an upload. Job statuses in routes/downloads use JobStatus.
2026-10-06 03:19:32 +02:00
parent 00886d92fe
commit 68cfc7e25d
15 changed files with 892 additions and 68 deletions
@@ -0,0 +1,62 @@
+import { Component, type ErrorInfo, type ReactNode } from "react";
+import { errorAttrs, log } from "../lib/log";
+import { reloadingForNewBuild } from "../lib/staleBuild";
+import { Button } from "./ui/Button";
+
+export interface CrashCopy {
+  title: string;
+  subtitle: string;
+  reload: string;
+}
+
+interface Props {
+  children: ReactNode;
+  /** Read at crash time, so the screen speaks the language active then. */
+  copy: () => CrashCopy;
+  /** What the entry does beyond the log line (the app keeps a fatal notice in its center). */
+  onCrash?: () => void;
+}
+interface State {
+  crashed: boolean;
+}
+
+// Catches render-time crashes anywhere in the tree, logs them and offers a reload. Free of the app's
+// i18n and notification store, so the public /watch entry wraps its page in it without loading
+// either; `ErrorBoundary` is the app's wrapper around it.
+export class CrashBoundary extends Component<Props, State> {
+  state: State = { crashed: false };
+
+  static getDerivedStateFromError(): State {
+    return { crashed: true };
+  }
+
+  componentDidCatch(error: Error, info: ErrorInfo) {
+    // The tab is already reloading onto a newer build (lib/staleBuild): this is the chunk it could not
+    // load, not a crash — no fatal notice, which would outlive the reload.
+    if (reloadingForNewBuild()) return;
+    log.fatal("ui.crash", "the app crashed while rendering", {
+      ...errorAttrs(error),
+      ...(info.componentStack ? { component_stack: info.componentStack } : {}),
+    });
+    this.props.onCrash?.();
+  }
+
+  render() {
+    if (this.state.crashed) {
+      if (reloadingForNewBuild()) return null;
+      const copy = this.props.copy();
+      return (
+        <div className="min-h-dvh grid place-items-center text-muted p-6 text-center">
+          <div>
+            <div className="text-lg font-semibold text-fg mb-1">{copy.title}</div>
+            <div className="text-sm mb-3">{copy.subtitle}</div>
+            <Button variant="link" onClick={() => location.reload()} className="text-sm">
+              {copy.reload}
+            </Button>
+          </div>
+        </div>
+      );
+    }
+    return this.props.children;
+  }
+}