Deep-review round 2 of the 2026-09 bug hunt, over the round-1 fix diff.
- A window was LATE by the distance to the keyframe its input seek landed on, and then doubled for
good once the full pass merged in: a cue already running at the window's start came out at a
negative time, and the webvtt muxer's default shifted the whole output so it sat at 0. Measured on
the real Westworld S01E06 at 25:00: every window cue +5.005 s, 682 cues merged instead of 608.
`-avoid_negative_ts disabled` keeps the times exact (the parser reads ffmpeg's signed-field
spelling of a negative time); now 608/608 on that file, and a real-ffmpeg test pins it.
- A full pass that failed was re-armed every minute while the viewer watched what it did publish —
a whole-container read per minute. It now backs off for an hour; windows keep running meanwhile.
- A failed WINDOW set the track's failure memo, so any uncovered position read "failed" — a final
answer that ends the player's poll, even with the full pass about to deliver, and one any account
could plant with an absurd `at`. It now marks only the span it failed to read; "failed" is given
once the full pass AND a window there have both failed.
- Windows join by what they COVER, not a bucketed identity: a backward seek no longer waits behind a
window that cannot cover it, and a playhead crossing a bucket edge no longer queues a second read.
The queue is bounded per track and overall.
- shutdown() sets a flag a worker checks before it spawns ffmpeg (one still in its Plex lookup used to
start a read after the kill sweep); queued-job cancellation and the lifespan call are now tested.
- A window starts where ffmpeg is told to seek (rounded to the ms it gets), a rounded-up millisecond
carries into the minute (no more `00:00:60.000`), a key's first publish claims nothing before its
VTT lands, and `at`/`offset`/`start`/`aoff` refuse non-finite values (`at` also an absurd one).
peter
473d9f02f2