fix(website): make the loop tooling refuse what would corrupt a cut

From the review of #980:
- publish-loops refuses an incomplete cut (a loop the site names, or any
  loop in --dir, without all five files) before uploading or writing
  anything.
- publish-loops refuses to rewrite a published cut: it lists the folder in
  R2 and compares each object's ETag, the MD5 of a single-part upload, with
  the local file. Different bytes, or objects --dir lacks, stop the run with
  nothing sent; equal files are skipped, so re-running an interrupted upload
  is safe. Tested on the live cut: 90 files recognised, none re-sent.
- encode-loops writes each output under a temporary name and renames it once
  its encode succeeded, and skips a master only when all five outputs exist,
  rather than trusting a poster that may be all an interrupted run left.
- check-loops gives every CDN request a 15 s deadline, so a stalled
  connection fails its URL instead of holding the workflow.

Author: EtienneLescot

website/scripts/check-loops.mjs

@@ -57,7 +57,8 @@ if (live && problems.length === 0) {
 				let res;
 				for (let attempt = 0; attempt < 2 && !res?.ok; attempt++) {
 					try {
-						res = await fetch(url, { method: "HEAD" });
+						// A stalled connection must fail this URL, not hold the workflow.
+						res = await fetch(url, { method: "HEAD", signal: AbortSignal.timeout(15_000) });
 					} catch (err) {
 						if (attempt === 1) problems.push(`${url}: ${err.message}`);
 					}

website/scripts/media/encode-loops.sh

@@ -12,20 +12,27 @@
 # around 94-98, 23% lighter than x264 at equal quality. Needs an ffmpeg built
 # with libx264, libx265 and libwebp (FFMPEG=..., e.g. `npm i ffmpeg-static`);
 # the LGPL build under crates/thirdparty has neither encoder.
-# A master whose poster already exists in <out dir> is skipped.
+# Each output is written to a temporary name and renamed only once its encode
+# succeeded, so an interrupted run leaves no plausible-looking partial file; a
+# master is skipped only when all five of its outputs are there.
 set -e
 F=${FFMPEG:-ffmpeg}
 S=${1:?masters dir}; O=${2:?out dir}; mkdir -p $O
 for src in $S/*.mp4; do
   slug=${src:t:r}
-  [[ -f $O/$slug-poster.webp ]] && continue
+  outs=($O/$slug-1080-hevc.mp4 $O/$slug-1080-h264.mp4 $O/$slug-720-hevc.mp4 $O/$slug-720-h264.mp4 $O/$slug-poster.webp)
+  all=1; for f in $outs; do [[ -f $f ]] || all=0; done
+  (( all )) && continue
   for h in 1080 720; do
     vf="scale=-2:${h}:flags=lanczos"
     $F -v error -y -i $src -an -vf $vf -c:v libx265 -crf 25 -preset slow -tag:v hvc1 \
-      -x265-params log-level=error:keyint=120:min-keyint=120 -pix_fmt yuv420p -movflags +faststart $O/$slug-$h-hevc.mp4
+      -x265-params log-level=error:keyint=120:min-keyint=120 -pix_fmt yuv420p -movflags +faststart -f mp4 $O/.part-$slug-$h-hevc.mp4
+    mv $O/.part-$slug-$h-hevc.mp4 $O/$slug-$h-hevc.mp4
     $F -v error -y -i $src -an -vf $vf -c:v libx264 -crf 23 -preset veryslow -g 120 -profile:v high -level 4.2 \
-      -pix_fmt yuv420p -movflags +faststart $O/$slug-$h-h264.mp4
+      -pix_fmt yuv420p -movflags +faststart -f mp4 $O/.part-$slug-$h-h264.mp4
+    mv $O/.part-$slug-$h-h264.mp4 $O/$slug-$h-h264.mp4
   done
-  $F -v error -y -i $src -frames:v 1 -vf "scale=1280:-2:flags=lanczos" -c:v libwebp -quality 80 $O/$slug-poster.webp
+  $F -v error -y -i $src -frames:v 1 -vf "scale=1280:-2:flags=lanczos" -c:v libwebp -quality 80 -f webp $O/.part-$slug-poster.webp
+  mv $O/.part-$slug-poster.webp $O/$slug-poster.webp
   echo "$slug done"
 done

website/scripts/media/publish-loops.mjs

@@ -22,6 +22,14 @@
  * a new --cut. Upload BEFORE anything points at the folder: the zone caches a
  * 404 for an hour.
  *
+ * Two refusals, both before anything is uploaded or written:
+ *   - an incomplete cut: every loop the site names (LOOP_NAMES), and every
+ *     loop in <dir>, must have all five files;
+ *   - a rewrite: if the folder already holds objects, each must be byte-equal
+ *     to the local file of the same name (R2's ETag is the MD5 of a single-part
+ *     upload) and the folder must hold nothing <dir> lacks. Equal files are not
+ *     re-sent, so re-running after an interrupted upload is safe.
+ *
  * Needs the `cf` CLI logged in to the account that owns getopenscreen.com, and
  * ffprobe (FFPROBE, or on PATH) for the durations.
  */
@@ -32,6 +40,8 @@ import { existsSync, readdirSync, readFileSync, statSync, writeFileSync } from "
 import { join, resolve } from "node:path";
 import { parseArgs } from "node:util";
 
+import { LOOP_NAMES } from "../../src/lib/demo-loop.ts";
+
 const ROOT = resolve(import.meta.dirname, "../..");
 const BUCKET = "openscreen-media";
 const ORIGIN = "https://media.getopenscreen.com";
@@ -79,8 +89,60 @@ for (const name of names) {
 	}
 }
 
+// ── refuse an incomplete cut ──────────────────────────────────────────────
+const VARIANTS = ["1080-hevc.mp4", "1080-h264.mp4", "720-hevc.mp4", "720-h264.mp4", "poster.webp"];
+const slugs = new Set([...LOOP_NAMES, ...names.map((n) => FILE.exec(n)[1])]);
+const missing = [...slugs].flatMap((slug) =>
+	VARIANTS.map((v) => `${slug}-${v}`).filter((f) => !files[f]),
+);
+if (missing.length) {
+	console.error(`incomplete cut, nothing uploaded or written:\n  ${missing.join("\n  ")}`);
+	process.exit(1);
+}
+
 if (!opts["no-upload"]) {
+	// ── refuse to rewrite a published cut ───────────────────────────────────
+	const listed = JSON.parse(
+		execFileSync(
+			"cf",
+			[
+				"r2",
+				"objects",
+				"list",
+				"--bucket-name",
+				BUCKET,
+				"--prefix",
+				`loops/${opts.cut}/`,
+				"--per-page",
+				"1000",
+			],
+			{ encoding: "utf8", maxBuffer: 1 << 26 },
+		),
+	);
+	if (listed.length >= 1000)
+		throw new Error("more than 1000 objects under one cut: paginate before trusting this check");
+	const remote = new Map(listed.map((o) => [o.key.slice(`loops/${opts.cut}/`.length), o]));
+	const md5 = (name) =>
+		createHash("md5")
+			.update(readFileSync(join(dir, name)))
+			.digest("hex");
+	const changed = names.filter(
+		(n) => remote.has(n) && remote.get(n).etag.replaceAll('"', "") !== md5(n),
+	);
+	const extra = [...remote.keys()].filter((n) => !files[n]);
+	if (changed.length || extra.length) {
+		console.error(
+			`loops/${opts.cut}/ is already published and differs; a published cut is never rewritten. Use a new --cut.` +
+				(changed.length ? `\n  different bytes: ${changed.join(", ")}` : "") +
+				(extra.length ? `\n  online but not in --dir: ${extra.join(", ")}` : ""),
+		);
+		process.exit(1);
+	}
 	for (const name of names) {
+		if (remote.has(name)) {
+			console.log("already there", name);
+			continue;
+		}
 		execFileSync(
 			"cf",
 			[