From 7f7341a84176beb4516a6801e16e2eb36557c2c8 Mon Sep 17 00:00:00 2001
From: Dennis Fink
Date: Sat, 9 May 2026 08:34:49 +0200
Subject: feat(core): verify output integrity before replacing original

After ffmpeg exits successfully, run ffprobe against the temporary
output file to confirm it is a valid, playable media file before
replacing the original. If the probe fails the temporary file is removed
and the encode is treated as a runtime failure, leaving the original
untouched.

This guards against cases where ffmpeg exits 0 but has written a
truncated or corrupt container (e.g. due to a disk-full condition
mid-write, a codec bug, or a preset producing an unreadable stream).

The check is enabled by default and can be disabled via
--no-verify-output or [encoding] verify_output = false in config.toml
for large batch jobs on trusted encoders where the extra ffprobe
  round-trip is undesirable.

The --continue flag is honoured: a failed integrity check counts as a
runtime failure for the purposes of deciding whether to proceed to the
next file.

Docs, man page, bash completion, and README updated accordingly.
---
 README.md | 3 +++
 1 file changed, 3 insertions(+)

(limited to 'README.md')

diff --git a/README.md b/README.md
index 95ffb9b..a01de23 100644
--- a/README.md
+++ b/README.md
@@ -153,6 +153,7 @@ quiet   = false
 |---------|-----|------|----------------|
 | `[encoding]` | `preset` | string | `-p` |
 | `[encoding]` | `nice` | integer | `-N` |
+| `[encoding]` | `verify_output` | boolean | `--verify-output` |
 | `[skip]` | `codecs` | array of strings | `-S` (merged with CLI) |
 | `[saving]` | `enabled` | boolean | `-s` |
 | `[saving]` | `file` | string | `--saving-file` |
@@ -178,6 +179,8 @@ transcode.sh [OPTION] [--] FILE...
 |--------|-------------|
 | `-c`, `--continue` | Continue to next file if ffmpeg fails |
 | `--no-continue` | Do not continue with the next file if ffmpeg fails |
+| `--verify-output` | Probe output with ffprobe before replacing original (default) |
+| `--no-verify-output` | Skip the post-encode integrity check |
 | `--config-file FILE`, `--config-file=FILE` | Load configuration from FILE instead of the default path |
 | `-f PATH`, `--encode-file PATH`, `--encodefile=PATH` | Read file list from PATH (one per line) |
 | `-n`, `--dry-run` | Show what would be done; don't run ffmpeg |
-- 
cgit v1.3.1