@torrent-tv/proxy 2.47.0 → 2.49.0

package/CHANGELOG.md

@@ -1,3 +1,15 @@
+## 2.49.0
+
+- **Fix**: The torrent worker is allowed to END rather than being torn down under itself. A core dump read on 2026-08-21 named the fault the proxy has been dying of: `SIGSEGV` in `v8::Value::IsArrayBufferView` reached through `napi_get_buffer_info` from utp-native's `on_utp_accept`, called from its UDP read — all of it inside `node::Environment::CleanupHandles`, under `FreeEnvironment`, on `Worker::Run`. That is a teardown race, not a data fault, which is why neither patch our forked library already carries touched it: a datagram arriving while the environment is being freed walks into an isolate that no longer exists. `destroyAll` called `Worker.terminate()` immediately after destroying the client inside, and `terminate()` frees the environment with libuv's handle callbacks still queued. It now waits for the thread to exit by itself — once the client is destroyed nothing holds its loop open — with `terminate()` kept as a five-second fallback, because a shutdown that hangs is worse than one that is forced.
+- **New**: A worker thread that ends is noticed. Only `message` and `error` were listened for, so when the thread went away the proxy simply stopped and the log ended mid-sentence — five times in three days with not one line to say so, and no way to tell our own shutdown from the thread dying. An `exit` handler now says which of the two it was, and fails everything waiting rather than leaving it hanging.
+- **New**: Core dumps are capped at the newest two at startup. Each is the worker's whole address space — 4.18 GB on the field host — and four of them had nearly filled a 235 GB disk. The newest stay because they are the evidence for the fault still open. `dumpsToRemove` is pure and tested.
+
+## 2.48.0
+
+- **Fix**: A copied picture now begins where it was asked to, so its cuts land on the times its playlist names. ffmpeg's own CLI moves an input seek back by `3*AV_TIME_BASE / 23` — **130.435 ms** — whenever the container does not declare `AVFMT_SEEK_TO_PTS` (Matroska does not) and a stream carries B-frames, which is sound in itself: such containers seek in decode order while the caller asks in presentation order. The consequence for a copy is that asking for a keyframe lands on the one BEFORE it, deterministically; and since `-segment_times` is measured from where the run really began while this code computed those offsets from the time it asked for, every cut of the run inherited one whole keyframe interval. Field 2026-08-20: 119 of 125 segments arriving a uniform 2.002 s early against the 0.5 s hls.js bridges, so every fragment was refused and re-fetched — on 2026-08-17 two of them 1908 times each. The request is now made that much later, bounded by half the distance to the next keyframe. Measured 2026-08-21 on Matroska with keyframes every 2 s: `-ss 10` produced a first segment starting at 8.000, `-ss 10.130435` one starting at 10.000; on MP4, where the heuristic does not fire, 10, 10.130435 and 10.2 all produced 10.000 — right in one case and harmless in the other. Not applied when the picture is re-encoded: a re-encode discards frames up to the requested time and already begins exactly there (`-ss 11` copied starts at 10.000, re-encoded at 11.000).
+- **New**: A run that did not begin where it was asked to says so. The first piece a run produces is the only statement of its real origin that exists, and nothing compared the two — which is why the fault above stayed silent through two releases that touched the same grid. Said once per run, and only past what a player bridges.
+- **Chore**: The tunnel-renewal test shuts its stand-in registry down deterministically. `WebSocketServer.close` waits for every connection to end and a renewal can leave one still closing, so a full suite run could hang for nine minutes on it.
+
 ## 2.47.0
 
 - **Fix**: The tunnel is replaced before anything upstream ends it, so a viewer no longer arrives to find no proxy. Something between the proxy and the server closes the socket after exactly **100 min 15 s** — measured across a day of logs 2026-08-20, three intervals of 100:15 wherever a restart did not reset the clock, `code=1006` each time, and with the 30 s keepalive running throughout, so it is a lifetime cap and not an idle timeout. Reconnecting afterwards takes five seconds during which this proxy does not exist as far as the registry is concerned. The connection is now replaced at ninety minutes and the replacement takes over FIRST: the new socket registers itself, the server atomically supersedes the old one, and only then does the old one close — so there is no instant with nothing registered. A socket that finds itself superseded says so rather than reporting the tunnel as down, and an abrupt close nobody asked for still reconnects as before. Pinned by a test against a real WebSocket server.

package/bin/cli.js

@@ -23,6 +23,7 @@ import { registerClient } from "../services/registry-api.js";
 import { createTunnelClient } from "../services/tunnel-client.js";
 import { createWebRtcManager } from "../services/webrtc-manager.js";
 import { createDataChannelHandler } from "../services/data-channel-handler.js";
+import { pruneCoreDumps } from "../services/core-dumps.js";
 import { collectHealthMetrics } from "../services/health-collector.js";
 import { createPortMapper } from "../services/port-mapper.js";
 import { classifyNat } from "../services/nat-classifier.js";
@@ -294,6 +295,11 @@ try {
   actualPort = started.port;
   const directBaseUrl = explicitBaseUrl || `http://${bindHost}:${actualPort}`;
 
+  // A native fault writes the whole address space out — 4.18 GB each on the
+  // field host, and four of them nearly filled a 235 GB disk. Keep the newest
+  // two, which are the evidence for the fault still open, and drop the rest.
+  void pruneCoreDumps(options.stateDir);
+
   logger.info(`Starting @torrent-tv/proxy v${PROXY_VERSION}`);
   logger.info(`Local stream endpoint: http://${bindHost}:${actualPort}/stream`);
   logger.info(`Advertised direct URL: ${directBaseUrl}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@torrent-tv/proxy",
-  "version": "2.47.0",
+  "version": "2.49.0",
   "description": "Torrent proxy client that exposes webseed-like HTTP stream endpoint.",
   "license": "GPL-3.0-or-later",
   "publishConfig": {

package/services/core-dumps.js

@@ -0,0 +1,106 @@
+/**
+ * @file Keep the last few core dumps and no more.
+ *
+ * A native fault on the torrent worker writes the whole address space out: on
+ * the field host that is **4.18 GB each**, and four of them had nearly filled a
+ * 235 GB disk by 2026-08-21. The dumps are worth having — the one read that day
+ * named a fault three days of reasoning had not — but only the recent ones are,
+ * and a full disk costs more than an old dump is worth.
+ *
+ * Deliberately not "delete them all": the newest are the evidence for the fault
+ * that is still open (roadmap item 7).
+ */
+
+import { readdir, rm, stat } from "node:fs/promises";
+import path from "node:path";
+
+import { logger } from "../utils/logger.js";
+
+/** How many to keep, newest first. */
+export const CORE_DUMPS_KEPT = 2;
+
+/**
+ * Which dumps to remove, given what is there.
+ *
+ * Pure, so the rule can be tested without a filesystem: newest first by the
+ * time they were written, keep `keep`, name the rest.
+ *
+ * @param {Array<{ name: string, writtenAt: number }>} dumps
+ * @param {number} [keep]
+ * @returns {string[]} Names to delete, oldest first.
+ */
+export function dumpsToRemove(dumps, keep = CORE_DUMPS_KEPT) {
+  const sorted = [...(Array.isArray(dumps) ? dumps : [])]
+    .filter((dump) => typeof dump?.name === "string" && Number.isFinite(dump?.writtenAt))
+    .sort((left, right) => right.writtenAt - left.writtenAt);
+  return sorted.slice(Math.max(0, keep)).map((dump) => dump.name).reverse();
+}
+
+/**
+ * Whether a file name is a core dump this host wrote.
+ *
+ * The kernel's pattern on the addon host produces `core.<thread>.<pid>.<epoch>`
+ * — every one seen so far is `core.WorkerThread.81.…`, the thread the torrent
+ * client runs on. Matched loosely on the `core.` prefix so a differently
+ * configured host is still swept.
+ *
+ * @param {string} name
+ * @returns {boolean}
+ */
+export function isCoreDump(name) {
+  return typeof name === "string" && /^core\.[^/\\]+$/.test(name);
+}
+
+/**
+ * Delete all but the newest few core dumps in `dir`.
+ *
+ * Best-effort and never fatal: a proxy that cannot tidy its dumps still has to
+ * serve video.
+ *
+ * @param {string} dir
+ * @param {number} [keep]
+ * @returns {Promise<void>}
+ */
+export async function pruneCoreDumps(dir, keep = CORE_DUMPS_KEPT) {
+  if (typeof dir !== "string" || dir.length === 0) {
+    return;
+  }
+  /** @type {Array<{ name: string, writtenAt: number, bytes: number }>} */
+  const dumps = [];
+  try {
+    for (const name of await readdir(dir)) {
+      if (!isCoreDump(name)) {
+        continue;
+      }
+      try {
+        const info = await stat(path.join(dir, name));
+        if (info.isFile()) {
+          dumps.push({ name, writtenAt: info.mtimeMs, bytes: info.size });
+        }
+      } catch {
+        // silent-ok: it went away between listing and reading, which is the
+        // outcome this function wanted anyway.
+      }
+    }
+  } catch {
+    return; // No such directory, or unreadable. Nothing to tidy.
+  }
+  if (dumps.length === 0) {
+    return;
+  }
+  const doomed = dumpsToRemove(dumps, keep);
+  const freed = dumps
+    .filter((dump) => doomed.includes(dump.name))
+    .reduce((total, dump) => total + dump.bytes, 0);
+  for (const name of doomed) {
+    try {
+      await rm(path.join(dir, name), { force: true });
+    } catch {
+      // silent-ok: best effort, and the next start tries again.
+    }
+  }
+  logger.info(
+    `core dumps: ${dumps.length} present, keeping the newest ${Math.min(keep, dumps.length)}` +
+      (doomed.length > 0 ? `, removed ${doomed.length} (${(freed / 1e9).toFixed(2)} GB)` : "")
+  );
+}

package/services/hls-session-manager.js

@@ -568,6 +568,36 @@ const SEGMENT_READ_HIGH_WATER_MARK = 4 * 1024 * 1024;
 // second is below any drift a viewer could notice, so anything above it is the
 // index being wrong about where a keyframe is rather than rounding.
 const SEGMENT_START_DISAGREEMENT_SEC = 0.25;
+/**
+ * What ffmpeg's own CLI subtracts from an input seek, and therefore what has to
+ * be added back to land where we asked.
+ *
+ * `fftools/ffmpeg_demux.c`, in `ifile_open`: when the container does not
+ * declare `AVFMT_SEEK_TO_PTS` — Matroska does not — and any stream carries
+ * B-frames, the seek target is moved back by `3*AV_TIME_BASE / 23` before
+ * `avformat_seek_file` is called. Its purpose is sound: such containers seek in
+ * decode order while the caller asks in presentation order, and with B-frames
+ * the two differ, so it backs off far enough to be sure of reaching the frame
+ * asked for.
+ *
+ * The consequence for a COPY is that asking for a keyframe lands on the one
+ * BEFORE it — deterministically, every time. Measured 2026-08-21 on a Matroska
+ * file with keyframes every 2 s: `-ss 10` produced a first segment starting at
+ * 8.000; `-ss 10.130435` produced one starting at 10.000. On MP4, where the
+ * heuristic does not fire, all of 10, 10.130435 and 10.2 produced 10.000 — so
+ * adding this is right in one case and harmless in the other.
+ *
+ * That landing is what `-segment_times` is measured from, while this code
+ * computes those offsets from the time it ASKED for. One keyframe interval
+ * apart, inherited by every cut of the run: 119 of 125 segments arriving a
+ * uniform 2.002 s early in the field, four times what a player bridges.
+ *
+ * Not applied when the picture is re-encoded: a re-encode decodes from the
+ * keyframe and discards frames up to the requested time, so its output already
+ * begins exactly where asked (measured the same day: `-ss 11` copied starts at
+ * 10.000, re-encoded at 11.000).
+ */
+const SEEK_LANDING_OFFSET_SEC = 3 / 23;
 
 /**
  * How far a fragment may land from where the playlist put it before the player
@@ -1146,6 +1176,34 @@ export function segmentCutTimesFrom(boundaries, startIndex) {
   return times;
 }
 
+/**
+ * How much later than a keyframe to ASK, so that ffmpeg lands on that keyframe.
+ *
+ * Bounded by half the distance to the next keyframe, which matters only where
+ * keyframes stand closer together than twice the offset. There no single value
+ * can satisfy both worlds — asking too little lands a keyframe early when the
+ * heuristic fires, asking too much lands a keyframe late when it does not — and
+ * the bound picks the smaller error, which is then under one keyframe interval
+ * and therefore under what a player bridges.
+ *
+ * @param {HlsSession} session
+ * @param {number} keyframe - A real keyframe time the run is to begin at.
+ * @returns {number} Seconds to add to the request.
+ */
+export function seekLandingOffsetFor(session, keyframe) {
+  // A re-encode trims to the requested time itself, so it needs no help and
+  // must not be pushed past what it was asked for.
+  if (session?.transcodeVideo === true) {
+    return 0;
+  }
+  const times = Array.isArray(session?.keyframeTimes) ? session.keyframeTimes : [];
+  const next = times.find((time) => time > keyframe + 0.001);
+  if (next === undefined) {
+    return SEEK_LANDING_OFFSET_SEC;
+  }
+  return Math.min(SEEK_LANDING_OFFSET_SEC, (next - keyframe) / 2);
+}
+
 /**
  * The largest keyframe time that does not exceed `target`, from a SORTED
  * (ascending) array of keyframe times such as {@link probeVideoKeyframeTimes}
@@ -3932,7 +3990,7 @@ export class HlsSessionManager {
     if (snappedKeyframe !== null) {
       const residualSeconds = Math.max(0, seekSeconds - snappedKeyframe);
       if (snappedKeyframe > 0) {
-        args.push("-ss", ffmpegSeconds(snappedKeyframe));
+        args.push("-ss", ffmpegSeconds(snappedKeyframe + seekLandingOffsetFor(session, snappedKeyframe)));
       }
       args.push("-i", session.inputUrl);
       if (residualSeconds > 0) {
@@ -5124,6 +5182,41 @@ export class HlsSessionManager {
    * @param {number} declaredStart - Seconds, from the playlist.
    * @returns {void}
    */
+  /**
+   * Where the run REALLY began, against where it was asked to begin.
+   *
+   * The first piece a run produces is the only statement of this that exists,
+   * and until now nothing compared the two. They disagree whenever the seek
+   * lands somewhere other than the time asked for — which, before the landing
+   * offset, was every run on a Matroska source with B-frames, by exactly one
+   * keyframe interval. Every cut of the run then inherits it, because
+   * `-segment_times` is measured from the landing.
+   *
+   * Said once per run, and only when it matters: within what a player bridges
+   * there is nothing to report.
+   *
+   * @param {HlsSession} session
+   * @param {number} index
+   * @param {number} trueStart
+   * @returns {void}
+   */
+  #noteRunLanding(session, index, trueStart) {
+    if (session.encodeStartIndex !== index || session.landingReportedForRun === index) {
+      return;
+    }
+    session.landingReportedForRun = index;
+    const asked = this.#segmentStartTime(session, index);
+    const drift = trueStart - asked;
+    if (!Number.isFinite(drift) || Math.abs(drift) <= PLAYER_BUFFER_HOLE_SEC) {
+      return;
+    }
+    logger.warn(
+      `transcode ${session.id} run began at ${trueStart.toFixed(3)}s but was asked for ` +
+      `${asked.toFixed(3)}s — ${drift > 0 ? "+" : ""}${drift.toFixed(3)}s, and every cut of this ` +
+      "run is measured from where it began, so the whole run is that far from its playlist"
+    );
+  }
+
   #noteIndexAccuracy(session, index, trueStart, declaredStart) {
     const deviation = Math.abs(trueStart - declaredStart);
     session.indexCheck ??= newIndexCheck();
@@ -7719,6 +7812,7 @@ export class HlsSessionManager {
           : null;
         const declaredStart = this.#segmentStartTime(session, index);
         if (trueStart !== null) {
+          this.#noteRunLanding(session, index, trueStart);
           this.#noteIndexAccuracy(session, index, trueStart, declaredStart);
         }
         // WHERE THE PLAYER WAS TOLD THIS SEGMENT BEGINS, which is the playlist

package/services/torrent-worker/client.js

@@ -22,6 +22,15 @@ import { createCaller, createReceiveStream } from "./channel.js";
 import { Command, Event } from "./protocol.js";
 
 const WORKER_URL = new URL("./worker.js", import.meta.url);
+/**
+ * How long a shutdown waits for the thread to end by itself before forcing it.
+ *
+ * Ending by itself is what lets libuv drain the handle callbacks it is holding;
+ * forcing it is what ran one of those against a freed isolate. Five seconds is
+ * long enough for a destroyed torrent client to release its sockets and short
+ * enough that a shutdown never appears to hang.
+ */
+const WORKER_EXIT_GRACE_MS = 5_000;
 
 /**
  * Runs the torrent client on its own thread and exposes it to the main thread.
@@ -34,6 +43,12 @@ const WORKER_URL = new URL("./worker.js", import.meta.url);
  */
 export class TorrentWorkerClient {
   #worker;
+  /**
+   * Whether this shutdown was asked for, so the thread ending can be told from
+   * the thread dying. Without it both look identical from outside, which is how
+   * five crashes produced no line in the log.
+   */
+  #stopping = false;
   #caller;
   /** Receive-side handles for in-flight reads, keyed by request id. */
   #reads = new Map();
@@ -186,6 +201,30 @@ export class TorrentWorkerClient {
       }
       this.#reads.clear();
     });
+
+    // A worker that ENDS was, until now, not noticed at all: only `message` and
+    // `error` were listened for. So when the thread went away the proxy simply
+    // stopped, the log ended mid-sentence, and nothing said whether we had
+    // asked for it — which is precisely the reading that was missing on
+    // 2026-08-21, when a core dump showed the thread faulting inside
+    // `Environment::CleanupHandles` and there was no way to tell our own
+    // shutdown from the thread ending on its own.
+    this.#worker.on("exit", (code) => {
+      if (this.#stopping) {
+        logger.info(`torrent-worker: thread ended as asked (code ${code})`);
+        return;
+      }
+      logger.error(
+        `torrent-worker: thread ended on its own with code ${code} — nobody asked it to. ` +
+        "Everything waiting on it is failed; the proxy has no torrent client until it is rebuilt."
+      );
+      const reason = new Error("Torrent worker ended unexpectedly.");
+      this.#caller.rejectAll(reason);
+      for (const [, read] of this.#reads) {
+        read.fail(reason);
+      }
+      this.#reads.clear();
+    });
   }
 
   /**
@@ -520,11 +559,33 @@ export class TorrentWorkerClient {
    * @returns {Promise<void>}
    */
   async destroyAll() {
+    this.#stopping = true;
     try {
       await this.#caller.call(Command.DESTROY_ALL, {});
     } catch {
-      // Already gone — termination below is what matters.
+      // Already gone — the wait below settles either way.
     }
-    await this.#worker.terminate();
+    // Let the thread END rather than tearing it down under itself.
+    //
+    // `terminate()` frees the environment immediately, with the handle
+    // callbacks libuv still holds queued. One of those is utp-native's UDP
+    // read, and running it against a freed isolate is what the core dump of
+    // 2026-08-21 caught: `on_utp_accept` → `napi_get_buffer_info` →
+    // `v8::Value::IsArrayBufferView` inside `Environment::CleanupHandles`.
+    // Once the client inside is destroyed the thread has nothing left holding
+    // its loop open, so it exits by itself and the callbacks drain first.
+    //
+    // `terminate()` stays as the bounded fallback, because a shutdown that
+    // hangs is worse than one that is forced.
+    await new Promise((resolve) => {
+      const timer = setTimeout(() => {
+        logger.warn("torrent-worker: thread did not end in 5s; terminating it");
+        void this.#worker.terminate().finally(resolve);
+      }, WORKER_EXIT_GRACE_MS);
+      this.#worker.once("exit", () => {
+        clearTimeout(timer);
+        resolve();
+      });
+    });
   }
 }

package/test/core-dumps.test.js

@@ -0,0 +1,57 @@
+/**
+ * @file Keep the last few core dumps and no more.
+ *
+ * Each is the worker thread's whole address space — 4.18 GB on the field host —
+ * and four of them had nearly filled a 235 GB disk by 2026-08-21. The newest
+ * are evidence for a fault that is still open, so they stay; the rest go.
+ */
+
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import { dumpsToRemove, isCoreDump } from "../services/core-dumps.js";
+
+const dumps = [
+  { name: "core.WorkerThread.81.1787176646", writtenAt: 1787176646000 },
+  { name: "core.WorkerThread.81.1787224562", writtenAt: 1787224562000 },
+  { name: "core.WorkerThread.81.1787237468", writtenAt: 1787237468000 },
+  { name: "core.WorkerThread.81.1787243278", writtenAt: 1787243278000 },
+  { name: "core.WorkerThread.81.1787292750", writtenAt: 1787292750000 }
+];
+
+test("the newest two stay and the rest go, oldest first", () => {
+  assert.deepEqual(dumpsToRemove(dumps), [
+    "core.WorkerThread.81.1787176646",
+    "core.WorkerThread.81.1787224562",
+    "core.WorkerThread.81.1787237468"
+  ]);
+});
+
+test("fewer than the limit leaves everything alone", () => {
+  assert.deepEqual(dumpsToRemove(dumps.slice(0, 2)), []);
+  assert.deepEqual(dumpsToRemove([]), []);
+});
+
+test("order on disk does not decide; the time written does", () => {
+  const shuffled = [dumps[3], dumps[0], dumps[4], dumps[2], dumps[1]];
+  assert.deepEqual(dumpsToRemove(shuffled, 1), [
+    "core.WorkerThread.81.1787176646",
+    "core.WorkerThread.81.1787224562",
+    "core.WorkerThread.81.1787237468",
+    "core.WorkerThread.81.1787243278"
+  ]);
+});
+
+test("only core dumps are considered", () => {
+  assert.equal(isCoreDump("core.WorkerThread.81.1787292750"), true);
+  assert.equal(isCoreDump("proxy.log"), false);
+  assert.equal(isCoreDump("host-timings.json"), false);
+  // Not a path, and not a directory called core.
+  assert.equal(isCoreDump("core.foo/bar"), false);
+  assert.equal(isCoreDump(""), false);
+});
+
+test("nothing readable is not a reason to delete anything", () => {
+  assert.deepEqual(dumpsToRemove(null), []);
+  assert.deepEqual(dumpsToRemove([{ name: 5, writtenAt: "x" }]), []);
+});

package/test/seek-landing.test.js

@@ -0,0 +1,50 @@
+/**
+ * @file Ask ffmpeg late enough that it lands where we meant.
+ *
+ * `fftools/ffmpeg_demux.c` moves an input seek back by `3*AV_TIME_BASE / 23` —
+ * 130.435 ms — whenever the container does not declare `AVFMT_SEEK_TO_PTS` and
+ * a stream carries B-frames. So asking for a keyframe lands on the one before
+ * it, and since `-segment_times` is measured from where the run really began,
+ * every cut of that run inherits the shift.
+ *
+ * Measured 2026-08-21 on Matroska with keyframes every 2 s: `-ss 10` produced a
+ * first segment starting at 8.000, `-ss 10.130435` one starting at 10.000. On
+ * MP4, where the heuristic does not fire, 10, 10.130435 and 10.2 all produced
+ * 10.000 — right in one case, harmless in the other.
+ */
+
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import { seekLandingOffsetFor } from "../services/hls-session-manager.js";
+
+const OFFSET = 3 / 23;
+
+test("a copied picture is asked for one heuristic later than the keyframe", () => {
+  const session = { transcodeVideo: false, keyframeTimes: [0, 2.002, 4.004, 6.006] };
+  assert.equal(seekLandingOffsetFor(session, 2.002), OFFSET);
+});
+
+test("a re-encode is asked for exactly what it should produce", () => {
+  // It decodes from the keyframe and discards frames up to the requested time,
+  // so pushing the request later would start its output late.
+  const session = { transcodeVideo: true, keyframeTimes: [0, 2.002, 4.004] };
+  assert.equal(seekLandingOffsetFor(session, 2.002), 0);
+});
+
+test("the offset never reaches the next keyframe", () => {
+  // Keyframes 0.1 s apart: half of that is the most that can be added without
+  // risking a landing on the NEXT one where the heuristic does not fire.
+  const session = { transcodeVideo: false, keyframeTimes: [0, 0.1, 0.2, 0.3] };
+  assert.equal(seekLandingOffsetFor(session, 0.1), 0.05);
+});
+
+test("the last keyframe has nothing after it to collide with", () => {
+  const session = { transcodeVideo: false, keyframeTimes: [0, 2.002, 4.004] };
+  assert.equal(seekLandingOffsetFor(session, 4.004), OFFSET);
+});
+
+test("no keyframe list is still answered", () => {
+  assert.equal(seekLandingOffsetFor({ transcodeVideo: false }, 5), OFFSET);
+  assert.equal(seekLandingOffsetFor(null, 5), OFFSET);
+});

package/test/tunnel-renewal.test.js

@@ -33,8 +33,12 @@ async function startRegistry() {
   let current = null;
   let opened = 0;
   let everEmpty = false;
+  /** Every socket ever accepted, so the server can be shut without waiting. */
+  const accepted = new Set();
   server.on("connection", (socket) => {
     opened += 1;
+    accepted.add(socket);
+    socket.on("close", () => { accepted.delete(socket); });
     const previous = current;
     current = socket;
     // The replacement is registered BEFORE the old one is closed, so a reader
@@ -52,7 +56,15 @@ async function startRegistry() {
   const { port } = server.address();
   return {
     url: `http://127.0.0.1:${port}`,
-    close: () => new Promise((resolve) => { server.close(resolve); }),
+    // `close` waits for every connection to end, and a renewal can leave one
+    // still closing, so they are ended here rather than waited on.
+    close: () => new Promise((resolve) => {
+      for (const socket of accepted) {
+        socket.terminate();
+      }
+      accepted.clear();
+      server.close(() => resolve());
+    }),
     registered: () => (current && current.readyState === 1 ? 1 : 0),
     killCurrent: () => { current?.terminate(); },
     opened: () => opened,